KR101107740B1 - Apparatus and method for assessing investigation item of voip security checklist - Google Patents

Abstract

PURPOSE: A VoIP(Voice over Internet Protocol) information protection state examination category evaluation apparatus and method thereof are provided to offer the evaluation result of an information protection state by receiving obedience state information from a VoIP service provider. CONSTITUTION: A condition determination unit(210) determines the satisfaction state of an examined category by receiving the evaluation result of an information protection state about one or more examined categories. A page creation unit(240) creates a page in order to display the satisfaction state of the determined examined category. A communication unit(260) receives obedience state information based on an SIP(Session Initiation Protocol). The communication unit transmits the created page.

Description

Apparatus and method for assessing investigation item of VoIP security checklist}

The present invention relates to an apparatus and method for evaluating the status of a VoIP information protection survey, and more particularly, to comply with matters necessary for providing a service from a Voice over Internet Protocol (VoIP) service provider through a SIP (Session Initiation Protocol) based network connection. The present invention relates to an apparatus and method for evaluating the status of a VoIP information protection survey which receives information on whether information is provided and provides an evaluation result thereof.

Voice over Internet Protocol (VoIP) refers to a technology for delivering voice information using IP. This is a technology that delivers voice information in digital form to discontinuous packets, rather than circuit-based protocols such as public switched telephone networks (PSTNs).

On the other hand, unlike PSTN, which is a closed network, there are security threats such as eavesdropping, interruption, denial of service, and billing bypass for VoIP services that deliver voice over the Internet. Occasionally there will be cases where you will have to pay for the phone.

Accordingly, the government of the Republic of Korea proposed the management, physical and technical survey items to conduct a survey on information security of major VoIP service providers. It is to investigate the compliance of the survey items through the information security investigation, recommend the following measures, and conduct security consulting for the small VoIP operators.

However, considering that the provision of secure services can be used as a competitive advantage in the highly competitive VoIP service market, the VoIP service provider periodically checks survey items and takes precautions to compensate for insufficient items. Despite the need to do so, there was no means for VoIP service providers to easily check the survey items.

Therefore, the emergence of the invention that allows the VoIP service provider to easily confirm whether or not the compliance of the survey items for the investigation of information security needs.

An object of the present invention is to receive a compliance information required for providing a service from a Voice over Internet Protocol (VoIP) service provider through a SIP (Session Initiation Protocol) based network connection, and provide an evaluation result thereof.

The objects of the present invention are not limited to the above-mentioned objects, and other objects which are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the VoIP information protection survey item evaluation device according to an embodiment of the present invention by referring to the compliance information received for each of at least one or more survey items required to perform Voice over Internet Protocol (VoIP) business A condition determination unit that determines whether the survey item corresponding to the compliance information is satisfied, a page generator that generates a page for displaying whether the determined survey item is satisfied, and a session initiation protocol (SIP) And a communication unit configured to receive the compliance information based on the received information and to transmit the generated page.

In accordance with an embodiment of the present invention, a method for evaluating survey items of VoIP information security is based on a Session Initiation Protocol (SIP), and information on compliance of at least one survey item for each of the at least one survey item required for performing a Voice over Internet Protocol (VoIP) business Determining whether the survey item corresponding to the compliance information is satisfied with reference to the received compliance information, and generating a page for displaying whether the determined survey item is satisfied. And transmitting the generated page based on a session initiation protocol.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the apparatus and method for evaluating the status of a VoIP information protection survey item of the present invention as described above, information on compliance with matters necessary for providing a service from a Voice over Internet Protocol (VoIP) service provider through a SIP (Session Initiation Protocol) -based network connection By inputting and providing an evaluation result therefor, the VoIP service provider has an advantage in that it can easily check whether the survey item for the information security investigation is observed.

1 is a diagram showing an entire system for evaluating a survey item according to an embodiment of the present invention.
2 is a block diagram showing a survey item evaluation apparatus according to an embodiment of the present invention.
3 is a diagram illustrating a page for receiving an input of checking a check list according to an embodiment of the present invention.
4 is a diagram illustrating a page displaying whether a survey item is satisfied according to an exemplary embodiment of the present invention.
5 is a diagram illustrating a page including the overall status of the integrated security management system according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing an entire system for survey item evaluation according to an embodiment of the present invention, the overall system is a VoIP information protection actual survey item evaluation device (hereinafter referred to as survey item evaluation device) 200 and at least one or more It is configured to include the operator terminal (110, 120).

The survey item evaluating apparatus 200 receives, from the operator terminals 110 and 120, compliance information for each of at least one survey item required for performing a Voice over Internet Protocol (VoIP) business, and corresponding to the compliance information. It determines whether the satisfaction of the and transmits the result to the operator terminal (110, 120).

Here, the survey item is an item for checking whether the VoIP business can be normally performed, and may include at least one of the network security, the terminal security, the VoIP facility security, and the user information protection.

In other words, the network security section and the terminal security section may be presented as a section for determining whether the VoIP business can be normally performed, and at least one survey item may be included in each section.

In addition, each division (hereinafter referred to as the Basic Division) can be divided into more detailed divisions (hereinafter referred to as Subdivisions). For example, the Network Security Division includes VoIP Traffic Monitoring and Security Management Division, Intrusion Detection and Response. Segment, network and terminal access control section, eavesdropping section and spam response section, and terminal security section includes terminal management section, account management section, encryption technology section and spam response section, and VoIP facility security The divisions include the Intrusion Detection Division, the Access Control and Account Management Division, the Log and Security Patch Management Division, and the Password Technology Division, and the User Information Protection Division may be configured to include the Privacy Management Division.

That is, at least one detailed section is included for each basic section, and at least one survey item may be included for each detailed section. For example, if the foundation is network security, and the subdivisions are VoIP traffic monitoring and security management, then the question "Do you have a system that can monitor and manage VoIP traffic?" Do you operate an integrated management system for VoIP security devices to protect the system? "

In the present invention, the compliance information on the survey item is information including whether the operator terminal (110, 120) is properly performing the contents of the survey item, which may be manually input by the operator (111, 121) It may be generated automatically. That is, the business operators 111 and 121 may directly input whether or not to observe each survey item through a page for inputting whether or not the survey item received from the survey item evaluator 200 is input. It is transmitted to the survey item evaluation device 200 as compliance information.

In addition, the compliance information may be automatically generated by the operator terminal (110, 120), the operator terminal (110, 120) generates a message corresponding to the survey item of the plurality of messages set in advance, the Compliance information is generated by inserting an appropriate value into a field corresponding to a survey item among fields.

When the compliance information is manually input, a check list is provided for each survey item, and the check list means a list of query statements presented to VoIP providers 111 and 121. For example, for the question "Do you have a system that can monitor and manage VoIP traffic?", Use the network monitoring tool and system to check the in / out bound traffic that is communicated between the backbone network and the main node. Are you monitoring 24 hours? "And" Is your network monitoring tools and systems available for 24 hours monitoring In / Out bound traffic on major lines connected to external networks? " Hereinafter, each query statement constituting the check list is called a check item.

Here, the check item preferably has the form of a query statement. Accordingly, the operators 111 and 121 may simply input one of “yes” or “no” to input whether or not to comply with the check item.

The operator terminals 110 and 120 have a function of performing packet inspection of an application layer from dynamic port filtering, a function of detecting a cross protocol according to separation of a signaling protocol and a media protocol, and an attack detection function based on protocol state and session state. As a device for providing a VoIP service, a page (hereinafter referred to as a check list confirmation page) for receiving input from a survey item evaluating apparatus 200 for checking whether a check list is received is displayed and displayed by the operator (111, 121). It receives the compliance status for each check item from the role of transmitting to the survey item evaluation device 200.

In addition, as described above, the operator terminals 110 and 120 may generate a message corresponding to the survey item and transmit the message to the survey item evaluation device 200.

Session Initiation Protocol (SIP) is an application layer protocol that specifies a procedure that allows a plurality of terminals on the Internet to identify each other, find their location, and create, delete, and change sessions of multimedia communications. Meaning, it is mainly used for multimedia services such as Internet-based conferencing, telephone and event transmission and reception without distinction of Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).

In the present invention, the communication between the survey item evaluating apparatus 200 and the operator terminals 110 and 120 may be implemented based on a session initiation protocol. For this purpose, the survey item evaluating apparatus 200 and the operator terminals 110 and 120 may have a session. It is preferable that a means for communicating based on the initiation protocol is provided, and as described above, messages having separate formats can be transmitted and received to each other for security.

For example, a message transmitted and received between the survey item evaluating apparatus 200 and the operator terminals 110 and 120 may include an alert message, a resource message, a control message, and a device message, and the alert message may be an operator terminal 110 or 120. Information on the attack detected or responded to, the origin and destination of the attack, the SIP service information to be attacked, and the method of classifying and blocking the attack, and the resource message includes CPU, memory, disk, network interface card, and SIP traffic statistics information. , SIP call setup information and SIP session state information, the control message is a security policy message that can transmit and manage configuration / failure and security policy commands that can control the execution and start of the operator terminal (110, 120) In this regard, the Device message relates to a message for informing the system status of the operator terminal (110, 120).

Accordingly, messages transmitted and received may vary depending on the survey item. For example, the question “Do you have a system that can monitor and manage VoIP traffic?” Checks whether the operator terminals 110 and 120 have a means to monitor and manage VoIP traffic. As an item to be described, the survey item may be transmitted and received between the survey item evaluation device 200 and the operator terminals 110 and 120 through a Device message and a Resource message.

The network connects the survey item evaluating apparatus 200 and the operator terminals 110 and 120 with each other to relay transmission and reception of data between the devices.

In the present invention, the network is preferably a wired or wireless Internet, but is not limited thereto. A separate wired or wireless network such as a telephone network or a mobile communication network may serve as a network.

2 is a block diagram illustrating an apparatus for evaluating survey items according to an exemplary embodiment of the present invention, wherein the apparatus for evaluating survey items 200 includes a communication unit 260, a storage unit 220, a control unit 230, and a page generation unit 240. And an item manager 250 and a condition determiner 210.

The communication unit 260 receives from the operator terminals 110 and 120 compliance information on each of at least one survey item necessary for performing a VoIP business, and transmits a page generated by the page generator 240. do. At this time, the communication unit 260 may perform data transmission and reception based on the session initiation protocol.

The communication unit 260 may participate in a network by wired or wireless communication. Communication methods used by the communication unit 260 include Ethernet, Public Switched Telephone Network (PSTN), Mobile Communication Network, Wireless LAN, Bluetooth, Wi-Fi (Wireless Fidelity), There may be UMTS (Universal Mobile Telecommunications System), HSDPA (High Speed Downlink Packet Access), WiBro (Wireless Broadband), etc. Of these, it is most preferable to use an Ethernet wired communication method.

The storage unit 220 stores data received from the operator terminals 110 and 120, such as compliance information. In addition, the storage unit 220 may store a basic section, a detailed section, a survey item, and a check list corresponding to each survey item, and are generated by the page generator 240 for transmission to the operator terminals 110 and 120. It can also play a role of temporarily storing pages.

In addition, the storage unit 220 may store a value that can be input to each field of the message to be transmitted and received. With this reference, the condition determination unit 210 may determine whether the survey item is observed.

The storage unit 220 may include a hard disk, a flash memory, a compact flash card (CF), a secure digital card (SD), a smart card (SM), a multimedia card (MMC), or a memory stick. May be provided inside the survey item evaluating apparatus 200 as a module capable of inputting / outputting, or may be provided in a separate apparatus.

The condition determining unit 210 determines whether the survey item corresponding to the compliance information is satisfied with reference to the compliance information received from the operator terminals 110 and 120.

To this end, the condition determiner 210 calculates a score for a corresponding survey item according to the received compliance information, and satisfies the survey item by referring to a score range including a calculated score among a plurality of preset score ranges. It can be determined.

For example, a first score range of 0 or more and 3 or less and a second score range of 3 or more and 5 or less are set. If the calculated score is 0, the result is "not satisfied". When included in the first score range "some satisfaction", if the calculated score is included in the second score range may be determined as "satisfaction".

Here, when the compliance information is manually input and received, the score for the survey item may be understood as an average of the scores of the check list of the survey item. For example, if one check item contains three check items, and each check item has a score of 0, 5, and 3 points, the average of the check items is about 2.67. 2.67.

As described above, the compliance information may be manually input by the operators 111 and 121, and may be automatically input by the operator terminals 110 and 120. In other words, the score for the survey item may be calculated by referring to whether the user is manually inputted or received by the service providers 111 and 121 or automatically generated and received.

For example, when the operators 111 and 121 manually input the scores, the scores may be assigned between 0 and 5 by referring to the compliance of each item, and the scores may be given by using the above-mentioned message if the operators are automatically entered. You can do it. Here, scoring using a message may be performed by referring to information included in the message. For example, "Do you operate a system that can monitor and manage VoIP traffic?" If the message includes a value indicating that the equipment for monitoring and managing the VoIP traffic is implemented, the condition determination unit 210 may give a score, otherwise it may not give a score. In addition, when a message is periodically received from the device, the condition determination unit 210 may give a higher score than when the message is simply received once.

Meanwhile, there may be a case where compliance information is manually input and received and automatically generated and mixed, where the condition determination unit 210 is manually input and received scores (hereinafter, manual). The score for the survey item may be calculated by assigning a weight to each of the scores (hereinafter referred to as automatic scores) for the automatically generated and received scores.

For example, the condition determination unit 210 may calculate a score for the survey item by assigning weights of 0.6 and 0.4 to the manual scores and the automatic scores, respectively. Here, the weight may be determined by the manager of the survey item evaluation device 200.

The page generator 240 generates a page for displaying whether the survey item determined by the condition determiner 210 is satisfied.

In the present invention, the page can be understood as any screen configuration that can display information such as text or image to the user, in fact, the page is generated by the browser on the operator terminal (110, 120) side, the survey item evaluation device 200 is to transmit a document to generate a page to a browser, but the page in the present invention can be understood as a page itself or a document to generate a page.

The item manager 250 manages the basic section, the detailed section, the survey item, and the check item stored in the storage 220. That is, the classification and the contents of the items may be changed by the administrator. The item manager 250 stores the new items in the storage 220 or deletes the existing items in response to a user command input from the manager. You can also modify some of the contents of an existing item.

In addition, the item manager 250 may play a role of managing a value that can be input to each field of the message.

In the present invention, each survey item has a minimum requirement for determining whether the survey item is in compliance or not, and thus a message and a field of the message may be determined accordingly.

For example, the minimum requirement, such as "traffic" and "monitoring," can be set for the question "Do you have a system that can monitor and manage VoIP traffic?" It can be understood as a matter that must be checked in order to determine whether the survey item is observed.

Such minimum requirements may be set by experts in advance. As the minimum requirements are set, the message and the field of the message corresponding to the survey item are determined, and the determined field of the message field stored in the storage 220 is determined. The value is managed through the item manager 250.

The controller 230 performs overall control of the communication unit 260, the storage unit 220, the page generation unit 240, the item manager 250, and the condition determination unit 210, and relays data transmission and reception between each module. It plays a role.

In addition, although not shown in FIG. 2, the research item evaluating apparatus 200 may be provided with a display means to display the check result page 400 and the entire status page 500 which will be described later.

3 is a diagram illustrating a page (hereinafter referred to as a check list page) for receiving input of whether or not to check a check list according to an embodiment of the present invention, and the operators 111 and 121 may use the check list page shown in FIG. Through 300, it is possible to input whether or not to comply with each check item.

The check list page 300 includes a period setting part 310, a check result calculation method part 320, and a compliance status input part 330.

Through the period setting part 310, the operators 111 and 121 may input a period in which all conditions for protecting VoIP information are satisfied, and the operators 111 and 121 may check through the check result calculation method 320. It may be determined whether the score for the item is to be calculated according to manual input, to be calculated according to automatic input, or to be calculated according to mixed input.

In the check result calculation method part 320 of FIG. 3, "use only user check result" means manual input, "use only SSMS collection result" means automatic input, and "use both" means mixed input. do. Here, SSMS means a SIP-based integrated security management system (SSMS), and the system shown in FIG. 1 may be understood as a SIP-based integrated security management system.

The compliance status input portion 330 includes a division field 331, a survey item field 332, a check list field 333, and a confirmation field 334.

In the division field 331, the above-described basic divisions and subdivisions may be selectively combined and specified, and FIG. 3 specifies only the subdivisions in the division field 331, but is not limited thereto.

The survey item field 332 may specify a survey item, which is an item for checking whether the VoIP business can be normally performed. There may be more than one survey item for each sector.

A check item corresponding to a survey item may be specified in the check list field 333, and a means for receiving input of compliance with the check item may be specified in the confirmation field 334.

As a result, the operators 111 and 121 input the compliance of each check item specified in the check list field 333 into the corresponding confirmation field 334. For this purpose, the operator terminals 110 and 120 may use a keyboard or a mouse. Input means may be provided.

4 is a diagram illustrating a page (hereinafter, referred to as a check result page) displaying whether a survey item is satisfied according to an exemplary embodiment of the present invention, wherein the administrator of the survey item evaluating apparatus 200 checks the check result page 400. Through it, it is possible to determine the business performance capability for the VoIP providers 111 and 121.

The check result page 400 includes a period setting part 410, a check result calculation method part 420, a survey item part 430, a check result part 440, and a check list part 450.

Through the period setting part 410, the administrator may input a period during which the check result is calculated. For example, the check result may vary according to the period, and the administrator may input a start date and an end date included in the period setting part 410 to check the result of the point capture.

The check result calculation method part 420 allows the administrator to decide whether to display the check result according to the manual input, the check result according to the automatic input, or the check result according to the mixed input. have. For example, when "Use only user check results" is selected, the check result portion 440 displays only the check results according to the manual input without the check result according to the automatic input, and "Use only the SSMS collection results" is selected. In this case, the check result portion 440 displays only the check result according to the automatic input, in which the check result according to the manual input is excluded, and when "use both" is selected, the check result part 440 only checks the result according to the mixed input. Will be displayed

In the survey item part 430, statistical data on whether the survey item is satisfied may be specified. For example, the number of satisfied or partially satisfied or unsatisfied survey items may be specified, where the number refers to the number of survey items.

The check result portion 440 includes a division field 441, a survey item field 442, and a check result field 443.

In the division field 441, a basic division and a detailed division may be selectively combined.

The survey item field 442 may specify a survey item, which is an item for checking whether the VoIP business can be normally performed. There may be more than one survey item for each sector.

The check result field 443 displays a check result for the survey item. That is, it is specified whether the survey item satisfies the condition or partially satisfies the condition, and whether the survey item is satisfied may be displayed as text or a figure. 4 illustrates whether the figure is satisfied by the figure, and the figure displayed in the check result field 443 is preferably kept consistent with the figure of the survey item portion 430.

The administrator may check whether or not the check item is compliant with a specific survey item, and the checklist portion 450 includes a check list corresponding to the survey item selected by the manager and whether the check item is compliant. Accordingly, the manager can check whether or not the check items are observed for the corresponding survey item.

In the above description, the check result page 400 may be confirmed by the administrator of the survey item evaluating apparatus 200, but may be displayed through the operator terminals 110 and 120. That is, the VoIP service providers 111 and 121 may check the service capability of their service providers terminals 110 and 120 through the check result page 400.

FIG. 5 is a diagram illustrating a page including the overall status of the integrated security management system according to an embodiment of the present invention (hereinafter, referred to as the overall status page). The overall status page 500 is a variety of information on the current status of providing VoIP service. And whether or not a survey item 510 for performing a VoIP business is satisfied. 5 is a graph showing whether the survey items for the VoIP business are satisfied.

The entire status page 500 may be displayed through the survey item evaluating apparatus 200 and the operator terminals 110 and 120, through which the manager of the survey item evaluating apparatus 200 and the VoIP service providers 111 and 121 may correspond. It is possible to check the overall status of the operator terminal (110, 120).

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. You will understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

210: condition determination unit 220: storage unit
230: control unit 240: page generation unit
250: item management unit 260: communication unit

Claims (14)

A condition determination unit that determines whether the survey item corresponding to the compliance information is satisfied by referring to the compliance information received for each of at least one survey item required for performing a Voice over Internet Protocol (VoIP) business;
A page generator for generating a page for displaying whether the determined survey item is satisfied; And
It includes a communication unit for receiving the compliance information based on the Session Initiation Protocol (SIP), and transmits the generated page,
The condition determining unit calculates a score for a corresponding survey item according to the received compliance information, and determines the satisfaction by referring to a score range including the calculated score among a plurality of preset score ranges. Protection status investigation item evaluation device. delete The method of claim 1,
And the condition determining unit calculates a score for the survey item by referring to whether the compliance information has been manually input and received by the user or is automatically generated and received. The method of claim 3,
The condition determining unit, when the compliance information is input and received by the manual input and the automatically generated and received, the score for the manually input and received and for the automatically generated and received An apparatus for evaluating the VoIP information protection fact finding item by weighting each score to calculate a score for the survey item. The method of claim 3,
The condition determining unit, when the compliance information is automatically generated and received, whether a message corresponding to a survey item to be determined as the compliance information is received, and whether a value of a corresponding message field is included in the received message. VoIP information protection fact finding item evaluation device for calculating a score for the survey item with reference to. The method of claim 1,
And at least one survey item for each of the network security section, the terminal security section, the VoIP facility security section, and the user information protection section. The method of claim 6,
The network security section includes VoIP traffic monitoring and security management section, intrusion detection and response section, network and terminal access control section, eavesdropping section and spam response section,
The terminal security section includes a terminal management section, an account management section, a encryption technology section, and a spam response section.
The VoIP facility security section includes an intrusion detection section, an access control and account management section, a log and security patch management section, and a encryption technology section.
And said user information protection section comprises a personal information handling management section. Receiving compliance information for each of at least one or more survey items required for conducting a Voice over Internet Protocol (VoIP) business based on a Session Initiation Protocol (SIP);
Determining whether the survey item corresponding to the compliance information is satisfied with reference to the received compliance information;
Generating a page for displaying whether the determined survey item is satisfied; And
Transmitting the generated page based on a session initiation protocol;
The determining of whether the survey item is satisfied may include calculating a score for a corresponding survey item according to the received compliance information, and referring to a score range including the calculated score among a plurality of preset score ranges. A method for evaluating a VoIP information security survey item including determining whether it is satisfactory. delete The method of claim 8,
The step of calculating a score for the survey item includes calculating a score for the survey item by referring to whether the compliance information is manually inputted or received by a user or automatically generated and received. How to Evaluate VoIP Information Security Survey Items. The method of claim 10,
The step of calculating a score for the survey item may include the score for the manually input and received when the compliance information is mixed with the manually input and received and the automatically generated and received. Calculating a score for the survey item by assigning a weight to each of the scores generated and received in the VoIP information protection survey item evaluation method. The method of claim 10,
The calculating of the score for the survey item may include: when the compliance information is automatically generated and received, whether a message corresponding to the survey item to be determined as the compliance information is received and a value of the corresponding message field is determined. And calculating a score for the survey item with reference to whether the message is included in the received message. The method of claim 8,
And at least one survey item includes at least one of network security, terminal security, VoIP facility security, and user information protection. The method of claim 13,
The network security section includes VoIP traffic monitoring and security management section, intrusion detection and response section, network and terminal access control section, eavesdropping section and spam response section,
The terminal security section includes a terminal management section, an account management section, a encryption technology section, and a spam response section.
The VoIP facility security section includes an intrusion detection section, an access control and account management section, a log and security patch management section, and a encryption technology section.
And said user information protection section comprises a personal information handling management section.

Images