KR101218698B1 - Method of realizing network security solution for supporting several IP version - Google Patents

Abstract

The present invention relates to a network security solution implementation method that supports a plurality of IP versions by classifying and processing the input network packet based on the version information of the IP header portion. In the first embodiment according to the present invention, the network device driver 201 checks the version of the input network packet based on the first 4 bit version information among the 20 byte IP header portions (S401). In step S402, network packets are classified and stored according to the checked version. Subsequently, the library 102 loads the temporarily stored network packets (S403) and transmits them to the corresponding engines 101a and 101b, and the pattern matching accelerator 300 receives the IPv4 and IPv6 engines 101a and 101b. In operation S404, the payload portion of the network packet received through the library 102 and the pattern matching accelerator driver 301 is sequentially compared with a predetermined number of intrusion patterns. If the comparison result is the same (YES in S405), the IPv4 and IPv6 engines 101a and 101b store the comparison result (S406) and selectively block the input of the corresponding network packet (S407). Accordingly, the present invention is a very useful invention that can more actively cope with the fluid network security-related market situation.

Network packet, IP version, IPv4, IPv6, IP header

Description

Method of realizing network security solution for supporting several IP version}

1 is a block diagram illustrating a system to which a conventional method for implementing a network security solution supporting IPv4 is applied.

2 is a configuration block diagram of a system applied to the first embodiment according to the present invention.

3 illustrates the format of an IP header portion in a network packet.

4 is a flowchart illustrating a method for implementing a network security solution supporting a plurality of IP versions applied to the first embodiment according to the present invention.

          <Description of the symbols for the main parts of the drawings>

10,100: GUI management console 11,101a: IPv4 engine

12,102 library 20,200 network device

21,201: Network Device Drivers

22,202a: IPv4 protocol stack

30,300: Pattern Matching Accelerator

31,301: Pattern Matching Accelerator Driver

101b: IPv6 engine 202b: IPv6 protocol stack

The present invention relates to a method for implementing a network security solution that supports a plurality of IP versions, and more particularly, to process a plurality of IP versions by classifying and processing an input network packet based on version information of an IP header part. The present invention relates to a network security solution implementation method.

As the Internet has become an information and communication infrastructure (infra) in the information society, the shortage of the Internet address is intensifying due to the increase of the Internet use media.

IPv4, which is a conventionally used Internet address, has a format of xxx.xxx.xxx.xxx, and FIG. 1 is a block diagram of a system to which a conventional network security solution implementation method is applied. The network intrusion detection system and the lower firewall system work in conjunction.

As shown in FIG. 1, in a network intrusion detection system on a system to which a conventional method for implementing a network security solution supporting IPv4 is applied, a graphical user interface (GUI) management console 10 has an IP version of IPv4. The engine can be registered and managed, and it provides monitoring functions to apply / manage intrusion prevention policy, firewall policy, NAT (network address translation) policy, QoS policy, and check intrusion detection / blocking result log or firewall log. do.

In the network intrusion detection system, the IPv4 engine 11 receives a network packet having an IP version of IPv4 from the library 12, and then, except for the IP header portion, that is, only the payload portion of the firewall system is described below. It transmits to the pattern matching accelerator driver 31 and the pattern matching accelerator 30. The IPv4 engine 11 receives the intrusion pattern comparison result from the pattern matching accelerator 30, stores the comparison result, that is, a log, and selectively blocks the input of the corresponding network packet according to the comparison result. It performs network intrusion prevention function, NAT function, and QoS function.

The library 12 loads the network packet temporarily stored in the IPv4 protocol stack 22 of the firewall system described later, processes the packet according to a designated format, and transmits the packet to the IPv4 engine 11.

In addition, in the firewall system at the bottom of the system to which the conventional network security solution implementation method supporting IPv4 is applied, the network device 20 is a physical device to which a network packet is input, and the network device driver 21 is the network device 20. Temporarily stores the network packet input through the IPv4 protocol stack 22.

In the firewall system, the pattern matching accelerator 30 sequentially compares network packets of IPv4 received from the IPv4 engine 11 of the network intrusion detection system with a predetermined number of intrusion patterns stored in advance. The pattern matching accelerator 30 transmits the comparison result to the IPv4 engine 11 through the pattern matching accelerator driver 31.

The system to which the conventional network security solution implementation method that supports and configures the above-described IPv4 is applied supports only one IP version whose IP version is IPv4.

However, in order to solve the problem of address exhaustion by IPv4, routing efficiency, security feature mobility support, and QoS guarantee, as the new version of the Internet address IP version IPv6 having the format xxx.xxx.xxx.xxx.xxx.xxx has been developed, Currently, IPv4 is widely used, but IPv6 will be gradually used, and according to the government's IT 839 policy, Korea is expected to move to IPv6 within the next 10 years.

Therefore, because IPv4 and IPv6 internet addresses are mixed, there is a need for a security product capable of supporting both IPv4 and IPv6 simultaneously. Furthermore, there is an urgent need to develop a security product that can support all of the various IP versions to be proposed in the future. to be.

Therefore, the present invention was created to solve the above-mentioned requirements, and implements a network security solution method for supporting a plurality of IP versions by processing the network packets inputted by version based on the version information of the IP header part. The purpose is to provide.

Network security solution implementation method for supporting a plurality of IP version according to the first embodiment of the present invention for achieving the above object, to check the IP (Internet Protocol) version (version) of the network packet (packet) input First step; A second step of classifying and temporarily storing the network packet according to the checked version; A third step of sequentially comparing the remaining portions except for the IP header portion in each of the temporarily stored network packets with a predetermined number of intrusion patterns stored in advance; And if the comparison result is the same, a fourth step of selectively blocking the corresponding network packet.

The IP version may be IPv4 or IPv6.

The first step may be based on first 4-bit version information of an IP header portion of the network packet.

According to the above-described flow, the network security solution implementation method for supporting a plurality of IP versions according to the present invention, the plurality of IP versions by processing the network packet inputted by the version based on the version information of the IP header portion. Support.

Hereinafter, a method for implementing a network security solution supporting a plurality of IP versions will be described in detail with reference to the accompanying drawings.

For reference, in the present embodiment, only the IP version of the network packet is referred to as IPv4 and IPv6, but even if more IP versions except for IPv4 and IPv6 are developed and distributed in the future, the same without departing from the basic spirit of the present invention. It can be said that it can be applied in advance.

FIG. 2 is a block diagram illustrating a system applied to the first embodiment of the present invention. The network intrusion detection system at the top of the system and the firewall system at the bottom operate in conjunction with each other. FIG. 3 is a format of an IP header portion of a network packet. (format) is shown.

In the network intrusion detection system on the top of the system applied to the first embodiment according to the present invention as shown in FIG. 2, the GUI management console 100 may register and manage an engine whose IP versions are IPv4 and IPv6. It provides monitoring function to apply / manage prevention policy, firewall policy, NAT policy, QoS policy, and check intrusion detection / blocking result log or firewall log.

In the network intrusion detection system, the IPv4 and IPv6 engines 101a and 101b receive network packets having IP versions of IPv4 and IPv6, respectively, from the library 102, and then pay the rest of the packet except the IP header. ) Is transmitted to the pattern matching accelerator driver 301 and the pattern matching accelerator 300 of the firewall system which will be described later.

The IPv4 and IPv6 engines 101a and 101b receive the intrusion pattern comparison result from the pattern matching accelerator 300 and store the comparison result, that is, the log, and optionally the corresponding network packet according to the comparison result. Perform network intrusion prevention function, NAT function, QoS function to block input

The library 102 loads the network packets temporarily stored in the IPv4 protocol stack 22 of the firewall system to be described below for each IP version and processes them according to a specified format, and then the IPv4 and IPv6 engines 101a, 101b).

In the firewall system at the bottom of the system applied to the first embodiment according to the present invention, the network device 200 may be exemplified as a LAN card in a general computer system and is a physical device to which a network packet is input.

In the firewall system, the network device driver 201 may be exemplified as a LAN card driver in a general computer system, and the network packet inputted through the network device 200 may be configured according to the IP version of the IPv4 and IPv6 protocol stacks. Temporarily stored in 202a and 202b, respectively. At this time, the network device driver 201 stacks the network packet based on the first 4-bit version information (see FIG. 3) of the IP header portion of the network packet inputted through the network device 200. It is divided into 202a and 202b and stored temporarily.

In addition, the pattern matching accelerator 300 in the firewall system, the network packet of the IPv4 and IPv6 received from the IPv4 and IPv6 engine (101a, 101b) of the network intrusion detection system, a predetermined number of pre-stored intrusion pattern (pattern) And compare sequentially. The pattern matching accelerator 300 transmits the comparison result to the IPv4 and IPv6 engines 101a and 101b through the pattern matching accelerator driver 301, so that the IPv4 and IPv6 engines 101a and 101b respectively receive the comparison result. It performs network intrusion prevention function, NAT function, and QoS function to save log and selectively block the input of corresponding network packet according to the comparison result.

4 is a flowchart illustrating a method for implementing a network security solution supporting a plurality of IP versions applied to the first embodiment according to the present invention.

Hereinafter, a method of implementing a network security solution supporting a plurality of IP versions applied to the first embodiment according to the present invention will be described in detail with reference to the operation of the system configured as described above.

First, when a network packet is input through the network device 200 of the firewall system, the network device driver 201 uses the first 4 bits of the 20-byte IP header part as the version of the input network packet. Check based on version information (see FIG. 3) (S401). The network device driver 201 classifies network packets according to the checked versions and temporarily stores them in the IPv4 and IPv6 protocol stacks 202a and 202b (S402).

After the input network packets are temporarily stored in the IPv4 and IPv6 protocol stacks 202a and 202b of the firewall system according to their versions, the library 102 of the network intrusion detection system is configured to store the IPv4 and IPv6 protocol stacks 202a and 202b. IPv4 and IPv6 versions of the network packets are loaded (S403), and each of the loaded network packets is processed according to a specified format and transmitted to the IPv4 and IPv6 engines 101a and 101b, respectively.

Subsequently, the IPv4 and IPv6 engines 101a and 101b transmit the payload portion to the library 102 except for the IP header portion in the IPv4 and IPv6 version of the network packet received from the library 102. do. The library 102 then transmits the payload portion of the received network packet to the pattern matching accelerator driver 301 of the firewall system.

The pattern matching accelerator driver 301 transmits a payload portion of the network packet to the pattern matching accelerator 300. The pattern matching accelerator 300 sequentially compares the payload portion of the network packet received from the library 102 and the pattern matching accelerator driver 301 with a predetermined number of intrusion patterns previously stored ( S404) The comparison result is transmitted to the IPv4 and IPv6 engines 101a and 101b by the version through the pattern matching accelerator driver 301 and the library 102, respectively.

Then, the IPv4 and IPv6 engines 101a and 101b store a log corresponding to the comparison result when the comparison result is the same (YES in S405) (S406), and the network packet corresponding to the intrusion pattern that is fatal to the system. Blocking the input and allowing the input of the network packet corresponding to the intrusion pattern that does not harm the system so as to selectively block the input of the network packet (S407).

As described above, the present invention has been described with reference to the embodiments shown in the drawings, which are merely exemplary, and those of ordinary skill in the art to which the present invention pertains should not depart from the spirit and scope of the present invention. It will be apparent that various modifications, changes and equivalent other embodiments are possible without departing. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

As described above, a method for implementing a network security solution supporting a plurality of IP versions according to the present invention supports a plurality of IP versions by classifying and processing a network packet input based on version information of an IP header part. This is a very useful invention that enables us to proactively cope with the market situation related to flexible network security.

Claims (3)

In the network security solution implementation method executed in the network intrusion detection system, the network security solution implementation method is A first step of checking a version of the IP based on version information in an IP (Internet Protocol) header portion of an input network packet; A second step of classifying and temporarily storing the network packets according to the checked version of the IP; A third step of loading each temporarily stored network packet by version and sequentially comparing a payload portion except for the IP header portion from the loaded network packet with a predetermined number of intrusion patterns stored in advance; step; And And a fourth step of storing a log corresponding to the comparison result and blocking input of a corresponding network packet to an intrusion pattern. The method of claim 1, The IP version is an IPv4 or IPv6 network security solution implementation method for supporting a plurality of IP versions, characterized in that. The method according to claim 1 or 2, And the first step is based on the first 4-bit version information of the IP header portion of the network packet.

Images