KR101341451B1 - System for checking firewall using harmful information db - Google Patents

Abstract

The present invention relates to a system which checks a firewall for protecting a network and, more specifically, to a firewall checking system using a harmful information database capable of checking a current security state and rapidly responding to future risks by previously checking weak points of a firewall policy; increasing the utility of a set of information for the weak points and the convenience of risk analysis; evaluating the comprehensive risk of firewall equipment and a network environment by extending the security analysis of an individual policy of the firewall; and increasing the stability and the convenience of a manager by modifying the firewall policy through automatically modifying the firewall policy according to an analysis result for the weak points of the firewall and updating automated harmful information. [Reference numerals] (1) Information collection unit;(11) Harmful information collection unit;(12) Policy information collection unit;(13) Asset information collection unit;(14) Connection information collection unit;(2) Information analysis unit;(21) Policy check unit;(22) Risk calculation unit;(221) Policy risk calculation unit;(222) Equipment risk calculation unit;(223) Site risk calculation unit;(3) Policy calculation unit;(31) Matching information calculation unit;(32) Matching policy calculation unit;(4) Report modification unit;(41) Information provision unit;(42) Policy modification unit;(5) Policy update unit;(51) Connection determination unit;(52) Non-matching information calculation unit;(53) Non-matching policy calculation unit;(54) Update determination unit

Description

System for checking firewall using harmful information DB}

The present invention relates to a system for inspecting a firewall that protects a network. More specifically, the system can diagnose the current security status and respond quickly to future risks by pre-checking the vulnerability of the firewall policy, and analyze the vulnerability of the firewall. By providing the results quantitatively, the effectiveness of vulnerability information and the convenience of risk analysis can be increased, and the safety analysis of individual policies of the firewall can be extended to assess the overall risk of firewall equipment and network environment. Therefore, it is about firewall inspection system utilizing harmful information database that can improve stability and convenience of administrator because it revises policy of firewall through quick response and automatic update of harmful information.

As all information of a company or organization is stored on a computer and the computing environment is diverse and complicated, information security measures are increasingly important between the network of the company or organization and the Internet. This is done by a firewall that allows and blocks traffic in and out of the condition. Illegal access through the network takes place through various harmful IPs and ports in various countries, and a good internal user becomes a subject of malicious attacks (zombie PC, botnet) by various attack methods such as email, phishing, pharming, etc. In this environment, both external attacks and malicious actions (access to harmful IP) from the inside need to be identified, and IP conversion by various techniques and zero-day attacks are required. It is important to maintain hazardous information.

Referring to the patent document below, the firewall checks the security vulnerability of the web server to protect the network.

Korean Patent Publication No. 10-2009-038683 (published Apr. 21, 2009) "Automatic Vulnerability Diagnosis Web Firewall and Vulnerability Diagnosis Method Using the Same"

However, the firewall can not only completely protect the network from harmful information by providing vulnerability information in the form of warnings and lists of individual firewall policies, but also has inconveniences in use.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems,

The present invention diagnoses the current security status by checking the vulnerability of the firewall policy such as attack from harmful IP (URL), connection to harmful IP (URL), open of vulnerable port, etc. The purpose is to provide a firewall inspection system that utilizes a harmful information database that can respond quickly to.

In addition, an object of the present invention is to provide a firewall inspection system utilizing a harmful information database that can quantitatively provide the results of vulnerability analysis of the firewall, thereby increasing the utility of vulnerability information and convenience of risk analysis.

In addition, an object of the present invention is to provide a firewall inspection system utilizing a harmful information database that can evaluate the overall risk of the firewall equipment and network environment by extending the safety analysis of the individual policy of the firewall.

In addition, the present invention can improve the network stability through a quick response to automatically modify the policy of the firewall according to the results of the firewall vulnerability analysis to provide a firewall inspection system using a harmful information database having improved convenience. have.

In addition, an object of the present invention is to provide a firewall inspection system using a harmful information database that can update the policy of the firewall through automated harmful information update to increase the stability and convenience of the administrator.

In order to achieve the above object, the present invention is implemented by the following embodiments.

According to an embodiment of the present invention, the firewall inspection system using the harmful information database according to the present invention compares and analyzes the information collecting unit for collecting security information from the network, and the harmful information and security information collected by the information collecting unit And an information analyzer for checking a vulnerability of the firewall of the network, wherein the information collector includes a policy information collector for collecting policy information of a firewall protecting the network, and the information analyzer is collected by the policy information collector. Comparing and analyzing the policy information to the harmful information, characterized in that it comprises a policy check unit for classifying a weak policy when the packet having the harmful information passes through the firewall.

According to another embodiment of the present invention, in the firewall inspection system using the harmful information database according to the present invention, the information collecting unit further includes a harmful information collecting unit for collecting harmful information from the harmful information DB, the harmful information is It includes a harmful IP, harmful URL, vulnerable PORT, the policy check unit is characterized in that it is determined whether the harmful information of the vulnerable policy is included in the policy origin, destination, service.

According to another embodiment of the present invention, in the firewall check system using the harmful information database according to the present invention, when the policy check unit determines that the policy of the firewall is a weak policy, the analysis result of the policy check unit According to the characterized in that it further comprises a risk calculation unit having a policy risk calculation unit for calculating the risk of each policy of the firewall.

According to another embodiment of the present invention, in the firewall check system using the harmful information database according to the present invention, the information collecting unit further collects the asset information collecting unit for collecting information on the value of each information asset constituting the network The policy risk calculation unit may include a policy risk calculation according to Equation 1 below in consideration of the degree of risk of harmful information, the degree of risk of asset information, and the degree of risk in the direction of attack.

[Equation 1]

rRule = (rRule_t) / Max (rRule_t) * 100, rRule_t = [{Max (SV) + Max (DV) + Max (rP)} * Max (rAs)] * (rTI or rTO or rTInt)

In Equation 1 above, rRule is the policy risk, rRule_t is the policy risk medium value, Max (rRule-t) is the maximum value that the policy risk medium value can have, and Max (SV) is included in the origin. Among the harmful information (harmful IP, harmful URL) means the maximum risk level, Max (DV) means the value of the maximum risk among the harmful information (harmful IP, harmful URL) included in the destination, Max (rP) means the maximum risk level among the harmful information (vulnerable port) included in the service, rTI indicates the inbound risk, rTO indicates the outbound risk, and rTInt indicates the internal risk.

According to another embodiment of the present invention, in the firewall inspection system using the harmful information database according to the present invention, the risk calculation unit and the equipment risk calculation unit for calculating a numerical value of the firewall risk having a plurality of policies, and a plurality of firewalls It characterized in that it further comprises a site risk calculation unit that calculates and calculates the network risk having a.

According to another embodiment of the present invention, the firewall risk system (rFW) in the firewall inspection system using the harmful information database according to the present invention is determined by the sum / policy number (n) of the policy risk (rRule), The firewall risk (rSite) is characterized by the sum / firewall number (n) of the firewall risk (rRW).

According to another embodiment of the present invention, the firewall inspection system using the harmful information database according to the present invention is based on the analysis results of the information analysis unit to reduce the risk of the network policy information of the firewall for blocking harmful information It is characterized in that it further comprises a policy calculation government to calculate.

According to another embodiment of the present invention, in the firewall inspection system using the harmful information database according to the present invention, the policy calculation unit may determine harmful information corresponding to weaknesses classified by the information analysis unit by source, destination, and service. A matching information calculation unit integrated to calculate a source harmful information object, a destination harmful information object, and a service harmful information object; And a matching policy calculation unit for newly generating a policy of the firewall so as to solve the vulnerability policy by using the objects calculated by the matching information calculation unit.

According to another embodiment of the present invention, the firewall check system using the harmful information database according to the present invention is to determine the interlocking information from the interlocking information collecting unit of the information collecting unit of the firewall system to protect the network If it is determined that the modification is allowed, the policy correction function for directly applying the policy of the firewall to the firewall according to the policy information of the firewall generated by the matching policy calculation unit is characterized in that it further comprises.

According to another embodiment of the present invention, the firewall check system utilizing the harmful information database according to the present invention collects harmful information in the harmful information DB at regular intervals, calculates policy information of the firewall, and updates the policy of the firewall. Characterized in that it further comprises a policy updating unit.

According to another embodiment of the present invention, in the firewall check system using the harmful information database according to the present invention, the policy update unit detects the interlocking information from the interlocking information collecting unit of the information collecting unit and protects the network policy. A linkage determination unit determining whether the external system is allowed to be modified; When the interlocking judgment judges that the external system is allowed to modify the policy of the firewall, an unmatched information mountain that analyzes the harmful information collected by the harmful information collector of the information collector and integrates the harmful information to generate a harmful information object With the government; A non-matching policy calculation unit for newly generating a policy of the firewall using the objects calculated by the mismatching information calculation unit, and directly applying the generated policy of the firewall to the firewall; If the harmful information is collected from the harmful information DB through the harmful information collection unit at a predetermined cycle and it is determined that there is a newly updated harmful information different from the harmful information collected in the previous cycle, the mismatching information calculation unit is operated to generate a new harmful information object. And an update determining unit configured to operate the mismatch policy calculation unit to generate a policy and apply the new firewall to the firewall.

The present invention can obtain the following effects by the above-described embodiment, the constitution described below, the combination, and the use relationship.

The present invention diagnoses the current security status by checking the vulnerability of the firewall policy such as attack from harmful IP (URL), connection to harmful IP (URL), open of vulnerable port, etc. There is an effect that can respond quickly to.

In addition, the present invention quantitatively provides a vulnerability analysis result of the firewall, there is an effect that can increase the utility of vulnerability information and convenience of risk analysis.

In addition, the present invention extends the safety analysis of individual policies of the firewall, and has an effect of evaluating the comprehensive risk of the firewall equipment and the network environment.

In addition, the present invention can improve the network stability through a quick response to automatically modify the policy of the firewall according to the firewall vulnerability analysis results, there is an effect having improved convenience.

In addition, the present invention has the effect of increasing the stability and convenience of the administrator because the policy of the firewall is updated through automated harmful information update.

1 is a block diagram showing the configuration of a firewall inspection system according to an embodiment of the present invention.
2 to 4 is a reference diagram for explaining a risk calculation process of the firewall inspection system according to an embodiment of the present invention.
5 is a flowchart illustrating a firewall check process of the firewall check system according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the firewall inspection system using a harmful information database according to the present invention will be described in detail. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. Throughout the specification, when an element is referred to as "including" an element, it is understood that the element may include other elements as well as other elements, The term "part" or the like means a unit for processing at least one function or operation, which may be implemented by hardware, software, or a combination of hardware and software.

1 is a block diagram showing the configuration of a firewall inspection system according to an embodiment of the present invention, Figures 2 to 4 are reference diagrams for explaining the risk calculation process of the firewall inspection system according to an embodiment of the present invention. 5 is a flowchart illustrating a firewall check process of a firewall check system according to an exemplary embodiment of the present invention.

1 to 4, the firewall inspection system collects harmful information from a harmful information DB and collects security information from a network. An information analysis unit (2) for comparing and analyzing the harmful information and security information collected from the collecting unit (1) and the information collecting unit (1) to check the vulnerability of the network firewall and to quantify the risk of the network; Based on the analysis result of the information analysis unit (2), the policy calculation unit (3) for calculating the policy information of the firewall for blocking harmful information in order to reduce the risk of the network, and the information analysis unit (2) and the policy The report correction section (4) reporting the results derived from the mountain government (3) to the network and modifying the policy of the firewall, and the harmful information from the harmful information DB at regular intervals. The policy update unit 5 may collect and calculate policy information of the firewall to update the policy of the firewall.

The information collecting unit 1 is configured to collect harmful information from the harmful information DB and collect security information from the network. The harmful information collecting unit 11, the policy information collecting unit 12, and the asset information collecting unit 13. And the interlocking information collecting unit 14. The security information is a concept encompassing various security-related information of the network, and includes, for example, policy information of a firewall, information on the value of an information asset, information on whether an external system is allowed to modify the firewall policy, and the like. .

The harmful information collecting unit 11 is configured to collect harmful information from the harmful information DB. At this time, the harmful information collected by the harmful information collecting unit 11 includes harmful IP (or / and harmful URL), weak port, etc. Include. The harmful information DB is a system for providing up-to-date harmful information, and may be a system provided by an administrator or a system provided by an external public authority. When the harmful information DB is a system provided by an external public authority (eg, the Internet Agency), the harmful information collecting unit 11 accesses the harmful information DB through the Internet and collects harmful information. 2A shows an example of harmful information collected by the harmful information collecting unit 11 from the harmful information DB, and the harmful information has a value ranging from 0 to 10 depending on the degree of danger (hereinafter referred to as 'hazard of harmful information'). Degree ').

The policy information collecting unit 12 is configured to collect policy information of a firewall that protects a network of a specific company or institution by accessing a network (server managing a network), wherein the policy information collecting unit 12 collects the policy information. The policy information of the firewall includes a plurality, and each policy information includes a source IP (URL) / destination IP (URL) / service port / action and the like. 2B shows an example of firewall policy information collected by the policy information collecting unit 12. The firewall has four policies, and the policy of step 2 is a specific IP (192.168.10.0/24). Allow network access and allow the network access to all IPs and PORTs.

The asset information collecting unit 13 accesses a network (server managing a network) to provide information on the value of each information asset constituting the network (which means elements constituting the network and can be classified by IP). In the configuration of collecting, for example, if the network is for a financial institution, the value of the account information DB may be evaluated higher than the value for the additional information DB. 2C shows an example of asset information collected by the asset information collecting unit 13, wherein the asset information has a value from 1 to 5 according to the degree of risk (hereinafter referred to as 'degree of risk of asset information'). ).

The interworking information collection unit 14 is connected to the network (server managing the network) to modify the policy of the firewall to protect the network by the external system (firewall inspection system using a harmful information database in the present invention). Collect information as to whether it is allowed.

The information analysis unit 2 is a configuration that checks the vulnerability of the firewall of the network by comparing and analyzing the harmful information and security information collected from the information collection unit 1, and calculates by quantifying the risk of the network, policy check The unit 21, the risk calculation unit 22 and the like.

The policy checking unit 21 is configured to analyze the harmful information and policy information collected by the information collecting unit 1 to determine whether a packet having the harmful information can pass through the firewall. When a packet having an IP, a malicious URL, and a weak port passes through the firewall, it is classified as a weak policy. The policy checking unit 21 determines whether harmful information of the vulnerable policy is included in the policy origin, destination, or service, and the degree of risk is changed according to the above determination result. 2D shows the degree of risk (hereinafter referred to as 'the degree of risk of attack direction') according to the attackable direction of the vulnerability policy of the firewall. Inbound indicates that the harmful IP is included in the policy origin and is attacked from the outside to the network. Outbound means that harmful IP is included in the destination of the policy, allowing attack from outside the network (leakage of information), and Internal means that access to the vulnerable port is allowed to attack from inside the network. Means.

When the policy check unit 21 determines that the policy of the firewall is a vulnerable policy, the risk calculation unit 22 calculates a risk for each policy, device, and site according to the analysis result of the policy check unit 21. In one configuration, the policy risk calculation unit 221, the equipment risk calculation unit 222, the site risk calculation unit 223 and the like.

When the policy check unit 21 determines that the policy of the firewall is a weak policy, the policy risk calculation unit 221 determines the degree of risk of harmful information and risk of asset information according to the analysis result of the policy check unit 21. Policy risk is calculated according to the following equation 1 in consideration of the degree of attack, the degree of danger of the attack direction. The risk for each policy is expressed as a value between 0 and 100. [Equation 1]

rRule = (rRule_t) / Max (rRule_t) * 100, rRule_t = [{Max (SV) + Max (DV) + Max (rP)} * Max (rAs)] * (rTI or rTO or rTInt)

In Equation 1 above, rRule is the policy risk, rRule_t is the median policy risk, Max (rRule_t) is the maximum value that the median policy risk can have, and Max (SV) is the harmful information included in the source. (Hazardous IP, Harmful URL) means the maximum risk level, Max (DV) means the maximum risk level among the harmful information (harmful IP, harmful URL) included in the destination, Max ( rP) means the maximum risk level among harmful information (vulnerable PORT) included in the service, Max (rAs) means the maximum risk level among asset information, and rTI means the risk level of inbound, rTO is the risk of outbound and rTInt is the risk of internal.

In the case of having harmful information (A), policy information (B), asset information (C), and a degree of risk (D) according to the attackable direction, as shown in FIG. An analysis result is derived, and when the risk of the policy is calculated with reference to FIGS. 2 and 3, the result is as shown in Table 1 below. Max (rRule_t) has a value of [{10 + 10 + 10} * 5] * 1.5 = 225.

Order rRule_t rRule One [{3 + 0 + 0} * 5] * 1.5 = 22.5 22.5 / 225 * 100 = 10 2 [{0 + 9 + 10} * 5] * 1 = 95 95/225 * 100 = 42.2 3 [{0 + 7 + 10} * 5] * 1 = 85 85/225 * 100 = 37.8 4 [{9 + 0 + 10} * 3] * 1.5 = 85.5 85.5 / 225 * 100 = 38

The equipment risk calculation unit 222 is configured to calculate and calculate a firewall risk having a plurality of policies, and the firewall risk rFW is determined by the sum / policy number n of the policy risk rrule. 2, 3 and Table 1, the firewall risk has a value of (10 + 42.2 + 37.8 + 38) / 4 = 32.

The site risk calculation unit 223 is configured to quantify a network risk having a plurality of firewalls, and the network risk rSite is determined by the sum / firewall number n of the firewall risk rFW. For example, as shown in FIG. 4, when the network 100 has four firewalls 101 to 104 and the firewall risk of each of the firewalls 101 to 104 has 32, 40, 35, and 33, the network risk ( rSite) has a value of (32 + 40 + 35 + 33) / 4 = 35.

The policy calculation unit (3) is configured to calculate the policy information of the firewall for blocking harmful information in order to reduce the risk of the network based on the analysis result of the information analysis unit (2), matching information calculation unit (31) , Matching policy calculation (32), and the like.

The matching information calculation unit 31 integrates harmful information matching the vulnerability policy classified by the information analyzing unit 2 by source, destination, and service, and generates a source harmful information object, a destination harmful information object, and a service harmful information object. In a configuration for calculating, the source harmful information object includes a harmful IP and a harmful URL having a weak policy at the source, the destination harmful information object includes a harmful IP and a harmful URL having a weak policy at a destination, and the service harmful The information object contains a vulnerable port with a vulnerable policy in the service.

The matching policy calculation unit 32 is a configuration for newly generating a policy of the firewall so that the weakness policy can be solved by using the objects calculated by the matching information calculation unit 31, and in the matching policy calculation unit 32. The generated firewall policy is reported to the network by the reporting correction unit 4 described later and applied directly to the firewall. Table 2 calculates the objects based on the analysis result of the vulnerability policy as shown in FIG. 3 and shows the newly created firewall policy using the object.

Order Starting point destination service Act One 69.197.40.43
69.197.40.44
69.197.40.45
http://risk.pe
http://de.ro any any Deny 2 any 69.197.40.43
69.197.40.44
69.197.40.45
http://risk.pe
http://de.ro any Deny 3 any any Deny

The report correction unit 4 is configured to report the results derived from the information analysis unit 2 and the policy calculation unit 3 to the network and to modify the policy of the firewall. The information providing unit 41 and the policy correction unit (42) and the like.

The information providing unit 41 is configured to report the results derived from the information analyzing unit 2 and the policy calculation unit 3 to the network, and the information provided by the information providing unit 41 includes a weak policy, It includes policy risk, firewall risk, site risk, and policy information modified according to vulnerability policy.

When the policy corrector 42 determines that the external system is allowed to modify the policy of the firewall protecting the network by identifying the interlocking information from the interlocking information collecting unit 14, the matching policy calculating unit 32 Apply the firewall policy directly to the firewall according to the policy information of the firewall generated in. Since the policy correction unit 42 automatically modifies the policy of the firewall, the policy correction unit 42 may improve network stability and administrator convenience through a quick response.

The policy update unit 5 collects harmful information from the harmful information DB at regular intervals, calculates policy information of the firewall, and updates the policy of the firewall. The interlocking determination unit 51 and the mismatching information calculation unit (52), non-matching policy calculation (53), renewal decision unit (54), and the like.

The interlocking determination unit 51 determines interlocking information from the interlocking information collecting unit 14 and determines whether an external system allows modification of a policy of a firewall protecting the network.

The mismatching information calculation unit 52 analyzes the harmful information collected by the harmful information collecting unit 11 when the interlocking determination unit 51 determines that the external system can modify the policy of the firewall. The unmatched information calculation unit 52 generates a harmful IP object, a harmful URL object, and a vulnerable PORT object by integrating harmful information.

The mismatch policy calculation unit 53 newly creates a policy of the firewall by using the objects calculated by the mismatching information calculation unit 52, and directly applies the generated policy of the firewall to the firewall.

When the update determination unit 54 collects harmful information from the harmful information DB through the harmful information collecting unit 11 at regular intervals and determines that there is a different updated information, that is, newly updated harmful information, The mismatch information calculation unit 52 is operated to generate a new harmful information object, and the mismatch policy calculation unit 53 is operated to generate a new firewall and apply the policy to the firewall. The policy updater 5 updates the policy of the firewall through automated harmful information update, so that the policy updater 5 can increase stability and convenience of the administrator.

Looking at the method of inspecting the firewall using the firewall inspection system using the harmful information database having the configuration as described above with reference to Figures 1 to 5, the firewall inspection method is the information collection step (S1), information analysis step (S2) ), Policy calculation step (S3), report correction step (S4), policy update step (S5) and the like.

The information collecting step S1 is a step in which the information collecting unit 1 collects harmful information from a harmful information DB and collects security information from a network. The harmful information collecting unit 11 in the information collecting step S1. ) Collects harmful information from the harmful information DB, the policy information collection unit 12 collects policy information of a firewall that protects the network of a specific company or organization by accessing a network, and the asset information collection unit 13 Collects information on the value of each information asset constituting the network by accessing the network, and the interlocking information collection unit 14 allows the external system to modify the policy of the firewall that protects the network by accessing the network. Collect information on

In the information analysis step (S2), the information analysis unit 2 compares the harmful information and security information collected in the information collection step (S1) to check the vulnerability of the firewall of the network and quantify the risk of the network. Step of calculating, including the policy check step (S21), risk calculation step (S22) and the like.

In the policy checking step S21, the policy checking unit 21 analyzes harmful information and policy information collected in the information collecting step S1 to determine whether a packet having the harmful information can pass through the firewall. In the step, when the packet having the harmful information (harmful IP, harmful URL, vulnerable port) passes through the firewall, it is classified as a vulnerable policy, and whether harmful information of the vulnerable policy is included in the origin, destination, or service of the policy. Determine.

In the risk calculation step (S22), if it is determined that the policy of the firewall is a weak policy in the policy check step (S21), the risk calculation unit 22 according to the policy according to the analysis result of the policy check step (S21) To calculate the risk per device and site, the policy risk calculation step (S221), the equipment risk calculation step (S222), the site risk calculation step (S223) and the like.

In the policy risk calculation step (S221), when it is determined that the policy of the firewall is a weak policy in the policy check step (S21), the policy risk calculation unit 221 according to the analysis result of the policy check step (S21) Policy risk is calculated according to Equation 1 above, taking into account the degree of risk of harmful information, the degree of risk of asset information, and the degree of risk of attack direction.

The equipment risk calculation step (S222) is a step in which the equipment risk calculation unit 222 numerically calculates a firewall risk having a plurality of policies, and the firewall risk (rFW) is the sum / policy number of policy risks (rRule). It is determined by (n).

The site risk calculation step (S223) is a step in which the site risk calculation unit 223 quantifies the network risk having a plurality of firewalls, and the firewall risk (rSite) is the sum / firewall count of the firewall risk (rRW). It is determined by (n).

The policy calculating step (S3) is a step of calculating the policy information of the firewall for blocking harmful information in order to reduce the risk of the network based on the analysis result of the information analysis step (S2) by the policy calculation unit (3). , Matching information calculation step (S31), matching policy calculation step (S32), and the like.

In the matching information calculating step S31, the matching information calculating unit 31 integrates harmful information matching the weak policy classified in the information analyzing step S2 for each source, destination, and service, and thus, a source harmful information object and a destination. Computing the harmful information object and the service harmful information object.

The matching policy calculation step (S32) is a step of newly creating a policy of the firewall so that the matching policy calculation unit 32 can solve the vulnerability policy by using the objects calculated in the matching information calculation step (S31).

The report correction step (S4) is a step in which the report correction unit (4) reports the results derived from the information analysis step (S2) and the policy calculation step (S3) to the network and corrects the policy of the firewall. Step 41, policy modification step 42, and the like.

The information providing step (S41) is a step in which the information providing unit 41 reports the result derived in the information analyzing step (S2) and the policy calculation step (S3) to the network, in the information providing step (S41). Information provided includes vulnerable policies, policy risks, firewall risks, site risks, and policy information modified according to vulnerable policies.

The interlocking determination step (S42) is a policy of the firewall that protects the network by grasping the interlocking information collected by the policy correction unit 42 in the information collection step (S1) after the information providing step (41). This is a step to determine if the modification is allowed.

In the policy correction step S43, when it is determined in the interlocking decision step 42 that the external system is allowed to modify the policy of the firewall protecting the network, the policy correction step 42 calculates the matching policy. In step S32, the firewall policy is directly applied to the firewall according to the policy information of the firewall.

The policy update step (S5) is a step in which the policy update unit 5 collects harmful information from the harmful information DB at regular intervals, calculates policy information of the firewall, and updates the policy of the firewall. S51), mismatching information calculation step (S52), mismatching policy calculation step (S53), update determination step (S54), and the like.

The interlocking determination step (S51) is to determine whether the interlocking determination unit 51 allows the external system to modify the policy of the firewall to protect the network by grasping the interlocking information collected in the information collection step (S1). Step.

The mismatching information calculation step (S52), when it is determined in the interlocking determination step (S51) to allow the external system to modify the policy of the firewall, the mismatching information calculation unit 52 is the harmful information collection unit (11) analyzing the harmful information collected by integrating the harmful information to create a harmful information object, the mismatch information calculation unit 52 to generate a harmful IP object, harmful URL object, vulnerable PORT object do.

In the mismatching policy calculation step (S53), the mismatching policy calculation unit 53 newly creates a policy of the firewall by using the objects calculated in the mismatching information calculation step S52, and generates the policy of the generated firewall. This step applies directly to the firewall.

In the update determination step (S54), after the mismatching information calculation step (S52), the update determination unit 54 collects harmful information from the harmful information DB through the harmful information collecting unit 11 at regular intervals, When it is determined that there is a new updated harmful information that is different from the collected harmful information, the mismatching information calculation unit 52 is operated to generate a new harmful information object, and the mismatching policy calculation unit 53 is operated. This step is to create a new firewall and apply it to the firewall.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, Should be interpreted as belonging to the scope.

1: Information collection 2: Information analysis department 3: Policy calculation
4: Reporting Ministry 5: Policy and Update Department 11: Harmful Information Collection Department
12: Policy Information Collector 13: Asset Information Collector 14: Linked Information Collector
21: Policy review department 22: Risk calculation section 31: Matching information calculation government
32: matching policy calculation 41: information provision 42: policy correction
51: Interdisciplinary Judgment 52: Mismatched Information Government 53: Mismatched Policy Government
54: Renewal Judgment 221: Policy Risk Calculation Unit 222: Maintenance Risk Calculation Unit
223: site risk calculation

Claims (8)

An information collecting unit for collecting security information from the network; And an information analysis unit for comparing the security information collected by the information collection unit with harmful information to check the vulnerability of the firewall of the network.
The information collecting unit includes a policy information collecting unit for collecting policy information of a firewall protecting the network,
The information analysis unit includes a policy check unit that compares the policy information collected by the policy information collection unit with harmful information, and classifies the packet as a weak policy when the packet having the harmful information passes through the firewall. Firewall inspection system using information database. The method of claim 1,
The information collecting unit further includes a harmful information collecting unit for collecting harmful information from the harmful information DB, the harmful information includes harmful IP, harmful URL, vulnerable port,
The policy inspecting unit determines whether harmful information of the vulnerability policy is included in the policy origin, destination, or service.
The information analyzing unit may further include a risk calculating unit having a policy risk calculating unit for calculating a risk of each policy of the firewall according to the analysis result of the policy checking unit when the policy checking unit determines that the policy of the firewall is a weak policy. Firewall inspection system using harmful information database. 3. The method of claim 2,
The information collecting unit further includes an asset information collecting unit collecting information on the value of each information asset constituting the network,
The policy risk calculator calculates a policy risk according to Equation 1 below by considering the risk of harmful information, the risk of asset information, and the risk of attack direction. .
[Equation 1]
rRule = (rRule_t) / Max (rRule_t) * 100, rRule_t = [{Max (SV) + Max (DV) + Max (rP)} * Max (rAs)] * (rTI or rTO or rTInt)
In Equation 1 above, rRule is the policy risk, rRule_t is the median policy risk, Max (rRule_t) is the maximum value that the median policy risk can have, and Max (SV) is the harmful information included in the source. (Hazardous IP, Harmful URL) means the maximum risk level, Max (DV) means the maximum risk level among the harmful information (harmful IP, harmful URL) included in the destination, Max ( rP) means the maximum risk level among harmful information (vulnerable PORT) included in the service, Max (rAs) means the maximum risk level among asset information, and rTI means the risk level of inbound, rTO is the risk of outbound and rTInt is the risk of internal The method of claim 3,
The risk calculator further includes an equipment risk calculator that quantifies and calculates a firewall risk having a plurality of policies, and a site risk calculator that quantifies and calculates a network risk having a plurality of firewalls.
The firewall risk (rFW) is determined by the sum / policy number (n) of the policy risk (rRule), and the network risk (rSite) is determined by the sum / firewall number (n) of the firewall risk (rFW). Firewall inspection system using the harmful information database, characterized in that. The method of claim 1,
The firewall inspection system further includes a policy calculation unit that calculates policy information of a firewall for blocking harmful information based on an analysis result of the information analysis unit to reduce the risk of the network.
The policy calculation unit may include: a matching information calculation unit configured to calculate harmful source information objects, harmful destination information objects, and harmful service information objects by integrating harmful information matching the weaknesses classified by the information analysis unit for each source, destination, and service; And a matching policy calculation unit for newly creating a policy of the firewall so that the weakness policy can be solved by using the objects calculated by the matching information calculation unit. The system of claim 5, wherein the firewall check system
If it is determined that the external system can modify the policy of the firewall that protects the network by identifying the interlocking information from the interlocking information collecting unit of the information collecting unit, the firewall according to the policy information of the firewall generated by the matching policy calculation unit. Firewall inspection system using a harmful information database, characterized in that it further comprises a policy correction to apply the policy directly to the firewall. The system of claim 1, wherein the firewall inspection system
The firewall inspection system using a harmful information database, characterized in that it further includes a policy update unit for collecting the harmful information in the harmful information DB at regular intervals to calculate the policy information of the firewall to update the policy of the firewall. The method of claim 7, wherein the policy update unit
An interlocking determination unit that determines interlocking information from the interlocking information collecting unit of the information collecting unit and determines whether an external system is allowed to modify a policy of a firewall protecting the network;
When the interlocking judgment judges that the external system is allowed to modify the policy of the firewall, an unmatched information mountain that analyzes the harmful information collected by the harmful information collector of the information collector and integrates the harmful information to generate a harmful information object With the government;
A non-matching policy calculation unit for newly generating a policy of the firewall using the objects calculated by the mismatching information calculation unit, and directly applying the generated policy of the firewall to the firewall;
If the harmful information is collected from the harmful information DB through the harmful information collection unit at a predetermined cycle and it is determined that there is a newly updated harmful information different from the harmful information collected in the previous cycle, the mismatching information calculation unit is operated to generate a new harmful information object. And an update determining unit configured to operate the mismatching policy calculation unit to generate a new firewall policy and apply the new firewall to the firewall.

Images