KR101416523B1 - Security system and operating method thereof - Google Patents

Abstract

The present invention relates to networks, and more particularly to a security system and a method of operation thereof. The operation method of the security system according to the embodiment of the present invention is a method in which each of packets communicated between a plurality of host computers and an Internet network is a DNS response packet transmitted from a DNS (Domain Named Server) Updating the IP address table by extracting an IP address corresponding to the domain name from the DNS response packet, and blocking or allowing packets based on the IP address table.

Description

[0001] SECURITY SYSTEM AND OPERATING METHOD THEREOF [0002]

The present invention relates to networks, and more particularly to a security system and a method of operation thereof.

A Domain Name System (DNS) is used as a system for managing a domain name (e.g., Fully Qualified Domain Name, FQDN) on the Internet. In this case, the domain name and the IP address of the server computer are mapped and registered in the DNS server. In this state, the user of the host computer (for example, client computer) It is possible to input a domain name without inputting it, to first request to the DNS server what IP address corresponds to the domain name, and to receive the IP address from the DNS server, thereby accessing the server computer indicated by the IP address. By using the domain name system, you can connect to the server computer by entering the domain name instead of the hard-to-remember IP address.

A plurality of IP addresses can correspond to one domain name. For example, a plurality of server computers each providing a website corresponding to one domain name can be operated.

It is an object of the present invention to provide a security system that efficiently blocks access to a specific web site.

A method of operating a security system according to an embodiment of the present invention is a method in which each of packets communicated between a plurality of host computers and an Internet network is transmitted to a Domain Name Server (DNS) A step of determining whether or not it is determined whether or Extracting an IP address corresponding to a domain name from the DNS response packet and updating the extracted IP address in an IP address table; And blocking the packet according to whether the source IP address or the destination IP address of each of the packets matches one of the IP addresses in the IP address table.

Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server according to a DNS query packet requesting an IP address corresponding to the domain name, Can be generated in any one of them.

The IP address corresponding to the domain name may be matched with the domain name and stored in the IP address table.

In an embodiment, the determining may be performed based on a header of each of the packets.

In an embodiment, the destination of the DNS response packet is any one of the plurality of host computers, and the operating method includes receiving a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network And storing information on the plurality of DNS query packets. The step of updating the IP address table may include determining whether a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets, And extracting the corresponding IP address.

Blocking the corresponding packet when the source IP address or the destination IP address of each of the packets matches any one of the IP addresses in the IP address table; And allowing the corresponding packet when the source IP address or the destination IP address of each of the packets does not match the IP addresses in the IP address table.

Another aspect of the invention relates to a security system. A security system according to an embodiment of the present invention includes a security unit for managing a plurality of host computers connected to an Internet network; And determining whether each of the packets communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted through the Internet network from a DNS (Domain Named Server) server, And a sniffing unit configured to extract an IP address corresponding to a domain name from the IP address table and to update the IP address corresponding to the domain name in the IP address table, wherein the security unit identifies a source IP address or a destination IP address of each of the packets, And to block the packet according to whether or not the packet matches any one of the packets.

Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server according to a DNS query packet requesting an IP address corresponding to the domain name, Can be generated in any one of them.

In an embodiment, the IP address table may be stored in the security unit.

As an example, the IP address table may be stored in the sniffing unit.

In an embodiment, the security unit blocks the corresponding packet when the source IP address or the destination IP address of each of the packets matches any one of the IP addresses in the IP address table, And to allow the corresponding packet when the IP address or the destination IP address does not match the IP addresses in the IP address table.

A method of operating a security system according to another embodiment of the present invention is a method in which a packet communicated between the plurality of host computers and the Internet network is transmitted from a Domain Name Server (DNS) server to a DNS response Determining whether the packet is a packet or a normal packet; Extracting an IP address corresponding to a domain name from the DNS response packet and updating the extracted IP address in an IP address table when the packet is the DNS response packet; And blocking the normal packet according to whether the source IP address or the destination IP address of the normal packet coincides with any one of the IP addresses in the IP address table when the packet is the normal packet.

In an embodiment, the determining step may be performed based on a header of the packet.

In an embodiment, the destination of the DNS response packet is any one of the plurality of host computers, and the operating method includes receiving a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network And storing information on the plurality of DNS query packets. The step of updating the IP address table may include determining whether a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets, And extracting the corresponding IP address.

The blocking step may include blocking the normal packet when the source IP address or the destination IP address of the normal packet matches one of the IP addresses in the IP address table. And allowing the normal packet when the source IP address or the destination IP address of the normal packet does not match the IP addresses in the IP address table.

According to an embodiment of the present invention, a security system that efficiently blocks access to a specific web site is provided.

1 is a conceptual diagram illustrating a data format of a packet transmitted and received through the Internet network.
2 is a block diagram illustrating a network including a security system according to an embodiment of the present invention.
3 is a flowchart illustrating an operation method of a sniffing unit according to an embodiment of the present invention.
4 is an exemplary diagram showing the data format of the header of the DNS response packet.
5 is a diagram showing an IP address table.
6 is a flowchart illustrating an operation method of a security unit according to an embodiment of the present invention.
7 is a flowchart illustrating an operation method of a sniffing unit according to another embodiment of the present invention.
Figure 8 is a flow chart illustrating a method for obtaining a DNS query packet.
FIG. 9 is a table showing IP addresses collected in the security system when the security system of FIG. 1 directly transmits DNS query packets to the DNS server.
10 is a table showing IP addresses collected per domain name according to an embodiment of the present invention.
11 is a flowchart illustrating an operation method of a security system according to another embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

1 is a diagram conceptually showing a data format of a packet P transmitted and received through the Internet network.

Referring to FIG. 1, a packet P includes a header HD and user data UD. The header HD is data for managing the user data UD. The header HD may include information on a source IP address SP, a destination IP address DP, and a domain name DN.

In a security system that manages a plurality of host computers, it may be required to block access to a particular web site. A method of blocking access to a Web site is to use a domain name (DN) included in the packet (P). The limitation of this method is that any one of a plurality of IP addresses corresponding to a domain name (DN) is input as a destination IP address (DP) without including a domain name (DN) in the packet P to attempt a bypass connection . Therefore, this method can not effectively block access to the web site.

Another way to block access to the web site is to use the destination IP address DP or the source IP address SP included in the packet P. However, the problem with this method is that the security system can not effectively collect IP addresses corresponding to domain names (DNs).

Assume that the number of IP addresses corresponding to the domain name www.XXXX.net is 12. It is assumed that a security system managing a plurality of host computers wants to obtain IP addresses corresponding to www.XXXX.net. The security system will ask the DNS server for DNS query packets requesting IP addresses corresponding to the domain name. At this time, even if the security system repeatedly transmits DNS query packets, the DNS server can provide only two IP addresses. That is, no matter how many DNS query packets are transmitted from a single destination (i.e., the security system) to the DNS server, the number of IP addresses provided by the DNS server may be limited. Accordingly, the security system can not efficiently obtain the IP addresses corresponding to the domain name (DN). In addition, when Global Service Load Balancing (GSLB) is used, different IP addresses are provided for one domain name (DN) according to the DNS server. At this time, the IP addresses that the security system can obtain in association with one domain name (DN) may be limited.

2 is a block diagram illustrating a network 100 including a security system 110 in accordance with an embodiment of the present invention.

2, the network 100 includes a plurality of host computers PC1 to PCk, a security system 110, an Internet network 120, a DNS (Domain Name System) server 130, (141 to 14n).

The plurality of host computers PC1 to PCk are connected to the Internet network 120 through the security system 110. [ The plurality of host computers PC1 to PCk receive the IP address corresponding to the domain name from the DNS server 130 and access the server computer corresponding to the provided IP address of the plurality of server computers 141 to 14n .

The first host computer PC1 transmits a DNS query packet requesting an IP address corresponding to the domain name to the DNS server 130 . The first host computer PC1 receives the DNS response packet provided from the DNS server 130 and obtains the IP address from the DNS response packet. The first host computer PC1 then transmits a normal packet defined as an IP address obtained from the DNS response packet to the destination IP address and a source IP address defined as an IP address corresponding to the first host computer PC1 120) and connects to the server computer by receiving a normal packet whose destination IP address is defined as an IP address corresponding to the first host computer (PC1) and whose source IP address is defined as an IP address obtained from the DNS response packet will be.

The security system 110 is configured to manage a plurality of host computers PC1 to PCk. The security system 110 includes a security unit 111 and a sniffing unit 112. The security unit 111 may be configured to manage packets transmitted to and received from a plurality of host computers PC1 to PCk according to predetermined security policies.

The security unit 111 monitors packets transmitted to the plurality of host computers PC1 through PCk through the Internet network 120 and blocks all or a part of the packets according to predetermined security policies . The security unit 111 is also configured to monitor packets transmitted from the plurality of host computers PC1 to PCk to the Internet network 120 and to block all or a part of the packets according to predetermined security policies .

The security unit 111 may store the IP address table (see T in Fig. 5). The bore unit 111 determines whether the source IP address or the destination IP address of each of the packets communicated between the host computers PC1 to PCk and the Internet network 120 matches one of the IP addresses in the IP address table And blocks the packet according to the discrimination result.

When the source IP address or destination IP address of each of the packets matches any of the IP addresses in the IP address table, the security unit 111 will block the packet. When the source IP address or the destination IP address of each of the packets does not match the IP addresses in the IP address table, the security unit 111 will allow the packet.

The sniffing unit 112 is configured to collect IP addresses that each host computer receives from the DNS server 130 in relation to the domain name. That is, the sniffing unit 112 determines whether each of the packets is a DNS response packet transmitted from the DNS server 130 to the plurality of host computers PC1 to PCk via the Internet 120, Thereby obtaining and storing the IP address from the DNS response packet.

The DNS server 130 is connected to the security system 110 and a plurality of host computers PC1 to PCk via the Internet network 120. [ The DNS server 130 is configured to provide a DNS response packet to the host computer in response to the DNS query packet received from each host computer.

DNS server 130 will store information about IP addresses corresponding to each domain name. Based on the stored information, the DNS server 130 searches for a domain address of the DNS query packet corresponding to an IP address and provides a DNS response packet including the searched IP address to the host computer through the Internet 120 .

In an embodiment, when a plurality of IP addresses correspond to a single domain name, the DNS server 130 transmits only a limited number of IP addresses, even if DNS query packets are repeatedly transmitted from the same destination (for example, the same host computer) It can be provided to the host computer. Each host computer can communicate with a limited number of server computers among the first to nth server computers 141 to 14n.

It is assumed that the security system 110 repeatedly transmits DNS query packets to the DNS server 130 in order to collect IP addresses corresponding to one domain name. The DNS server 130 will provide only a limited number of IP addresses to the security system 110 in response to DNS query packets received from the security system 110, which are the same destination. According to this method, it is difficult for the security system 110 to obtain the IP addresses of the server computers 141 to 14n with which the host computers PC1 to PCk communicate with respect to a specific domain name.

According to an embodiment of the present invention, the sniffing unit 112 monitors packets communicated between the host computers (PC1-PCk) and the Internet network 120, distinguishes DNS response packets from such packets, Obtain the IP address from the DNS response packet. Thus, at least the IP addresses with which the host computers PC1 to PCk communicate with respect to the domain name can be efficiently collected by the sniffing unit 112. [

The first to nth server computers 141 to 14n are configured to communicate with the first to kth host computers PC1 to PCk through the Internet network 120. [ The IP addresses corresponding to the first to nth server computers 141 to 14n are different. However, each of the first to n-th server computers 141 to 14n provides a website corresponding to one domain name.

In FIG. 2, it will be appreciated that the security unit 111 and the sniffing unit 112 may be implemented by a plurality of physical devices, and may be implemented by a single physical device. For example, each of the security unit 111 and the sniffing unit 112 may be implemented using various methods, such as using software or using firmware.

3 is a flowchart showing an operation method of the sniffing unit 112 according to an embodiment of the present invention.

2 and 3, in step S110, the sniffing unit 112 monitors packets communicated between the plurality of host computers PC1 to PCk and the Internet network 120. [ The plurality of host computers PC1 to PCk can communicate with the DNS server 130 through the Internet network 120. [ A packet transmitted and received between a plurality of host computers (PC1 to PCk) and a DNS server 130 is defined as a DNS packet. At this time, a packet transmitted from each host computer to the DNS server 130 is defined as a DNS query packet, and a packet transmitted from the DNS server 130 to each host computer is defined as a DNS response packet. The plurality of host computers PC1 to PCk can communicate with the server computers 141 to 14n via the Internet network 120. [ Packets transmitted and received between a plurality of host computers (PC1 to PCk) and server computers (141 to 14n) are defined as normal packets.

Hereinafter, for convenience of explanation, a case where the first host computer PC1 transmits / receives a packet to / from the DNS server 130 will be described as an example with reference to FIG.

In step S120, the sniffing unit 112 determines whether the packet is a DNS response packet. That is, the sniffing unit 112 determines whether the packet is a DNS response packet transmitted from the DNS server 130. [

As an embodiment, whether the packet is a DNS response packet can be determined based on the header of the packet. This is described in more detail with reference to FIG.

If the packet is a DNS response packet, step S130 is performed.

In step S130, the sniffing unit 112 extracts the IP address corresponding to the domain name from the DNS response packet. The DNS response packet may include domain name information and corresponding IP address information. The DNS response packet is provided in response to a DNS query packet requesting an IP address corresponding to a domain name, and thus includes an IP address corresponding to the domain name. The extracted IP address may be an address indicating one of the first to nth server computers 141 to 14n.

In step S140, the sniffing unit 112 adds the extracted IP address to the IP address table in association with the domain name. As an example, the IP address table may be stored in the security unit 111. [ As another example, the IP address table may be stored in the sniffing unit 112.

The IP address table stores corresponding IP addresses for each domain name. That is, the extracted IP address is matched with the corresponding domain name and stored. This is described in more detail with reference to FIG.

4 is an exemplary diagram showing a data format of a header (DNS_HD) of a DNS response packet.

Referring to FIG. 4, the header (DNS_HD) of the DNS response packet includes first to third flag information 11 to 13, a destination IP address DP, and a domain address DN. The first flag information 11 indicates whether the packet is a DNS packet or a normal packet.

As an embodiment, the first flag information 11 may be the IP address of the source port of the packet (see SP in FIG. 1). Whether the first flag information 11 indicates the DNS server 130 or not can be determined if the packet is a DNS packet.

The destination IP address (DP) is the IP address of the destination port to which the DNS response packet is to be transmitted.

For example, the first flag information 11, the destination IP address DP, and the domain name DN may be included in the Transmission Control Protocol (TCP) header of the DNS response header of the DNS response packet.

The second flag information 12 indicates whether the packet is a DNS query packet or a DNS response packet. For example, if the second flag information 12 is composed of one data bit, and the second flag information 12 is a logical state "1 ", the packet is a DNS response packet and the second flag information 12 is a logical state "0" means that the packet is a DNS query packet.

The third flag information 13 indicates whether the corresponding IP address is present and the number of corresponding IP addresses when the packet is a DNS response packet.

An IP address (IP) is provided corresponding to a DNS query packet from any one of a plurality of host computers (PC1 to PCk).

For example, the second and third flag information 12 and 13 and the IP address IP may be included in the DNS header of the DNS response header of the DNS response packet.

Whether the packets communicated between the host computers PC1 to PCk and the Internet network 120 are DNS response packets can be discriminated based on the first to third flag information 11 to 13. [

5 is a diagram showing an IP address table (T).

Referring to FIG. 5, the IP address table T includes IP addresses corresponding to the respective domain names DN1 to DNn. As an embodiment, the DNS response packet includes information on the IP address and information on what the corresponding domain name is. Each time the DNS response packet is detected, the sniffing unit 112 adds the extracted IP address to the IP address table T by matching with the corresponding domain name.

As an example, the IP address table T may be stored in the security unit 111 (see FIG. 2). At this time, the sniffing unit 112 (see FIG. 2) will provide information about the extracted IP address and information about the corresponding domain name to the security unit 111 whenever a DNS response packet is detected.

As another example, the IP address table T may be stored in the sniffing unit 112. At this time, the sniffing unit 112 will include a data storage medium for storing the IP address table T.

6 is a flowchart showing an operation method of the security unit 111 according to the embodiment of the present invention.

Referring to FIGS. 2 and 6, in step S111, the security unit 111 monitors packets communicated between the plurality of host computers PC1 to PCk and the Internet network 120. FIG.

Hereinafter, for convenience of explanation, a case where the first host computer PC1 and the first server computer 141 exchange packets will be described as an example with reference to FIG.

In step S121, the security unit 111 determines whether one of the IP addresses in the IP address table T (see FIG. 5) corresponds to the destination IP address DP (see FIG. 1) or the source IP address SP ). If so, step S131 is performed. If not, step S141 is performed.

For example, when the packet is a downstream packet to be transmitted to the first host computer PC1 through the Internet network 120, the security unit 111 determines whether the source IP address SP of the packet exists in the IP address table . For example, when the packet is an upstream packet to be transmitted from the first host computer PC1 to the Internet network 120, the security unit 111 determines whether the destination IP address DP of the packet exists in the IP address table .

In step S131, the security unit 111 blocks the packet. In step S141, the security unit 111 allows the packet.

According to an embodiment of the present invention, the security system 110 may efficiently search for IP addresses corresponding to a domain name, and may block or allow access to a corresponding web site using the retrieved IP addresses.

7 is a flowchart showing a method of operating the sniffing unit 112 according to another embodiment of the present invention.

Referring to FIGS. 2 and 7, in step S210, the sniffing unit 112 monitors packets communicated between the plurality of host computers PC1 through PCk and the Internet network 120. FIG. In step S220, the sniffing unit 112 determines whether the packet is a DNS response packet.

Hereinafter, for convenience of explanation, a case where the first host computer PC1 transmits / receives a packet to / from the DNS server 130 will be described as an example in the description with reference to FIG. 7 and FIG.

In step S230, the sniffing unit 112 determines whether or not a DNS query packet corresponding to the DNS response packet has been transmitted from the first host computer PC1 to the DNS server 130. [ To this end, the sniffing unit 112 stores information about a DNS query packet transmitted from the first host computer PC1 to the DNS server 130. [ This is described in more detail with reference to FIG.

DNS response packets are transmitted to at least one of the host computers PC1 to PCk, for example, the first host computer PC1 via the Internet network 120, for various purposes, Lt; / RTI > This DNS response packet will not be generated by the DNS server 13 but will be generated by any other server.

In this case, the reliability of the header (DNS_HD) of the DNS response packet is very low. The header (DNS_HD) of the DNS response packet may include the same first to third flag information 11-13 as described with reference to FIG. If the sniffing unit 112 determines whether the packet is a DNS response packet based on only the header (DNS_HD) of the DNS response packet, it is possible to collect an invalid IP address.

According to this embodiment, whether the packet is a DNS response packet is determined based on the header (HD) of the DNS response packet, and the sniffing unit 112 determines whether the first host computer (PC1) has generated the DNS query packet Check.

In step S240, the sniffing unit 112 extracts the IP address corresponding to the domain name from the DNS response packet. In step S250, the sniffing unit 112 adds the extracted IP address to the IP address table.

According to this embodiment, the reliability of the IP addresses collected by the sniffing unit 112 can be further improved.

Figure 8 is a flow chart illustrating a method for obtaining a DNS query packet.

8, the sniffing unit 112 monitors packets communicated between a plurality of host computers PC1 to PCk and the Internet network 120 (S210), and determines whether the packet is a DNS query packet (S220). The DNS query packet is a packet for asking for an IP address corresponding to a domain name, and is transmitted from the first host computer PC1 to the DNS server 130. [ For example, whether the packet is a DNS query packet can be determined by the destination IP address of the packet. If the packet is a DNS query packet, the sniffing unit 112 stores information about the DNS query packet (S230). Information on the DNS query packet will be used in step S230 of FIG.

FIG. 9 is a table showing IP addresses collected in the security system 110 when the security system 110 of FIG. 1 directly transmits DNS query packets to the DNS server 130.

Referring to FIG. 9, two IP addresses corresponding to one domain name (www.daum.net) are obtained. All IP addresses with which the host computers (PC1 to PCk, see Fig. 1) communicate are not obtained.

10 is a table showing IP addresses collected per domain name according to an embodiment of the present invention.

Referring to FIG. 10, three or more IP addresses are obtained in one domain name (www.daum.net). By monitoring and detecting the DNS response packets that the host computers PC1 to PCk receive from the DNS server 130 (see FIG. 2), it can be seen that all the IP addresses with which the host computers PC1 to PCk communicate can be obtained Able to know.

11 is a flowchart illustrating an operation method of the security system 110 according to another embodiment of the present invention.

Referring to FIGS. 2 and 11, in step S410, the security system 110 monitors packets communicated between the plurality of host computers PC1 through PCk and the Internet network 120. FIG.

In step S420, it is determined whether or not the packet is a DNS response packet. If so, step S430 is performed.

In step S430, the IP address corresponding to the domain name is extracted from the DNS response packet. In step S440, the extracted IP address is added to the IP address table (see FIG. 5).

In step S450, if the packet is not a DNS response packet, it is determined whether the source IP address or the destination IP address of the packet matches one of the IP addresses in the IP address table (T, see FIG. 5). If so, step S460 is performed. If not, step S470 is performed.

In step S460, the packet is blocked. In step S470, the packet is allowed.

For example, it is assumed that the corresponding packet is an uplink packet transmitted to the Internet network 120, and all the IP addresses corresponding to the first to nth server computers 141 to 14n are included in the IP address table T . When the corresponding packet is a DNS query packet, the source IP address (corresponding to any one of PC1 to PCk) or the destination IP address (corresponding to 130) of the packet will not exist in the IP address table T. When the packet is a normal packet, the destination IP address (corresponding to any one of 141 to 14n) of the packet will be present in the IP address table T.

For example, it is assumed that the corresponding packet is a downlink packet transmitted through the Internet network 120 and that all the IP addresses corresponding to the first to nth server computers 141 to 14n are included in the IP address table T do. When the packet is a DNS response packet, step S450 will not be performed. When the packet is a normal packet, the source IP address (corresponding to any one of 141 to 14n) of the packet will be present in the IP address table T.

As a result, the normal packets communicated between the first to kth host computers PC1 to PCk and the first to nth server computers 141 to 14n will be blocked or allowed according to the IP address table T .

According to the embodiment of the present invention, it is possible to effectively block the access to the corresponding web site by using the searched IP addresses by efficiently searching the IP addresses corresponding to the domain name.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the claims equivalent to the claims of the present invention as well as the claims of the following.

PC1 to PCk: first to kth host computers
Security system: 110
Internet network: 120
DNS server: 130
141 to 14n: first to nth server computers
DN: Domain Name

Claims (16)

A method of operating a security system for managing a plurality of host computers connected to an Internet network, the method comprising:
Determining whether each of packets communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted through the Internet network from a DNS (Domain Named Server) server;
Extracting an IP address corresponding to a domain name from the DNS response packet and updating the extracted IP address in an IP address table; And
Blocking the corresponding packet according to whether the source IP address or the destination IP address of each of the packets matches any one of the IP addresses in the IP address table,
Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server according to a DNS query packet requesting an IP address corresponding to the domain name,
Wherein the DNS query packet is generated at any one of the plurality of host computers. delete The method according to claim 1,
Wherein the IP address corresponding to the domain name is matched with the domain name and stored in the IP address table. The method according to claim 1,
Wherein the determining is performed based on a header of each of the packets. The method according to claim 1,
Wherein the destination of the DNS response packet is any one of the plurality of host computers,
Detecting a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network and storing information on the plurality of DNS query packets,
The step of updating the IP address table may include determining whether a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets, And extracting the IP address. The method according to claim 1,
The blocking step
Blocking the corresponding packet when a source IP address or a destination IP address of each of the packets matches any one of IP addresses in the IP address table; And
And accepting the corresponding packet when the source IP address or the destination IP address of each of the packets does not match the IP addresses in the IP address table. A security unit for managing a plurality of host computers connected to the Internet network; And
Wherein each of the packets communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted from the Domain Name Server (DNS) server through the Internet network, And a sniffing unit configured to extract an IP address corresponding to the domain name and update the IP address in the IP address table,
Wherein the security unit is configured to block the packet according to whether the source IP address or the destination IP address of each of the packets matches one of the IP addresses in the IP address table. 8. The method of claim 7,
Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server according to a DNS query packet requesting an IP address corresponding to the domain name,
Wherein the DNS query packet is generated at any one of the plurality of host computers. 8. The method of claim 7,
Wherein the IP address table is stored in the security unit. 8. The method of claim 7,
Wherein the IP address table is stored in the sniffing unit. 8. The method of claim 7,
The security unit
When the source IP address or the destination IP address of each of the packets coincides with any one of the IP addresses in the IP address table,
And accepts the packet when the source IP address or the destination IP address of each of the packets does not match the IP addresses in the IP address table. A method of operating a security system for managing a plurality of host computers connected to an Internet network, the method comprising:
Determining whether a packet communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted through the Internet network or a normal packet from a DNS (Domain Named Server) server;
Extracting an IP address corresponding to a domain name from the DNS response packet and updating the extracted IP address in an IP address table when the packet is the DNS response packet; And
Blocking the normal packet according to whether the source IP address or the destination IP address of the normal packet coincides with any one of the IP addresses in the IP address table when the packet is the normal packet,
Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server according to a DNS query packet requesting an IP address corresponding to the domain name,
Wherein the DNS query packet is generated at any one of the plurality of host computers. delete 13. The method of claim 12,
Wherein the determining is performed based on a header of the packet. 13. The method of claim 12,
Wherein the destination of the DNS response packet is any one of the plurality of host computers,
Detecting a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network and storing information on the plurality of DNS query packets,
The step of updating the IP address table may include determining whether a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets, And extracting the IP address. 13. The method of claim 12,
The blocking step
Blocking the normal packet when the source IP address or the destination IP address of the normal packet matches any one of the IP addresses in the IP address table; And
Allowing the normal packet when the source IP address or the destination IP address of the normal packet does not match the IP addresses in the IP address table.

Images