KR101425726B1 - Linked network security system and method based on virtualization in the separate network environment - Google Patents

Abstract

The LNSV of the present invention includes a first network interworking system, an interworking control system, a second network interworking system, and an interworking monitoring system, wherein each of the systems is logically separated by a hypervisor, And is implemented between the second networks. Thus, although individual communication is possible with users included in each of the separate networks, no direct communication session is created between users belonging to the separate network. Therefore, it is possible to send and receive data without any removable storage medium between separate networks. In the case of data transmission, encryption / decryption algorithm is applied in a single system and user validation process is performed by network connection information, Functions can be satisfied.

Description

TECHNICAL FIELD [0001] The present invention relates to a network-based security system and a method thereof,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network-connected security system and a method thereof, and more particularly, to a network-based security system and method capable of ensuring secure data transmission between separate networks.

Today, it is the era that promotes business through the use of computers and networks and creates high added value. Governments, corporations, and individuals have already embraced computer and networked cyberspace as an indispensable part of their work and life. Therefore, they are highly interested in defending various attacks for the security of cyberspace. Despite this interest, however, cyber threats have been causing serious damage and are continuing to occur. Therefore, research on problems and countermeasures in areas such as intelligent phishing, critical infrastructure attacks using Stuxnet, and internal information leakage It is actively proceeding.

One way to solve this problem is to separate the intranet and the Internet. FIG. 1 is a diagram showing an example of such a network separation configuration. In particular, FIG. 1 illustrates an example in which networks are separated physically and logically. In the example of FIG. 1, the network 10 and the network 20 are examples of physical network separation, and the network 30 is an example of logical network separation. Physical network separation is a hardware separation of all systems and networks, and logical network separation is a software technique.

In this way, if the network is physically or logically separated, the networks can not communicate with each other and thus require a separate data transmission architecture. For example, data transmission has been performed between networks using a removable storage medium (e.g., CD, USB, etc.). This method requires the risk of data leakage due to the loss of the removable storage medium, the inconvenience of users who need to connect to PC every time they use it, and the risk of malicious code transmission. It also has the disadvantage of adding USB authentication and encryption related systems.

Meanwhile, a connected server based on storage as illustrated in FIG. 2 may be utilized for data transmission between separated networks. Separate servers 40, 50, 70 and 80 for establishing a storage 60 between separate networks (e.g., the Internet and an intranet) and connecting each network to the storage 60, The users belonging to each network can store data in the storage device 60 so that a user belonging to the other network can read data from the storage device 60. [ However, since this method requires construction and operation of a plurality of servers and storage devices separately, it must satisfy various requirements such as an access control system and an encryption / decryption function. This increases the investment cost of IT assets and reduces the efficiency of system and network administrators and users.

Therefore, this study aims to provide a network-based security system and method for virtualization-based network that can conveniently and securely transmit data in a network separation environment.

In one aspect, a virtualization-based network-linked security system is provided. Wherein the virtualization-based network-connected security system is a network-based security system between two or more separate networks, the network-based security system comprising: at least two network interworking systems field; An interworking control system for transmitting and receiving the encrypted data between the two or more network interworking systems; And an interworking monitoring system for monitoring the operation status of the at least two network interworking systems and the interworking control system and for managing data transmission results, wherein the at least two network interworking systems, the interworking control system, and the interworking monitoring system Wherein the interworking monitoring system reports a list of user identification information and network connection information to be connected to the network interworking systems and sets a security policy based on the information .
The two or more network interworking systems each storing valid user information in the network-based security system; A network connection unit for controlling connection with the network user; A data storage unit for storing data for transmission to another separate network or data received from the other network; And a control unit for checking whether the data sender is valid based on valid user information stored in the user database when the data is received from the network, encrypting and storing the received data, and generating a data storage announcement signal.
Here, the controller may check whether the data sender is valid based on the information stored in the user database when the data is received from another network, decrypt the received data, and store the received data.
The interworking control system may further include a first connection control unit connected to a network interworking system of a transmitting-side network to which data is to be transmitted in response to a storage notification signal of the control unit and reading data newly stored in the data storage unit; A data analyzer for analyzing the read data and detecting receiver network connection information; And a second connection control unit for confirming the network to which the data is to be received based on the detected receiver network connection information and for connecting to the reception side network interworking system and storing data.

According to another aspect of the present invention, there is provided a network-linked security method using the network-linked security system, the system comprising: a first and a second network interworking system respectively interworking with separate first and second networks; A network connection security method using a network connection security system in which an interworking control system for transmitting and receiving data between network interworking systems is logically separated from one server, Confirming the validity of the data; If the sender is valid, encrypting and storing transmission data by the first network interworking system; The first network interworking system generating a data storage announcement signal; Reading the transmission data after the interworking control system is connected to the first network interworking system in response to the data storage announcement signal; The interworking control system accessing the second network interworking system to transmit the transmission data; Confirming the validity of the transmission data sender by the second network interworking system; And decrypting and storing transmission data by the second network interworking system when the sender is valid.
The step of verifying the validity of the sender of the first network interworking system preferably checks whether the sender's ID, password and network connection information are valid based on user information previously stored in the first network interworking system.
Preferably, the step of encrypting and storing the transmission data by the first network interworking system stores the encrypted transmission data together with the sender identification information, the network connection information, the receiver identification information, and the network connection information.
In addition, the step of transmitting the transmission data may include the steps of: the interworking control system analyzing the transmission data to detect the sender identification information, the network connection information, and the receiver network connection information; Transmitting the sender identification information and the network connection information to the second network interworking system; And transmitting transmission data in response to a reception permission notification signal transmitted from the second network interworking system.
In addition, the step of verifying the validity of the sender of the second network interworking system preferably confirms whether the sender's ID, password and network connection information are valid based on the user information previously stored in the second network interworking system.

In the present invention, each individual storage device is installed in a separate network, and the data is transmitted and received by connecting to the individual storage device using a logically separated interlocking control system, so that the use of a removable storage medium It is possible to transfer data between separate networks without the Therefore, it can be free from the risk of data leakage due to the loss of the removable storage medium, the inconvenience of users who need to connect with PC every time they use, and the risk of malicious code propagation.

In addition, by applying encryption / decryption algorithm in a single system during data transmission and verifying user validity by network connection information, all the security functions required for data transmission can be satisfied. Therefore, system and network administrators and users can concentrate on the management and operation of a single system, so that they can work effectively, and the initial investment cost for securing security in a network separation environment is small.

In addition, the virtualization-based network-based security system of the present invention is open to all users of the individual network using a network connector, and is universal enough to store all the data that need to be transmitted.

1 is a diagram showing an example of a general network separation configuration.
2 is a system configuration diagram using a storage-based link server according to a conventional embodiment.
3 is a system configuration diagram of a virtualization-based network-connected security system implemented on a network according to an embodiment of the present invention.
4 is a conceptual diagram of a network-based security system based on virtualization according to an embodiment of the present invention.
5 is a schematic block diagram of a network interworking system according to an embodiment of the present invention.
6 is a diagram illustrating a data field structure of a user database according to an exemplary embodiment of the present invention.
7 is a schematic block diagram of an interlocking control system according to an embodiment of the present invention.
8 is a view showing an example of a process list generated in the interlocking monitoring system according to an embodiment of the present invention.
9 is a flowchart of a virtualization-based network-linked security method according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and like parts are denoted by similar reference numerals throughout the specification. And a detailed description thereof will be omitted to omit descriptions of portions that can be readily understood by those skilled in the art.

Throughout the specification and claims, where a section includes a constituent, it does not exclude other elements unless specifically stated otherwise, but may include other elements.

3 is a system configuration diagram of a virtualization-based network-connected security system implemented on a network according to an embodiment of the present invention. Referring to FIG. 3, a virtual network based security system (LNSV) 100 according to an exemplary embodiment of the present invention includes a network 100 separated into an Internet and an intranet (Physically or Logically separate network)), and is implemented between an Internet server (40) and an Intranet (Disconnected) server (80) And performs communication. Therefore, the LNSV 100 of the present invention is capable of individual communication with users transmitting and receiving data (in this case, each user is connected to a separate network), and a session for communication is not created between the users. That is, the direct communication between users is not performed.

4 is a conceptual diagram of a network-based security system based on virtualization according to an embodiment of the present invention. Referring to FIG. 4, a virtual network-based security system (LNSV) 100 according to an exemplary embodiment of the present invention includes a first network interworking system 120, an interworking control system 130, a second network interworking system 140, And an interworking monitoring system 150. Each of the systems includes a CPU 171, a memory 172, a network information center (NIC) 173, a disk 174, Devices implemented on a single hardware 170 are virtual systems logically separated by a hypervisor 160. The hypervisor 160 may be a processor or a memory The hypervisor 160 is a software program that allows a plurality of operating systems to run on a single computer system. The hypervisor 160 is a thin layer of software that controls various operating systems (OS) With a central processing unit (CPU) It is an effective virtualization engine that can be used as a kind of intermediate software between operating systems and can be used to create virtual machines that use different operating systems on the same computer.

The systems of the present invention implemented on the hypervisor 160 will be described below.

First, the first and second network interworking systems 120 and 140 interwork with the first and second networks, respectively, which are separated from each other. Referring to FIG. 3, the first and second network interworking systems 120 and 140 include network connectors 121 and 141 and data storages 122 and 142, respectively, The first network interworking system 120 is interworked with the Internet of FIG. 3, and the second network interworking system 140 is interworked with the intranet of FIG. The network connection unit 121 of the first network interworking system 120 is connected to the Internet server 40 to transmit and receive data to and from the Internet server 40 and the second network interworking system 140 The network connection unit 141 is connected to an intranet server 80 and transmits and receives data to and from an intranet server 80. Data stores 122 and 142 cryptographically store data to be transmitted to other networks and decrypts and stores data received from other networks.

The interworking control system 130 transmits and receives the encrypted data between the first and second network interworking systems 120 and 140. To this end, the interworking control system 130 includes a first connection control unit 131 for connecting to the first network interworking system 120, a second connection control unit for connecting to the second network interworking system 140 And the first and second connection control units 131 and 132 perform security communication for transmitting the encrypted data.

The interlocking monitoring system 150 monitors the operation states of the first and second network interlocking systems 120 and 140 and the interlocking control system 130 and manages the data transmission results. In order to achieve this, a virtualization-based network security system monitor (LNSV Monitor) 151 for performing the monitoring operation, a security policy for setting a security policy by analyzing usage statistics such as data storage statistics per data / And a security policy 152.

5 is a schematic block diagram of a network interworking system according to an embodiment of the present invention. FIG. 5 illustrates the first network interworking system 120 of FIG. 4 as an example. Referring to FIG. 5, the first network interworking system 120 includes a network connection unit 121, a data storage unit 122, a control unit 123, and a user DB 124.

The network connection unit 121 controls connection with a first network (e.g., Internet) user. At this time, the user and the network connection unit 121 can be connected through a web-based or agent-based connection. The web-based method is a method in which a user inputs a network connection part address (e.g., a URL or an IP address) on an Internet access program (e.g., Internet Explorer) And connect them. Since the above methods use a GUI (Graphic User Interface), the user can intuitively select and move files.

On the other hand, the network connection unit 121 can automatically delete the transmission data after a certain period elapses from the user PC. This is to enhance the security of the transmission file by making it impossible to know the contents of the file moved to the separated network even if an accident occurs in the transmitted PC or network. To this end, the network connection unit 121 informs the user of the result of the last transmission list check, notifies the user of whether or not the file needs to be deleted, and finally determines whether or not the user deletes the file.

In addition, the network connection unit 121 may restrict the types of files that can be transferred in advance and transmit only limited types of files, and may designate a plurality of approval and approval providers for file transmission. In this case, the form of approval / approval can be set as pre-approval, post-approval, rejection, and non-use of the approval function, and the approver can approve after approving the data and the approval form to be transmitted and generate an approval alarm.

The data storage unit 122 stores data for transmission to another separated network (e.g., an intranet) or data received from the other network (e.g., an intranet).

The control unit 123 controls the operation of the first network interworking system 120 based on a preset control program. Particularly, when data is received from the network (for example, the Internet), the validity of the data sender is confirmed based on the information stored in the user DB 124. [ That is, based on the network connection information (e.g., IP address, port information, etc.) of the data sender, it is determined whether or not the data sender is a valid user. Only when the data sender is a valid user, the received data is stored in the data storage unit 122, encrypted and stored, and a 'data storage announcement signal' is generated. If the data sender is not valid, the user is disconnected. The 'data storage announcement signal' is for informing the interworking control system that new data to be transmitted to another network is generated.

On the other hand, when data is received from another network (for example, an intranet), the control unit 123 confirms the validity of the data sender based on the information stored in the user DB 124. [ That is, it decides whether or not the data sender is a valid user based on the network connection information (for example, IP address, port information, etc.) of the data sender, and decodes and stores the received data only when the data sender is a valid user. If the data sender is invalid, the data is ignored.

The user DB 124 stores valid user information in the network-linked security system. Referring to FIG. 6, the user DB 200 stores an ID 201 field for storing user identification information, and an IP address to which the user connects. And a port information field 205 for storing the IP address 203 field and the pod information to which the user is connected.

7 is a schematic block diagram of an interlocking control system according to an embodiment of the present invention. 5 and 7, the interlocking control system 130 includes a first connection control unit 131, a data analysis unit 133, and a second connection control unit 132. [

The first connection control unit 131 accesses the network interworking system in response to the 'data storage announcement signal' generated in the specific network interworking system and reads the newly stored data. If the 'data storage notification signal' generated in the first network interworking system 120 of FIG. 5 is received, the first connection control unit 131 responds to the 'data storage notification signal' And reads the data stored in the data storage unit 122 in the first network interworking system 120 by connecting to the network interworking system, that is, the first network interworking system 120.

The data analysis unit 133 analyzes the read data to detect recipient network connection information.

The second connection control unit 132 confirms the network (e.g., intranet) to which the data is to be received based on the receiver network connection information detected by the data analysis unit 133, and connects to the reception side network interworking system to store the data .

At this time, the interworking control system 130 preferably deletes the remaining data on the transmitting-side network interworking system. That is, after the second connection control unit 133 finishes storing data in the reception side network interworking system, the first connection control unit 131 preferably deletes the data that has been transmitted in the transmission side network interworking system. This is to prevent a manager or the like from previewing the corresponding file in the interworking control system 130 in advance and to make the contents of the moved file unknown even if an intrusion occurs in the interworking control system 130 to be. For this purpose, the interlocking control system 130 preferably deletes the transmitted data automatically. This is because it is unnecessary for the user or the administrator to perform additional work on the file.

8 is a view showing an example of a process list generated in the interlocking monitoring system according to an embodiment of the present invention. The interlocking monitoring system monitors the operation of each component of the virtualization-based cooperative security system of the present invention and as a result derives a list as illustrated in FIG. Then, the security policy is set based on the result. For example, a security policy such as automatically deleting the ID when the number of times that a user of a specific ID attempts to connect with an invalid path exceeds a preset threshold value may be set.

9 is a flowchart of a virtualization-based network-linked security method according to an exemplary embodiment of the present invention. FIG. 9 is a block diagram illustrating a first network interworking system 120 and a second network interworking system 140 interworking with separate first and second networks, an interworking system for transmitting and receiving data between the first and second network interworking systems 120 and 140, The interworking monitoring system 150 for monitoring the control system 130 and the first and second network interworking systems 120 and 140 and the interworking control system 130 is implemented using a network interfacing security system logically separated from one server A procedure for a network-linked security method is illustrated.

Referring to FIG. 9, when a user's connection attempt is detected in the first network interworking system 120 (S101), that is, when a specific user connected to the first network inputs his ID and password to access the first network system The first network interworking system 120 confirms the validity of the user using the information input by the user and the network connection information (for example, IP address and port information) (S103). The validity check confirms whether the ID, password, and network connection information of the user (i.e., the data sender) is valid based on the user information stored in advance in the first network interworking system 120. If it is determined that the sender is a legitimate user (S105), the first network interworking system 120 stores the input data input by the user (i.e., the data sender) (S109). In this case, the first network interworking system 120 encrypts and stores the input data, and stores the ID and network connection information (e.g., IP address and port information) of the sender, the ID of the receiver, and the network connection information And port information). It can also store hash values for encryption and decryption.

If it is determined that the sender is not valid as a result of the determination (S105), the first network interworking system 120 disconnects the corresponding user (i.e., the data sender) (S107).

Meanwhile, in step S109, the first network interworking system 120 storing the input data outputs a data storage notification signal (S111).

In step S115, the interworking control system 130, which confirms the data storage notification signal, accesses the first network interworking system 120 in response to the data storage notification signal in step S113 and reads the transmission data in step S115.

The interworking control system 130, which has read the transmission data from the first network interworking system 120, analyzes the transmission data, confirms the network connection information of the receiver and the receiver, and connects to the network interworking system of the corresponding network. In the example of FIG. 9, the network interworking system corresponding to the recipient's network is the second network interworking system 140. FIG. Accordingly, the interworking control system 130 connects to the second network interworking system 140 (S117) and transmits the transmission data.

At this time, the interworking control system 130 transmits the sender information, i.e., the sender's identification information and the network connection information, which is one of the data analysis results, to the second network interworking system 140 (S119) And transmits the transmission data to the second network interworking system 140 in response to the reception permission notification signal transmitted from the second network interworking system 140 having confirmed the sender's validity (S125, S127).

On the other hand, the second network interworking system 140 confirms the validity of the sender based on the sender information transmitted from the interworking control system 130 (S121), and if the sender is determined to be the authorized user (S123) Transmits the signal to the interlocking control system 130, receives the data from the interlocking control system 130, and stores the data (S129). At this time, in step S121, the second network interworking system 140 determines whether the ID, password, and network connection information of the sender are valid based on previously stored user information. In step S129, the received data is decoded and stored.

In the above-described exemplary system, the methods are described on the basis of a flowchart as a series of steps or blocks, but the present invention is not limited to the order of the steps, and some steps may occur in different orders or simultaneously .

It will also be understood by those skilled in the art that the steps shown in the flowchart are not exclusive and that other steps may be included or that one or more steps in the flowchart may be deleted without affecting the scope of the invention.

Claims (10)

A network-linked security system between two or more separate networks,
Two or more network interworking systems interworking with each of the two or more networks;
An interworking control system for transmitting and receiving the encrypted data between the two or more network interworking systems; And
And an interworking monitoring system for monitoring an operation state of the at least two network interworking systems and the interworking control system and managing a result of data transmission,
The two or more network interworking systems, the interworking control system and the interlocking monitoring system are logically separated devices in one server,
Wherein the interworking monitoring system reports user identification information and network connection information to be connected to the network interworking systems, and sets a security policy based on the information. The system of claim 1, wherein the two or more network interworking systems each comprise:
A user database for storing valid user information within the network-based security system;
A network connection unit for controlling connection with the network user;
A data storage unit for storing data for transmission to another separate network or data received from the other network;
And a control unit for checking whether the data sender is valid based on valid user information stored in the user database when the data is received from the network, encrypting and storing the received data, and generating a data storage announcement signal Network - based security system based on virtualization. 3. The apparatus of claim 2, wherein the control unit
Based on the information stored in the user database, whether the data sender is validated, and decrypts and stores the received data when data is received from another network. 3. The system of claim 2, wherein the interlocking control system
A first connection control unit connected to a network interworking system of a transmission side network to transmit data in response to a storage notification signal of the control unit and reading data newly stored in the data storage unit;
A data analyzer for analyzing the read data and detecting receiver network connection information;
And a second connection controller for confirming a network to which the data is to be received based on the detected receiver network connection information, and storing the data by connecting to a receiving network interworking system. delete The first and second network interworking systems interlocked with the first and second networks separated from each other, and the interworking control system for transmitting and receiving data between the first and second network interworking systems, A network-linked security method using a security system,
Confirming the validity of the sender that the first network interworking system attempts to connect to transmit data;
If the sender is valid, encrypting and storing transmission data by the first network interworking system;
The first network interworking system generating a data storage announcement signal;
Reading the transmission data after the interworking control system is connected to the first network interworking system in response to the data storage announcement signal;
The interworking control system accessing the second network interworking system to transmit the transmission data;
Confirming the validity of the transmission data sender by the second network interworking system; And
And if the sender is valid, the second network interworking system decrypts and stores the transmission data. 7. The method of claim 6, wherein validating the sender of the first network interworking system comprises:
And checks whether the sender's ID, password, and network connection information are valid based on user information previously stored in the first network interworking system. The method of claim 6, wherein encrypting and storing transmission data of the first network interworking system comprises storing the encrypted transmission data together with the sender identification information, the network connection information, the receiver identification information, and the network connection information To-network security method. 7. The method of claim 6, wherein transmitting the transmission data comprises:
The interworking control system analyzing transmission data to detect sender identification information, network connection information and recipient network connection information;
Transmitting the sender identification information and the network connection information to the second network interworking system; And
And transmitting transmission data in response to a reception permission notification signal transmitted from the second network interworking system. 7. The method of claim 6, wherein validating the sender of the second network interworking system comprises:
And confirms whether the sender's ID, password, and network connection information are valid based on user information previously stored in the second network interworking system.

Images