KR101429877B1

KR101429877B1 - L2/L3 switch system having a function of security module updating

Info

Publication number: KR101429877B1
Application number: KR1020130126746A
Authority: KR
Inventors: 최보경
Original assignee: 주식회사 다산네트웍스; (주) 파이어넷
Priority date: 2013-10-23
Filing date: 2013-10-23
Publication date: 2014-08-13

Abstract

The present invention relates to a L2/L3 switch system having a security module updating function. The present invention can improve convenience for a user by automatically updating a security module if a security server detects update information without inconvenience of manually updating the security module of the L2 / L3 switch system.

Description

An L2 / L3 switch system having a security module update function has a function of updating a security module,

The present invention relates to an L2 / L3 switch, and more particularly to an L2 / L3 switch system having a security module update function.

Korean Patent Laid-Open No. 10-2011-0117947 (Oct. 28, 2011) discloses that the conventional L2 / L3 switch system does not have an update function for the security module, so that the user must manually update the security module manually There was.

Accordingly, the present inventors have developed a security module update function that can improve user convenience by automatically updating a security module when update information is detected from a security server without the inconvenience of a user manually updating the security module, L3 switch system.

Korean Patent Publication No. 10-2011-0117947 (October 28, 2011)

It is an object of the present invention to provide a security module update function which is implemented to automatically update a security module when update information is detected from a security server without the inconvenience of a user manually updating the security module, / L3 switch system.

According to an aspect of the present invention, there is provided an L2 / L3 switch system having a security module update function, including: a security module for detecting an abnormality of traffic data transmitted and received using sampling data; A traffic sampling engine for extracting sampling data for detecting an anomaly from traffic data to be transmitted and received, and a system on a chip (SoC) module including a packet forwarding engine for relaying traffic data transmitted and received and; Controlling the operation of the security module and the traffic sampling engine to be off when update information is detected from the security server, controlling the packet forwarding engine operation to keep on, An O / S kernel module for controlling the update of the security module using updated update data; And the like.

According to a further aspect of the present invention, there is provided an update engine, wherein the switch SoC module receives update data from a security server and updates the security module by reflecting the update data to the security module under the control of the O / S kernel module; And further comprising:

According to a further aspect of the present invention, when the O / S kernel module detects update information from the security server, it releases the memory allocation of the security module and reassigns the security module to the memory after the security module update is completed .

According to a further aspect of the present invention, after the security module update of the O / S kernel module is completed, the security module operation and the traffic sampling engine operation are controlled to be on.

According to a further aspect of the present invention, the update engine detects update information by monitoring an update notification from a security server or a security module version of a security server, and reports the update information to the O / S kernel module.

The present invention has the effect of improving user convenience by automatically updating the security module when update information is detected from the security server without the inconvenience of the user manually updating the security module of the L2 / L3 switch system.

1 is a block diagram illustrating a configuration of an L2 / L3 switch system having a security module update function according to an embodiment of the present invention.
2 is a flowchart illustrating an example of a security module update operation of an L2 / L3 switch system having a security module update function according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The terms used throughout the specification of the present invention have been defined in consideration of the functions of the embodiments of the present invention and can be sufficiently modified according to the intentions and customs of the user or operator. It should be based on the contents of.

1 is a block diagram illustrating a configuration of an L2 / L3 switch system having a security module update function according to an embodiment of the present invention. 1, an L2 / L3 switch system 100 having a security module update function according to this embodiment includes a security module 110, a switch on system (SoC) module 120, And an O / S kernel module 130.

The security module 110 detects abnormalities of traffic data transmitted and received using the sampling data. For example, the security module 110 includes a black list 111 such as an abnormal data pattern, and a security application 112 for comparing the sampled data and the abnormal data pattern to determine whether the traffic data is abnormal .

The switch SoC module 120 extracts sampling data for detecting abnormality of traffic data, performs packet forwarding for relaying traffic data transmitted and received, and includes a traffic sampling engine 121, a packet forwarding And a packet forwarding engine 122.

The traffic sampling engine 121 extracts sampling data for detecting abnormality from traffic data transmitted and received. For example, the traffic sampling engine 121 may be configured to extract sampling data of a specific data size from the traffic data transmitted and received at specific time intervals.

The packet forwarding engine 122 relays traffic data to be transmitted and received. The function of the L2 / L3 switch is to relay the transmission / reception data between communication nodes (not shown) connected to the L2 / L3 switches, and this function is performed by the packet forwarding engine 122.

The O / S kernel module 130 controls the entire L2 / L3 switch system 100. When the update information is detected from the security server 200, the O / S kernel module 130 controls the operations of the security module 110 and the traffic sampling engine 121 And the operation of the packet forwarding engine 122 is kept to be on and the security module 110 is controlled to use the update data received from the security server 200 .

When the O / S kernel module 130 detects update information from the security server 200, the O / S kernel module 130 releases the memory (not shown) of the security module 110 and updates the security module 110 And reassign the security module 110 to memory after completion.

The O / S kernel module 130 may be configured to control the operation of the security module 110 and the operation of the traffic sampling engine 121 to be on after the security module 110 is updated .

Therefore, according to the present invention, when the update information is detected from the security server, the security module is updated automatically. However, according to the present invention, a sampling data extraction function for detecting abnormalities of traffic data during updating of the security module, And the packet forwarding function for relaying the transmission / reception traffic data is maintained, so that the security module can be automatically updated without any problem.

According to a further aspect of the invention, the switch SoC module 120 may further include an update engine 123. The update engine 123 receives the update data from the security server 200 and updates the security module by reflecting the update data to the security module 110 under the control of the O / S kernel module 130. At this time, the update data may be a newly added black list 111 or a new version of the security application 112 code.

Meanwhile, the update engine 123 detects update information through the update notification from the security server 200 or the security module version of the security server 200 and reports the updated information to the O / S kernel module 130, The S kernel module 130 may be configured to detect update information.

Therefore, according to the present invention, when the update information is detected from the security server without the inconvenience of the user manually updating the security module of the L2 / L3 switch system, the security module is automatically updated through the update engine 123, .

The security module update operation of the L2 / L3 switch system having the security module update function according to the present invention as described above will be described with reference to FIG. 2 is a flowchart illustrating an example of a security module update operation of an L2 / L3 switch system having a security module update function according to the present invention.

First, in step 310, the L2 / L3 switch system detects security module update information. At this time, the L2 / L3 switch system can detect the update information through the update notification from the security server or the security module version monitoring of the security server.

If the security module update information is detected by the step 310, the L2 / L3 switch system receives update data for updating the security module from the security server in step 320. At this time, the update data may be a newly added black list or a new version of the secure application code.

Then, in step 330, the L2 / L3 switch system controls the security module operation and the traffic sampling engine operation to be off and the packet forwarding engine operation to continue to be on.

Then, in step 340, the L2 / L3 switch system updates the security module of the L2 / L3 switch system using the update data received from the security server by step 320 above.

When the security module update is completed, in step 350, the L2 / L3 switch system turns on the security module operation and the traffic sampling engine operation turned off by the step 330 on.

Therefore, according to the present invention, when the update information is detected from the security server without the inconvenience of the user manually updating the security module of the L2 / L3 switch system, the security module is automatically updated to improve user convenience Therefore, the object of the present invention can be achieved.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. .

The present invention is industrially applicable in the L2 / L3 switch technology field and its application field.

100: L2 / L3 switch system
110: Security module
111: Blacklist
112: Security Application
120: Switch SoC module
121: Traffic sampling engine
122: Packet Forwarding Engine
123: Update Engine
130: O / S kernel module
200: Security server

Claims

A security module for detecting abnormalities of traffic data transmitted and received using the sampling data;
A traffic sampling engine for extracting sampling data for detecting abnormality from traffic data to be transmitted and received, and a system on a chip (SoC) module including a packet forwarding engine for relaying traffic data transmitted and received and;
Controlling the operation of the security module and the traffic sampling engine to be off when update information is detected from the security server, controlling the packet forwarding engine operation to keep on, An O / S kernel module for controlling the update of the security module using updated update data;
L3 switch system having a security module update function.

The method according to claim 1,
The switch SoC module comprises:
An update engine for receiving update data from the security server and updating the security module by reflecting the update data to the security module under the control of the O / S kernel module;
L2 / L3 switch system having a security module update function.

3. The method according to claim 1 or 2,
The O / S kernel module comprises:
And when the security information is detected from the security server, releasing the memory allocation of the security module, and reassigning the security module to the memory after the security module update is completed, the L2 / L3 switch system having the security module update function.

3. The method according to claim 1 or 2,
The O / S kernel module comprises:
L3 switch system having a security module update function, after the security module update is completed, the security module operation and the traffic sampling engine operation are turned on.

3. The method of claim 2,
The update engine comprising:
And reports the update information to the O / S kernel module by notifying the update information from the security server or monitoring the security module version of the security server.