KR101444908B1 - Security device storing signature and operating method thereof - Google Patents

Abstract

The present invention relates to a security device and a method of operation thereof. A method of operating a security device in accordance with an embodiment of the present invention includes storing a plurality of signatures each corresponding to a plurality of applications to be managed, generating first data packets communicated between the host computer and the Internet network for a predetermined time Monitoring and detecting signatures corresponding to the first data packets, and defining the detected signatures as hot signatures. After the hot signatures are defined, the second data packet communicated between the host computer and the Internet network is processed according to whether it corresponds to hot signatures.

Description

TECHNICAL FIELD [0001] The present invention relates to a security device for storing signatures,

The present invention relates to an electronic apparatus, and more particularly, to a security apparatus and a method of operating the same.

Nearly every application on a computer currently uses network resources, such as the Internet network, and the traffic of a large number of applications flows through the Internet, causing intentional or unintentional problems. Therefore, the administrator managing the traffic between the computer and the Internet network determines which application is generating the traffic, and how each of the applications has an impact on the Internet network and the Internet network is used by these applications It was asked to decide whether to block or allow it.

On the other hand, in order to identify the application that generates the data packet, there is a signature based identification technique. This is a method of storing a signature for each application in advance, comparing a previously stored signature with a data packet when a data packet is generated, and identifying the corresponding application when matching. At this time, since the identification of the application is based on the pre-stored signature, if there are a large number of pre-stored signatures, comparatively large load is applied to the comparison operation, but more applications can be identified. On the other hand, if there are few pre-stored signatures, relatively few applications can be identified but relatively few applications can be identified. For example, if N signatures are stored for N applications, a maximum of N comparison operations must be performed when a data packet is generated, and the number of comparison operations performed when the number of signatures is increased will also increase.

Embodiments of the present invention are intended to maintain reliability for application identification while reducing the number of comparison operations between data packets and signatures.

A method of operating a security device according to an embodiment of the present invention includes: storing a plurality of signatures each corresponding to a plurality of applications to be managed; Monitoring first data packets communicated between the host computer and the Internet network for a predetermined period of time to detect signatures corresponding to the first data packets from the plurality of signatures; And defining the detected signatures as hot signatures when the predetermined time has elapsed. After the hot signatures are defined, a second data packet communicated between the host computer and the Internet network is processed according to whether it corresponds to the hot signatures.

In an embodiment, the defining step includes defining the detected signatures of the plurality of signatures as hot signatures and the remaining signatures as cold signatures. The determination as to whether or not the second data packet corresponds to the cold signatures will be omitted.

As an embodiment, the second data packet is blocked when the second data packet corresponds to one of the hot signatures, and the second data packet is not sent when the second data packet does not correspond to the hot signatures Can be allowed.

As an embodiment, during the predetermined time, the host computer may communicate third data packets over one session of the Internet network, and the third data packets may be included in the first data packets. Wherein the detecting of the signatures comprises: discriminating whether there is a signature corresponding to the corresponding data packet among the plurality of signatures each time the respective third data packets are sequentially received; And incrementing the count value each time the discrimination step is performed. At this time, when the count value becomes larger than a predetermined threshold value, the discriminating step for the remaining data packets not yet received among the third data packets is omitted and the third data packets of the plurality of signatures The corresponding signature is treated as nonexistent.

Another aspect of the present invention relates to a security device. A security device according to an embodiment of the present invention includes a storage unit configured to store a plurality of signatures respectively corresponding to a plurality of applications to be managed; Monitoring the first data packets communicated between the host computer and the Internet network for a predetermined time to detect signatures corresponding to the first data packets from the plurality of signatures, A signature management unit configured to set the detected signatures as hot signatures; And a data packet processing unit configured to determine whether a second data packet communicated between the host computer and the Internet network corresponds to the hot signatures in the storage unit and to process the second data packet according to the determination result Unit.

In an embodiment, the signature management unit sets the detected ones of the plurality of signatures to hot signatures and sets the remaining signatures to cold signatures. At this time, the signature management unit skips the determination as to whether or not the second data packet corresponds to the cold signatures.

In an embodiment, the signature management unit blocks the second data packet when the second data packet corresponds to one of the hot signatures, and when the second data packet does not correspond to the hot signatures, The second data packet can be accepted.

As an embodiment, during the predetermined time, the host computer may communicate third data packets over one session of the Internet network, and the third data packets may be included in the first data packets. At this time, the signature management unit determines whether there is a signature corresponding to the corresponding data packet among the plurality of signatures each time the third data packets are sequentially received, and when the determination step is performed, Can be increased. And, when the count value becomes larger than a predetermined threshold value, the discriminating operation for remaining data packets not yet received among the third data packets is omitted.

According to an embodiment of the present invention, reliability of application identification is maintained while reducing the number of comparison operations between data packets and signatures.

1 is a block diagram illustrating a network including a security device according to an embodiment of the present invention.
2 is a block diagram illustrating a security device according to an embodiment of the present invention.
3 is a flowchart showing an operation method of a signature management unit according to an embodiment of the present invention.
4 is a conceptual illustration of the signatures stored in the storage unit.
5 is a flow chart showing a method of operation of the data packet processing unit of FIG.
6 is a flowchart showing an embodiment of an operation method of the signature management unit.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

1 is a block diagram illustrating a network 100 including a security device 110 in accordance with an embodiment of the present invention.

Referring to FIG. 1, a network 100 includes a host computer (PC), a security device 110, an Internet network 120, and a plurality of server computers 141 to 14n.

The host computer (PC) is connected to the Internet network 120 via the security device 110. The host computer (PC) can communicate using a plurality of applications. In this case, the application is a program that is driven by a host computer (PC) and generates traffic in the Internet network 120, and is software running on a host computer (PC). When an application is run on a host computer (PC), an application generates data packets to the Internet network 120 and receives data packets transmitted through the Internet network 120 to access the server computer.

On the other hand, data packets generated by different applications may correspond to different signatures. A signature means a characteristic, e.g., a constant data pattern, that can identify whether a data packet has been generated by an application.

The security device 110 is configured to manage data packets transmitted to and received from a host computer (PC). In the security device 110, a plurality of signatures are stored in advance. The plurality of signatures correspond to a plurality of applications to be managed, respectively. That is, each signature contains a certain data pattern generated by the application, and thus can be used to determine which application the data packet was generated by. When the data packet is communicated between the host computer (PC) and the Internet network 120, the security device 110 compares the data packet with the signature, so that the host computer (PC) It is possible to determine whether or not the connection is established. The configuration of the security device 110 will be described in more detail with reference to FIG.

The first to nth server computers 141 to 14n are connected to the host computer PC through the Internet network 120 and the security device 110. [ The first to nth server computers 141 to 14n may correspond to a plurality of applications, for example, each of which is driven by a host computer (PC). That is, each application running on the host computer (PC) can access the server computer by exchanging data packets with different server computers.

2 is a block diagram illustrating a security device 110 in accordance with an embodiment of the present invention.

Referring to FIG. 2, the security device 110 includes a preprocessor 210, a signature management unit 220, a storage unit 230, a data packet processing unit 240, and an analyzer 250.

The preprocessor 210 receives the data packets DP. In this case, each data packet may be a downlink data packet transmitted to the host computer (PC) through the Internet network 120 or an uplink data packet transmitted from the host computer (PC) through the Internet network 120. The preprocessor 210 may pass only data packets DP corresponding to a specific protocol. As an embodiment, the preprocessor 210 may pass only data packets DP corresponding to a hypertext transfer protocol (HTTP) communication protocol. The preprocessor 210 sends the data packets DP to the signature management unit 220 and the data packet processing unit 240.

The signature management unit 220 receives the data packets DP and detects signatures corresponding to the data packets DP among the plurality of signatures sg1 to sgN in the signature table T. [ Signatures corresponding to the data packets DP can be detected, for example, by performing a string comparison between the data packet and the plurality of signatures sg1 through sgN each time a data packet is received.

The data packets DP will be packets received for a predetermined time. That is, the detection operation is performed on data packets DP received on a predetermined time basis. By way of example, this predetermined time may be set by the user of the security device 110, such as a week or a month.

When a predetermined time has elapsed, the signature management unit 220 controls the storage unit 230 so that the detected signatures are set to the hot signatures. Signatures that are not hot signatures in the signatures (sg1 to sgN) in the signature table (T) can be defined as cold signatures.

The operation of detecting signatures and the operation of setting detected signatures to hot signatures will be repeated in a predetermined time unit as described above.

The storage unit 230 is connected to the signature management unit 220 and the data packet processing unit 240. The storage unit 230 is configured to store the signature table 230. The signature table 230 stores a plurality of signatures sg1 to sgN corresponding to a plurality of applications, respectively. As an example, the storage unit 230 may be at least one of various storage media such as SRAM (Static RAM), DRAM (Dynamic RAM), SDRAM (Synchronous DRAM) and the like.

The data packet processing unit 240 receives the data packets DP. The data packet processing unit 240 also receives hot signatures from the signature table T from the storage unit 230. [ Each time data packets DP are received, the data packet processing unit 240 determines whether the corresponding data packet corresponds to each hot signature. At this time, the data packet processing unit 240 does not compare the data packet with the cold signatures. That is, the comparison with the cold signatures is omitted. Thus, the time taken for the comparison operation of the data packet processing unit 240 is shortened, and as a result, the processing time for the data packets DP is shortened.

As an example, if the data packet corresponds to any hot signature, the data packet will be blocked, for example. If the data packet does not correspond to any hot signature, the data packet will be allowed, for example. If allowed, the data packet processing unit 240 will send the data packet out.

The analyzer 250 generates the processing result of the data packet processing unit 240 as log information. Such log information may be known to a user of the security device 110, for example, via a display device. Alternatively, such log information may be stored in the storage unit 230 or a separate storage medium (not shown).

1, the preprocessor 210, the signature management unit 220, the data packet processing unit 240 and the analyzer 250 may be implemented by a plurality of physical devices and may be implemented by one physical device It will be understood that it is possible. For example, each of the preprocessor 210, the signature management unit 220, the data packet processing unit 240, and the analyzer 250 may be implemented using various methods, such as using software or firmware .

According to the embodiment of the present invention, since the plurality of signatures sg1 to sgN are stored while the data packets DP are compared with the hot signatures without being compared with the cold signatures, Is shortened and the processing time of the data packet is shortened, the reliability of the application identification is maintained.

3 is a flowchart showing an operation method of the signature management unit 220 according to an embodiment of the present invention.

Referring to FIGS. 2 and 3, in step S110, a data packet is received in the signature management unit 220. FIG. In step S120, the signature management unit 220 determines whether or not there is a signature corresponding to the data packet in the signature table (T). In step S130, the signature management unit 220 detects the signature according to the determination result. Information on the detected signature can be temporarily stored in the storage unit 230, for example.

In step S140, the signature management unit 220 determines whether or not a predetermined time has elapsed. If the predetermined time has elapsed, step S150 is performed. If the predetermined time has not elapsed yet, step S110 is performed. That is, steps S110 to S140 are repeatedly performed each time a data packet is received for a predetermined time.

In step S150, the signature management unit 220 sets the signatures detected during the predetermined time to the hot signatures. As an example, the signature management unit 220 may set the detected signatures to hot signatures by storing flag values corresponding to the detected signatures. For example, the signature management unit 220 may store the flag values of the hot signatures as "1 " and the flag values of the cold signatures as" 0 ". In addition, the signature management unit 220 may divide the signatures sg1 through sgN stored in the storage unit 230 into hot signatures and cold signatures through various methods.

4 is a diagram conceptually showing the signatures sg1 to sg100 stored in the storage unit 220. As shown in Fig.

Referring to FIG. 4, the storage unit 220 stores first through 100th signatures sg1 through sg100. The signature management unit 220 divides the first to the hundredth signatures sg1 to sg100 into the hot signatures hsg and the cold signatures csg.

According to the embodiment of the present invention, a plurality of signatures sg1 to sg100 are stored in the storage unit 220, and only hot signatures hsg, which are a part thereof, are compared with the data packet.

5 is a flowchart showing a method of operating the data packet processing unit 240 of FIG.

Referring to FIGS. 2, 4 and 5, in step S210, a data packet is received in the data packet processing unit 240. FIG. In step S220, the data packet processing unit 240 determines whether or not the corresponding data packet corresponds to at least one hot signature. Here, the discriminating operation for the cold signature is omitted.

If there is a hot signature corresponding to the data packet, step S230 is performed. Otherwise, step S240 is performed.

In step S230, the data packet processing unit 240 blocks the corresponding data packet. In step S240, the data packet processing unit 240 allows the corresponding data packet.

It will be appreciated that, unlike that shown in FIG. 5, the data packet may be processed in a variety of ways depending on whether there is a corresponding hot signature with the data packet. For example, if there is a hot signature corresponding to the data packet, the security device 110 informs the user of the fact that the corresponding data packet is blocked according to the user's selection.

6 is a flowchart showing an embodiment of a method of operation of the signature management unit 220. FIG.

Referring to FIG. 6, the operation of detecting the hot signature of the signature managing unit 220 may be performed for each session.

In step S310, a data packet on one session is received. At this time, the session means a physical and logical connection path between the host computer (PC, see FIG. 1) and the server computer (for example, 141) from when the application starts to be used until its use ends. For example, it means a physical and logical connection path between a host computer (PC) and a corresponding server computer from the time of login to the time of logout when a login or logout occurs by a specific user in the application.

In step S320, the signature management unit 220 increments the count value. That is, the signature management unit 220 stores the count value and increases the count value each time a data packet is received through the session.

In step S330, the signature management unit 220 determines whether there is a signature corresponding to the corresponding data packet among the signatures (sg1 to sgN, see FIG. 2) in the signature table. If not, step S340 is performed. If so, step S350 is performed. In step S350, the corresponding signature is detected. If a signature is detected, the operation is terminated.

In step S340, the signature management unit 220 determines whether the count value is greater than the threshold value. If the count value is less than or equal to the threshold value, step S310 is performed. If the count value is greater than the threshold value, the operation ends. That is, even though a large number of data packets are communicated through the session, when the number of data packets larger than the threshold value is communicated, the data packets at the time of exceeding the threshold value are not compared with the signatures sg1 to sgN. That is, the comparison between the data packets and the signatures sg1 to sgN when crossing the threshold will be skipped and no signatures corresponding to the data packets communicated on that session will be treated as nonexistent.

All of the data packets generated by the application of the host computer (PC) may not include the corresponding signature corresponding to the application. Therefore, in order to identify the application, at least a predetermined number of data packets should be compared with the signatures sg1 to sgN. However, even when a relatively large number of data packets are communicated, only a part of the data packets generated earlier among them are compared with the signatures sg1 to sgN, the reliability is not significantly degraded. Thus, according to an embodiment of the present invention, the comparison between the data packets and the signatures sg1 to sgN when exceeding the threshold is omitted.

Thereafter, when the predetermined time (see FIG. 3) has elapsed, the signature detected in step S350 will be set as a hot signature in the signature table T. For another session, a signature will be detected and set to a hot signature in the signature table T as described with reference to Fig.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the claims equivalent to the claims of the present invention as well as the claims of the following.

PC: Host computer
110: Security device
120: Internet network
141 to 14n: first to nth server computers
210: preprocessor
220: Signature management unit
230: storage unit
240: Data packet processing unit
250: Analyzer

Claims (13)

A method of operating a security device provided between a host computer and an Internet network, the method comprising:
Storing a plurality of signatures each corresponding to a plurality of applications to be managed;
Monitoring first data packets communicated between the host computer and the Internet network during a predetermined time period to detect signatures corresponding to the first data packets from the plurality of signatures; And
Defining the detected signatures as hot signatures and defining the remaining signatures as cold signatures when the predetermined time has elapsed,
After the hot signatures are defined, a second data packet communicated between the host computer and the Internet network is processed according to whether it corresponds to the hot signatures and whether the second data packet corresponds to the cold signatures The judgment as to whether or not it is omitted is omitted. delete delete The method according to claim 1,
The second data packet is blocked when the second data packet corresponds to one of the hot signatures,
Wherein the second data packet is allowed when the second data packet does not correspond to the hot signatures. The method according to claim 1,
Wherein the host computer communicates third data packets over one session of the Internet network during the predetermined time,
Wherein the third data packets are included in the first data packets. 6. The method of claim 5,
Wherein the detecting of the signatures comprises: discriminating whether there is a signature corresponding to the corresponding data packet among the plurality of signatures each time the respective third data packets are sequentially received;
And incrementing the count value each time the determining step is performed,
When the count value is greater than a predetermined threshold value, the discriminating step for remaining data packets not yet received among the third data packets is omitted and the corresponding one of the plurality of signatures corresponding to the third data packets Wherein the signature is treated as nonexistent. The method according to claim 1,
Wherein each of the first data packets is configured based on a hypertext transfer protocol (HTTP) communication protocol. A security device provided between a host computer and an Internet network, comprising:
A storage unit configured to store a plurality of signatures each corresponding to a plurality of applications to be managed;
Monitoring the first data packets communicated between the host computer and the Internet network for a predetermined time to detect signatures corresponding to the first data packets from the plurality of signatures, A signature management unit configured to set the detected signatures as hot signatures and to set the remaining signatures as cold signatures; And
A data packet processing unit configured to determine whether a second data packet communicated between the host computer and the Internet network corresponds to the hot signatures in the storage unit and to process the second data packet according to the determination result, ≪ / RTI >
The data packet processing unit skipping the determination as to whether the second data packet corresponds to the cold signatures. delete delete 9. The method of claim 8,
Wherein the signature management unit blocks the second data packet when the second data packet corresponds to one of the hot signatures, and when the second data packet does not correspond to the hot signatures, . 9. The method of claim 8,
Wherein the host computer communicates third data packets over one session of the Internet network during the predetermined time,
Wherein the third data packets are included in the first data packets. 13. The method of claim 12,
The signature management unit determines whether there is a signature corresponding to the corresponding data packet among the plurality of signatures each time the third data packets are sequentially received, and increments the count value each time the determination step is performed However,
Wherein when the count value is greater than a predetermined threshold value, the discriminating operation for remaining data packets not yet received among the third data packets is omitted.

Images