KR101656615B1 - Network security system and method for displaying a blocked site - Google Patents

Abstract

The present invention relates to a network security method for indicating a blocked website, i.e., a target to be blocked, by using a warning server of a network security system, thereby preventing leakage of information. The network security method for indicating a blocked website comprises the steps of: mirroring, by a DNS blocking server, a DNS query packet passing through network equipment to which a client terminal is connected; generating, by the DNS blocking server, a false DNS response packet when a DNS query domain address extracted from the DNS query packet is a domain address of a control target; transmitting, by the DNS blocking server, the false DNS response packet to the client terminal; when a warning server receives a certificate request packet from the client terminal, generating, by the warning server, a private certificate, and transmitting, by the warning server, the private certificate to the client terminal; and transmitting, by the warning server, a warning page, indicating that a website has been blocked, to the client terminal when a request packet is received from the client terminal.

Description

TECHNICAL FIELD [0001] The present invention relates to a network security system and a method for displaying blocked sites,

The following description relates to a technique for preventing information leakage, and relates to a network security method.

Due to the development of information and communication, it has become possible to access the Internet and exchange information anytime and anywhere. However, there are many harmful sites on the back that provide unhealthy information. As the risks of information leakage and hacking become greater, there is a growing interest in network security.

Korean Patent Laid-Open Publication No. 2014-0044987 provides a system and method for detouring an Internet access path through Domain Name System (DNS) packet modulation, thereby preventing IP address collision and enabling smooth communication. However, in the above-mentioned patent, a network security system using a proxy server inspects packets coming from the outside and blocks them, but can not block outgoing packets from the inside. Accordingly, there is a need for a technology capable of providing a security service while maintaining the existing network environment.

Further, there is a need for a technique that can warn that the page is a blocked page without error due to SSL communication even when the site to be blocked uses SSL (Secure Sockets Layer) communication.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a network security system and method for displaying a blocking site.

Specifically, the present invention can provide a method for preventing information leakage by displaying a blocking site to be blocked using a warning server of a network security system.

Also, according to the present invention, when a connection to a blocking site requiring SSL communication occurs using a warning server capable of generating SSL communication and private certificate, a private certificate is generated and provided to prevent an SSL communication error, And to provide a network security system and method capable of displaying the network security system.

In order to achieve the above object, a network security system according to an embodiment of the present invention includes a client device connected to a network device to mirror a DNS query packet through the network device, A DNS blocking server that generates a fake DNS response packet and transmits the fake DNS response packet to the client terminal when the domain address is a managed domain address; And a warning server for transmitting a warning page to the client terminal, when the server receives the request packet from the client terminal that received the bogus DNS response packet, informing that the site is blocked.

At this time, if the alert server receives the certificate request packet from the client terminal before receiving the request packet, the alert server may generate a private certificate and transmit the private certificate to the client terminal.

At this time, the private certificate may be a certificate corresponding to a site to which the client terminal wants to connect.

At this time, the warning server can generate the private certificate by using the DNS query domain address that the client terminal desires to access as an argument.

At this time, upon receipt of the private certificate, the client terminal can confirm whether the private certificate is trusted and authenticate the private certificate.

At this time, the client terminal sets information about the warning server as a trusted root certification authority in advance.

At this time, the DNS blocking server may generate the false DNS response packet by inputting the IP address of the warning server as a response IP address corresponding to the DNS query domain address.

In this case, the DNS blocking server includes a list of managed domain addresses including at least one managed domain address, extracts the DNS query domain address from the DNS query packet, It can be determined whether the address is the management domain address according to whether the address is included in the domain address list.

According to another aspect of the present invention, there is provided a network security method comprising: mirroring a DNS query packet through a network device to which a client terminal is connected in a DNS blocking server; Extracting a DNS query domain address from the DNS query packet in the DNS blocking server; Determining whether the DNS query domain address is a managed domain address in the DNS blocking server; Generating a fake DNS response packet in the DNS blocking server if the DNS query domain address is a managed domain address; Transmitting the fake DNS response packet from the DNS blocking server to the client terminal; And transmitting, to the client terminal, a warning page informing that the site is blocked when receiving a request packet from the client terminal that has received the fake DNS response packet from the warning server.

do. Generating a private certificate and transmitting the private certificate to the client terminal when the warning server receives the certificate request packet from the client terminal before receiving the request packet from the client terminal in the warning server.

The present invention is a method for mirroring a DNS query packet through a network device connected to a client terminal in a DNS blocking server and generating a false DNS response packet when the DNS query domain address extracted from the DNS query packet is a managed domain address When receiving the certificate request packet from the client terminal, the alert server generates a private certificate and transmits it to the client terminal. Upon receiving the request packet from the client terminal, a warning page informing the client terminal of the blocked site is transmitted to the client terminal The present invention is directed to a network security system that can perform network communication even if the DNS blocking server fails and can prevent the network traffic from being blocked even if the managed domain uses SSL (Secure Sockets Layer) To warn of There.

1 is a block diagram illustrating a network security system according to an embodiment of the present invention.
2 is a flowchart illustrating a process of processing a DNS query packet in a DNS blocking server of a network security system according to an exemplary embodiment.
FIG. 3 is a flowchart illustrating a process for alerting a warning server of a network security system according to an exemplary embodiment of the present invention when a connection to a management target is requested.
4 is a diagram showing a flow when a client terminal requests a connection to a site to be managed which requires SSL communication according to an embodiment.
5 is a diagram illustrating an example of inputting an instruction for generating a private certificate according to an exemplary embodiment.
6 is a diagram illustrating an example of inputting information to be input when a private certificate is generated according to an embodiment.
FIG. 7 is a diagram illustrating an example of verifying information of a private certificate generated according to an embodiment.
8 shows an example of a list of DNS blocking servers according to an embodiment.

Other objects and features of the present invention will become apparent from the following description of embodiments with reference to the accompanying drawings.

Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

However, the present invention is not limited to or limited by the embodiments. Like reference symbols in the drawings denote like elements.

Hereinafter, a network security system and method for displaying a blocking site according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 8.

1 is a block diagram illustrating a network security system according to an embodiment of the present invention.

Referring to FIG. 1, when connecting to the Internet 100 from a client terminal 160 in a network environment, the client terminal 160 may be connected to a switch 170 or a router. The client terminal 160 may be connected to the switch 170 or the router to enable network connection and data transmission. At this time, at least one client of the client terminal 160 can be connected to the Internet. For example, the client may be a terminal such as a PC or a smart phone.

The DNS blocking server 140 may be connected to the network equipment to which the client terminal 160 is connected and may mirror the DNS query packet through the network equipment. The DNS blocking server 140 may store a list of managed domain addresses. For example, the DNS blocking server 140 may store the managed domain addresses www.aaa.com, www.bbb.com, and www.ccc.com.

The DNS query packet may be transmitted to the external DNS server 120 through the Internet 100 or may be transmitted to the DNS blocking server 140 through mirroring. The DNS blocking server 140 can extract the DNS query domain address included in the DNS query packet. For example, you can extract the DNS query domain address, www.abc.com, contained within the DNS query packet. At this time, it is possible to determine whether the DNS query domain address is a managed domain address. It is possible to determine whether the address is a managed domain address by comparing the list of the managed domain addresses stored in the DNS blocking server 140 with the DNS query domain address.

If the DNS query domain address is not the address of the managed domain, the www server (not shown) sends a DNS response packet for the DNS query packet transmitted to the external DNS server 120 via the Internet 100 to the client terminal 160 . The client terminal 160 can normally access the destination site using the DNS response packet to perform communication. The DNS response packet may be provided in response to a DNS query packet requesting an IP address corresponding to a domain name, and may include an IP address corresponding to a domain name.

If the DNS query domain address of the DNS query packet is a managed domain address, a fake DNS response packet may be generated and transmitted to the client terminal 160 via the switch 170. The DNS blocking server 140 may generate a false DNS response packet by inputting the IP address of the warning server 150 as a response IP address corresponding to the DNS query domain address. And transmits the generated DNS response packet to the client terminal 160 via the switch 170. [ For example, if the DNS query domain address www.abc.com is a managed domain address, the DNS blocking server 140 sets the IP address (for example, 10.10.10.10) of the warning server 150 to the DNS query domain address To generate a spoofed DNS response packet, and to transmit the generated spoofed DNS response packet to the client terminal 160.

The client terminal 160 may receive the DNS response packet and may connect to the alert server 150. When receiving the request packet from the generated client terminal 160 using the false DNS response packet, the warning server 150 transmits a warning page to the client terminal 160 indicating that the site is blocked.

Meanwhile, when the site to be accessed is a site requiring SSL (Secure Sockets Layer) communication, the client terminal 160 transmits a request packet requesting connection of the site to the alert server 150 To the alert server 150, a certificate request packet requesting a certificate for SSL communication.

The alert server 150 may generate a private certificate and transmit it to the client terminal 16 upon receiving the certificate request packet from the client terminal 160 before receiving the request packet from the client terminal 160. [ That is, the warning server 150 can support SSL communication.

At this time, the private certificate may be a certificate corresponding to the site to which the client terminal 160 intends to access. The warning server 150 can generate a private certificate by using the DNS query domain address that the client terminal 160 desires to access as an argument.

Alert server 150 can generate a private certificate using OpenSSL using a DNS query domain address as an argument. The process of generating a private certificate using OpenSSL will be described with reference to FIG. 5 through FIG.

5 is a diagram illustrating an example of inputting an instruction for generating a private certificate according to an exemplary embodiment.

Referring to FIG. 5, "openssl req -x509 -nodes -days 365 -newkey rsa: 2048 -keyout privateKey.key -out cerficate.crt -reqexts v3_req -extensions v3_ca" is a command for creating a private certificate. If you enter the above command, you will enter the issuer in the next step.

Here, "openssl" means the openssl command, "-days 365" means the expiration period, "Rsa: 2048" means the encryption method, "-keyout ~~~ .key" , And "-out certificate.crt" means certificate generation.

6 is a diagram illustrating an example of inputting information to be input when a private certificate is generated according to an embodiment.

Referring to FIG. 6, the screen of FIG. 6 is displayed after inputting the command of "openssl req -x509 -nodes -days 365 -newkey rsa: 2048 -keyout privateKey.key -out cerficate.crt -reqexts v3_req -extensions v3_ca" Issuer email, domain name corresponding to issuer information. Issuing department. company. Area, and the like, and a private certificate can be generated through this process.

FIG. 7 is a diagram illustrating an example of verifying information of a private certificate generated according to an embodiment.

Referring to FIG. 7, it can be confirmed that the private certificate includes information such as version, serial number, signature algorithm, signature hash algorithm, issuer, validity period (start), validity period (end), and the like.

Returning to the description of FIG. 1, upon receiving the private certificate, the client terminal 160 checks whether the private certificate is trusted and authenticates. If the authentication is successful, the client terminal 160 transmits an authentication request packet, (150).

Meanwhile, in order for the private certificate generated by the warning server 150 to be authenticated, the client terminal 160 sets information on the warning server 150 in advance as a trusted root certification authority. Alternatively, the client terminal 160 may manage the private certificate generated by the warning server 150 by including the private certificate in the root certificate.

In the past, when the network security system failed, normal network connection was often disabled. The network security system according to an embodiment does not cause a service stop problem because the network communication is continuously performed even if the DNS blocking server fails. For example, even if the DNS blocking server is malfunctioning, the DNS response packet is transmitted from the normal DNS server to the client terminal, so that the client terminal can make a normal network connection using the DNS response packet.

2 is a flowchart illustrating a process of processing a DNS query packet in a DNS blocking server of a network security system according to an exemplary embodiment.

Referring to FIG. 2, the DNS blocking server 140 mirrors a DNS query packet through a network device to which the client terminal 160 is connected (210).

Then, the DNS blocking server 140 extracts the DNS query domain address from the DNS query packet (220).

The DNS blocking server 140 determines whether the DNS query domain address is a managed domain address (230).

If it is determined in step 230 that the DNS query domain address is the address of the managed domain, the DNS blocking server 140 generates a bogus DNS response packet (240). At this time, the DNS blocking server 140 generates a bogus DNS response packet by inputting the IP address of the warning server 150 as a response IP address corresponding to the DNS query domain address.

Then, the DNS blocking server 140 transmits the generated bogus DNS response packet to the client terminal 160 (250).

FIG. 3 is a flowchart illustrating a process for alerting a warning server of a network security system according to an exemplary embodiment of the present invention when a connection to a management target is requested.

Referring to FIG. 3, the alert server 150 determines whether a certificate request packet is received from the client terminal 160 (310).

Upon receipt of the certificate request packet in step 310, the alert server 150 generates a private certificate and transmits the generated private certificate to the client terminal 160 (320). At this time, the private certificate is generated by using, as a factor, a DNS query domain address to which the client terminal 160 wants to connect with a certificate corresponding to a site to which the client terminal 160 is to access.

Then, the warning server 150 confirms whether the request packet requesting connection to the site is received from the client terminal 160 that received the bogus DNS response packet (330).

Upon receipt of the request packet in step 330, the warning server 150 transmits a warning page to the client terminal 160 to inform that the site is blocked (340).

4 is a diagram showing a flow when a client terminal requests a connection to a site to be managed which requires SSL communication according to an embodiment.

Referring to FIG. 4, the DNS blocking server 140 mirrors a DNS query packet through a network device to which the client terminal 160 is connected (410).

If the DNS blocking server 140 extracts a DNS query domain address from the DNS query packet and confirms that the address is a management subject domain address, it is a managed domain address (412) and generates a false DNS response packet to the client terminal 160 (414). At this time, the IP address of the alert server 150 is described in the response IP address of the fake DNS response packet.

If the site to which the client terminal 160 is to access is a site requesting SSL communication, upon receipt of the fake DNS response packet, the alert server 150 transmits a certificate request packet to the alert server 150 (416).

When the alert server 150 receives the certificate request packet from the client terminal 160, the private certificate is generated (418). At this time, the private certificate is generated by using, as a factor, a DNS query domain address to which the client terminal 160 wants to connect with a certificate corresponding to a site to which the client terminal 160 is to access.

Then, the private certificate generated by the warning server 150 is transmitted to the client terminal 160 (420).

Upon receipt of the private certificate from the warning server 150 at the client terminal 160, it is authenticated whether the private certificate is legitimate. If the authentication is successful at step 422, the warning server 150 transmits a request packet requesting access to the site (424).

When the warning server 150 receives the request packet from the client terminal 160, the warning server 150 transmits a warning page to the client terminal 160 (426).

8 shows an example of a list of DNS blocking servers according to an embodiment.

Referring to FIG. 8, FIG. 8 shows a management domain address list (800). The managed domain address may be stored in the database of the DNS blocking server, and an external database storing the managed domain address may be used. The managed domain address list may include a domain address field 810, an information field, and other fields may be generated and stored. At this time, the list of the managed domain addresses can be stored in a list in the database, and the managed domain addresses can be updated at regular intervals. Also, the managed domain address list can modify, add, and delete domain addresses.

The managed domain list can store the managed domain address. For example, the list of managed domains may contain the addresses of the managed domains, www.plustech.com, www.abc.com, and www.zzz.com. It may also include the address of at least one webmail site.

In the network security system according to an exemplary embodiment of the present invention, a method of displaying a blocking site may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

120; DNS server
140; DNS blocking server
150; Warning server
160; Client terminal
170; switch

Claims (10)

A client terminal connected to the network device and mirroring a DNS query packet through the network device; and if the DNS query domain address of the DNS query packet is a managed domain address, a spurious DNS response packet is generated and transmitted to the client terminal DNS blocking server; And
When receiving a request packet from the client terminal that has received the bogus DNS response packet, transmits an alert page to the client terminal,
Lt; / RTI >
The DNS blocking server,
Generating a spurious DNS response packet by inputting the IP address of the alert server as a response IP address corresponding to the DNS query domain address,
The warning server,
Upon receiving the certificate request packet from the client terminal before receiving the request packet, a private certificate is generated and transmitted to the client terminal
Network security system.
delete The method according to claim 1,
The private certificate includes:
Wherein the certificate is a certificate corresponding to a site to which the client terminal intends to connect
Network security system.
The method according to claim 1,
The warning server,
And generates the private certificate by using the DNS query domain address to which the client terminal wants to connect as a factor
Network security system.
The method according to claim 1,
The client terminal,
Upon receipt of the private certificate, it is checked whether the private certificate is trustworthy and authenticated
Network security system.
The method according to claim 1,
The client terminal,
And the information about the warning server is set as a trusted root certification authority
Network security system.
delete The method according to claim 1,
The DNS blocking server,
A list of managed domain addresses containing at least one managed domain address
Lt; / RTI >
Extracts the DNS query domain address from the DNS query packet and determines whether the DNS query domain address is the managed domain address according to whether the DNS query domain address is included in the managed domain address list
Network security system.
Mirroring a DNS query packet through a network device to which a client terminal is connected in a DNS blocking server;
Extracting a DNS query domain address from the DNS query packet in the DNS blocking server;
Determining whether the DNS query domain address is a managed domain address in the DNS blocking server;
Generating a fake DNS response packet in the DNS blocking server if the DNS query domain address is a managed domain address;
Transmitting the generated dummy DNS response packet from the DNS blocking server to the client terminal; And
When receiving a request packet from the client terminal which has received the fake DNS response packet from the warning server, transmitting a warning page to the client terminal,
Lt; / RTI >
Wherein the generating the spoofed DNS response packet comprises:
Generating a spurious DNS response packet by inputting the IP address of the alert server as a response IP address corresponding to the DNS query domain address,
Before receiving the request packet from the client terminal in the warning server,
Receiving a certificate request packet from the client terminal in the alert server, and generating a private certificate and transmitting the private certificate to the client terminal
Network security method. delete

Images