KR101848428B1 - Routing method for security improvement based on wire communication and entry router system having security function based on wire communication - Google Patents

Abstract

The present invention relates to a routing method for enhancing a security function based on wired communications and an entry router system having a security function based on wired communications wherein a security function is provided to a router of a packet network, a harmful data packet is detected before the harmful data packet enters a sub-network and causes a wide range of damage, harmfulness is removed by a server for managing harmfulness, and the data packet is automatically routed to a destination to provide convenience for maintaining and managing a packet network. Since the security function is provided to the router of the packet network, before the harmful data packet enters the sub-network and causes damage over a wide range, the data packet is also detected, harmfulness is removed by the interrupt server for managing harmfulness, and the data packet is automatically routed to the destination. Consequently, convenience for maintaining and managing the packet network can be provided. When link routes for transmission of the packet data to the interrupt server and destination server are determined, distribution of load and speed of transfer are considered. Therefore, harmful data can be processed in a rapid manner by efficiently using a link.

Description

TECHNICAL FIELD [0001] The present invention relates to a routing method for enhancing security functions based on wired communication and an entry router system having security functions based on wired communication. [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a routing method for enhancing security functions based on wired communication and an entry router system having a wired communication based security function. More specifically, It is necessary to detect the above harmful data packet before widespread harm to the sub-network, and to prevent the harmfulness from being deteriorated in the server for the malicious traffic and to automatically route the packet to the destination, A routing method for improving the security function of a communication base, and an entry router system having a wired communication-based security function.

In general, publicly accessible packet data communication networks are susceptible to break-in by intruding elements such as hackers. By targeting several critical nodes with destructive viruses or worms, it is possible to break down the entire network that is in the local area network or the remote area. Prior art routers have done little more than read header information and send each data packet to the destination indicated in the associated header. This does not provide protection for destination devices, including wired terminals and other routers that can be harmed by user data carrying data packets.

Accordingly, there is a need in the art for a method and apparatus for providing node security to routers in a packet network. Technological developments are needed to detect and remove these harmful data packets before potentially harmful data packets arrive at the network and reach the destination and cause extensive harm.

1. Korean Registered Patent No. 10-0693034 entitled " Network Alarm Management System for Managing Events of Network Element Devices and Network Alarm Management Method Using the Same "(Registered on Mar. 4, 2007). 2. Korean Patent Publication No. 10-2003-0003596 "Network security device and network security method capable of applying a specific security policy during restriction" (published on Jan. 10, 2003).

SUMMARY OF THE INVENTION The present invention has been conceived to solve the problems described above, and it is an object of the present invention to provide a security function in a router of a packet network to detect a data packet before a harmful data packet enters a sub- A routing method for improving the security function based on a wired communication and a wired communication based security function for providing convenience to the maintenance of the packet network by allowing the interrupt server to automatically route the packet to the destination by eliminating harmfulness And to provide an entry router system.

In addition, by considering the load distribution and the transmission speed when determining the link route for the packet data transmission to the interrupt server and the destination server, the routing for improving the security function based on the wired communication for the rapid processing of harmful data, And an entry router system having security functions based on wired communication.

According to a first aspect of the present invention, there is provided a routing method for improving security functions on a wired communication system, the method comprising the steps of: monitoring a data packet addressed to a destination server, Step S511; (S512) if the data packet addressed to the destination server by the entry router is determined to be harmful to the destination server, the entry router generating the malicious determination information; (S513) interrupting transmission of a data packet addressed to the destination server by the entry router; After the entry router performs a first link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the destination server on the basis of the bandwidth on the basis of the bandwidth, the destination router connected to the IP network via the first link route Computing (S514) a first transmission speed for packet data transmission to the server; After the entry router performs a second link route extraction in which it is determined that the transfer speed is the fastest among the plurality of link routes directed to the interrupt server on the subnetwork based on the bandwidth, (S515) a second transmission speed for packet data transmission to the base station; (S516) determining whether the entry router is faster than the second transmission speed calculated in the step S515 if the first transmission speed calculated in the step S514 is faster than the second transmission speed calculated in the step S515; If it is determined in step S516 that the first transmission speed is not equal to or faster than the second transmission speed, the entry router cancels the data packet addressed to the destination server after releasing the interrupt according to step S513, (S517) to the interrupt server through the subnetwork and the IP network; (S518) of causing the interrupt server to recreate a data packet from which harmful information has been removed using the analysis of the data packet received in step S517 and the harmful determination information; (S519) of the interrupt server transmitting the regenerated data packet to the destination server through the IP network in step S518; If it is determined in step S516 that the first transmission speed is faster than the second transmission speed, the entry router 20 releases the interrupt according to step S513, And transmitting the data packet addressed to the destination server to the destination server 50 through the IP network (S520); (S521) the destination server routes the received data packet to the interrupt server via the IP network 40 together with the harmful determination information without demodulating the data packet received in step S520, and delivers the data packet to the interrupt server; (S522) of causing the interrupt server to regenerate a data packet from which the harmfulness is removed using the analysis of the data packet received in step S521 and the harmful determination information; And transmitting the regenerated data packet to the destination server through the IP network in operation S523.

According to a second aspect of the present invention, there is provided an entry router system having a wired communication-based security function, including: a wired terminal; an entry router having a wired communication-based security function; A router system for improving security function of a wired communication base including an intermediate router group and an ending router group, an IP network, a destination server and an interrupt server, the router system comprising: An I / O port that is an input / output port for performing transmission / reception; A transmitting and receiving unit transmitting and receiving to and from the wired terminal and the subnetwork; A system memory unit; A storage unit for storing a routing table; And a control unit connected to and controlling the I / O port, the transmission / reception unit, the system memory unit, and the storage unit, wherein the system memory unit of the entry router is connected to the I / When a data packet addressed to the destination server is determined to be harmful to the destination server according to monitoring of a data packet transmitted to the destination server and addressed to the destination server, A node security module that interrupts the node; After performing a first link route extraction that determines that the transmission speed is the fastest among the plurality of link routes directed to the destination server on the basis of bandwidth on the subnetwork formed of the intermediate router group and the ending router group, A second transmission speed for transmitting packet data to the destination server connected to the IP network; and a second transmission speed determining unit for determining a transmission speed of the second transmission route based on bandwidth among the plurality of link routes to the interrupt server on the sub- A link root module for calculating a second transmission speed for packet data transmission to an interrupt server connected to the IP network through the second link root after performing link root extraction; And after the entry router releases the interruption of transmission of the data packet addressed to the destination server if the first transmission speed is not faster than or equal to the second transmission speed, Control unit controls the transceiver to transmit the hazard judgment information generated by the security module to the interrupt server via the subnetwork and the IP network, and if the first transmission speed is faster than the second transmission speed, And transmits the addressed data packet to the destination server after releasing the interruption of the transmission of the data packet addressed to the server and transmitting the harmful determination information to the destination server via the subnetwork and the IP network, And a security enforcement module The interrupt server regenerates a data packet from which the harmfulness of the data packet is removed by using the hazard judgment information generated by the node security module transmitted from the entry router and transmits the regenerated data packet to the destination server through the IP network, The destination server transmits the received data packet to the interrupt server via the IP network together with the harmful determination information without demodulating the data packet using the hazard determination information generated in the node security module transmitted from the entry router And the interrupt server regenerates the data packet from which the harmfulness of the data packet has been removed by using the hazard judgment information received from the destination server and transmits the regenerated data packet to the destination server through the IP network.

An entry router system having a wired communication-based security function enhancement function and a wired communication-based security function according to the present invention has a security function in a router of a packet network so that harmful data packets enter the subnetwork, There is an advantage in that it is possible to provide convenience for the maintenance of the packet network by detecting the data packet and then automatically routing it to the destination by removing the harmfulness at the interrupt server for the hazard management.

In addition, the load distribution and the transmission speed are taken into consideration in determining the link route for transmission of packet data to the interrupt server and the destination server, which makes it possible to utilize the link efficiently to enable quick processing of harmful data.

Brief Description of the Drawings Fig. 1 is a whole system diagram illustrating a routing method for enhancing security functions based on wired communication according to the present invention. Fig.
FIG. 2 is a block diagram of an entry router in FIG. 1. FIG.
3 is a configuration diagram of the link root module in Fig.
Fig. 4 is an illustration of a link route extraction and delivery speed measurement performed by the link root module in Fig. 3; Fig.
FIG. 5 is a flowchart illustrating a routing method for enhancing security functions based on wired communication according to the present invention.
FIG. 6 is a flowchart illustrating a process of acquiring a transmission speed in FIG. 5; FIG.

Hereinafter, an entry router having a wired communication-based security function routing function and a wired communication-based security function routing function according to the present invention will be described in detail with reference to the drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and they may vary depending on the intentions or customs of the client, the operator, the user, and the like. Therefore, the definition should be based on the contents throughout this specification.

Like numbers refer to like elements throughout the drawings.

2 is a block diagram of an entry router in FIG. 1, FIG. 3 is a block diagram of a link router in FIG. 2, and FIG. FIG. 4 is a diagram illustrating a link route extraction and transmission speed measurement performed by the link route module in FIG. 3, and FIG. 5 is a diagram illustrating a security function enhancement based on a wired communication according to the present invention. FIG. 6 is a flowchart illustrating a process of acquiring a transmission speed in FIG. 5. Referring to FIG.

 1, a whole system in which a routing method for improving security functions based on a wired communication is implemented includes a wired terminal 10 An entry router 20 having a wired communication based security function, a sub network 30, an IP network 40, a destination server 50, And an interrupt server 60. The sub-network 30 includes an intermediate router group 31 and an ending router group 32.

Here, the intermediate router group 31 includes a plurality of intermediate routers including a first intermediate router 31-1 and a second intermediate router 31-2, and the ending router group 32 also includes a first ending And a plurality of ending routers including a router 32-1 and a second ending router 32-2.

The intermediate routers and the ending routers constituting the sub-network 30 only perform a routing function for the packet data when it is determined by the entry router 20 that the packet data is harmful, Reading, conversion, analysis, and the like.

Fig. 2 is a diagram showing the configuration of the entry router 20 in Fig. 2, the entry router 20 includes an I / O port 21, a transmitting / receiving unit 22, a control unit 23, a storage unit 25, and a system memory unit 24 A node security module 24a, a link root module 24b, and a security performing module 24c.

3 is a diagram showing a configuration of the link root module 24b in Fig. 3, the link route module 24b includes a bandwidth extracting unit 24b-1, a link route generating / determining unit 24b-2, and a transmission speed calculating unit 24b-3. The I / O port 21 is an input / output port for transmitting / receiving data between the wired terminal 10 and the entry router 20.

4 is a diagram for explaining the link route extraction and transmission speed measurement performed by the link route module 24b in Fig.

When the power of the entry router 20 is turned on, the node security module 24a, the link root module 24b, and the link security module 24b loaded in the system memory unit 24 by the control unit 23, And the security module 24c, the security function based on the wired communication performed by the entry router 20 will be described in detail.

The node security module 24a monitors the data packet transmitted from the wired terminal 10 and addressed to the destination server 50. [

The node security module 24a generates hazard information when a data packet is determined to be harmful to the destination server 50 and then interrupts transmission of a data packet to the destination server 50, And notifies the link root module 24b.

Accordingly, the link root module 24b performs the first link route extraction, which is determined to be fastest in terms of bandwidth among the plurality of link routes directed to the destination server 50 on the sub network 30, And calculates a first transmission speed for packet data transmission to the destination server 50 connected to the IP network 40 via the first link route. In addition, the link root module 24b performs a second link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the interrupt server 60 on the sub-network 30 based on the bandwidth, And calculates a second transmission speed for packet data transmission to the interrupt server 60 connected to the IP network 40 via the second link root.

Hereinafter, the functions of the bandwidth extracting means 24b-1, the link route creating / deciding means 24b-2, and the transmission speed calculating means 24b-3 constituting the link root module 24b will be described. 1 transmission speed and the second transmission speed. do.

The bandwidth extracting means 24b-1 extracts the first intermediate router 31-1 and the second intermediate router 31-2 having the largest bandwidth for sending data packets among the intermediate routers constituting the intermediate router group 31 Based on the routing table stored in the storage unit 25.

The bandwidth extracting means 24b-1 extracts the bandwidth for receiving the data packet from the first intermediate router 31-1 and the second intermediate router 31-2 among the ending routers constituting the ending router group 32 The first and second ending routers 32-1 and 32-2 are extracted based on the routing table stored in the storage unit 25. [

The bandwidth extracting means 24b-1 sends the link L11 to the first intermediate router 31-1 for sending the data packet addressed to the destination server 50 and the link L11 to the second intermediate router 31-1 And extracts and stores the bandwidth for the link L12 on the basis of the routing table stored in the storage unit 25. [

The bandwidth extracting means 24b-1 extracts the bandwidth L21 from the first intermediate router 31-1 to the first ending router 32-1, the link from the first intermediate router 31-1 to the second ending router 32-1, A link L22 from the second intermediate router 31-2 to the first ending router 32-1 and a link L23 from the second intermediate router 31-2 to the second end router 32-2, The bandwidth for the link L24 to the ending router 32-2 is extracted and stored based on the routing table stored in the storage unit 25. [

The bandwidth extracting means 24b-1 extracts the bandwidth L31 from the first ending router 32-1 through the IP network 40 to the destination server 50, A link L32 to the interrupt server 60 via the network 40, a link L33 to the destination server 50 via the IP network 40 at the second ending router 32-2, The bandwidth for the link L34 from the router 32-2 to the interrupt server 60 via the IP network 40 is extracted and stored based on the routing table stored in the storage unit 25. [

The link route creation / determination means 24b-2 extracts all the link routes D1, D2, and D3 to which the data packet is directed to the destination server 50 and extracts the link routes D1, D2, After extracting the minimum bandwidth of each link, the link route having the maximum minimum bandwidth is selected as the first link route. 4, the link route D1 is formed of a link L11, a link L21, and a link L31, and the link route D2 includes a link L12, a link L23, L31, and the link route D3 is formed of a link L12, a link L24, and a link L33. For example, if the bandwidth of the link L11 in the link route D1 is 1G, the bandwidth of the link L21 is 2G, the bandwidth of the link L31 is 3.1G, the bandwidth of the link L12 in the link route D2, The bandwidth of the link L23 is 2G, the bandwidth of the link L23 is 3G, the bandwidth of the link L31 is 3.1G, the bandwidth of the link L12 is 2G, the bandwidth of the link L24 is 1.5G, (L33) is formed to have a bandwidth of 3.5G. In this case, the entry router 20 determines that 2G corresponding to the bandwidth of the link L12, which is the minimum bandwidth among the links L12, L23, and L31 constituting the link route D2, The link route D2 is selected as the first link route since the minimum bandwidth (D1 in the case of D3 is 1G and in the case of D3, L24 is 1.5G). Accordingly, since the minimum bandwidth of the link route D2 is larger than the minimum bandwidth of the other link routes, the load of the network load is reduced more than that of the data packet delivery, thereby ensuring a fast transmission speed .

The link route creation / determination means 24b-2 extracts all the link routes D4, D5, and D6 to which the data packet is directed to the interrupt server 60 and extracts the link routes D4, D5, After extracting the minimum bandwidth of each link, the link route having the maximum minimum bandwidth is selected as the second link route. 4, the link route D4 is formed by a link L12, a link L24 and a link L34, and a link route D5 is formed by a link L11, a link L22, L34, and the link route D6 is formed of a link L11, a link L21, and a link L32.

The transmission speed calculation means 24b-3 calculates the sum of distances formed by the respective links included in the first link route based on the measurement signal transmission to the destination server 50 and the RTT (Round Trip Time) To calculate a first transmission speed. The transmission speed calculation means 24b-3 calculates the sum of the distances formed by the respective links included in the second link route to the interrupting server 60 based on the measurement signal transmission to the interrupt server 60 and the RTT method And divides by time to calculate the second transmission speed.

Meanwhile, the security executing module 24c determines whether the first transmission speed calculated by the transmission speed calculation unit 24b-3 is faster than the second transmission speed.

If the first transmission speed is not equal to or faster than the second transmission speed as a result of the determination by the transmission speed calculation unit 24b-3, the security performance module 24c transmits an interrupt performed by the node security module 24a The data packet addressed to the destination server 50 and the hazard judgment information generated by the node security module 24a are sent to the interrupt server 60 via the sub network 30 and the IP network 40 And controls the transmission / reception unit 22 to transmit. Accordingly, the interrupt server 60 regenerates the data packet from which the harmfulness is removed using the analysis of the data packet addressed to the destination server 50 and the harmful determination information, and then transmits the regenerated data packet to the IP network 40 To the destination server (50).

If the first transmission speed is faster than the second transmission speed as a result of the determination by the transmission speed calculation unit 24b-3, the security performance module 24c determines that the interruption performed by the node security module 24a And transmits the addressed data packet and the hazard judgment information generated by the node security module 24a to the destination server 50 through the sub network 30 and the IP network 40 22). In this case, the security executing module 24c causes the entry router 20 to transmit the harmful determination information to the destination server 50 before the data packet, so that the destination server 50 determines that the packet is a harmful data packet without demodulation do. Thereafter, the destination server 50 routes and delivers the received data packet to the interrupt server 60 via the IP network 40, together with the harmful determination information, without demodulation of the received data packet, The interrupt server 60 returns the regenerated data packet from the interrupt server 60 in accordance with the analysis of the received data packet and the regeneration of the data packet by removing harmfulness using the harmful judgment information.

5 is a flowchart illustrating a routing method for enhancing security functions based on wired communication according to the present invention. Referring to FIGS. 1 to 5, the entry router 20 monitors the data packet transmitted from the wired terminal 10 and addressed to the destination server 50 (S511).

Thereafter, if the data packet addressed to the destination server 50 by the entry router 20 is determined to be harmful to the destination server 50, the entry router 20 generates harmful determination information (S512) .

Thereafter, the entry router 20 interrupts the transmission of the data packet addressed to the destination server 50 (S513).

Then, the entry router 20 performs a first link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the destination server 50 on the basis of the bandwidth on the sub-network 30, (S514) a first transmission speed for packet data transmission to the destination server 50 connected to the IP network 40 via one link route.

Thereafter, the entry router 20 performs a second link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the interrupt server 60 on the basis of bandwidth on the sub-network 30, (S515) a second transmission speed for packet data transmission to the interrupt server 60 connected to the IP network 40 via the second link route.

Thereafter, the entry router 20 determines whether the first transmission speed calculated in S514 is faster than the second transmission speed calculated in S515 (S516).

If it is determined that the first transmission speed is not equal to or faster than the second transmission speed, the entry router 20 releases the interrupt according to S513 and then transmits the address to the destination server 50 The data packet and the hazard determination information generated in S512 are transmitted to the interrupt server 60 through the sub network 30 and the IP network 40 in S517.

Thereafter, the interrupt server 60 regenerates the data packet from which the harmfulness is removed using the analysis of the data packet received in step S517 and the harmful determination information (step S518).

Thereafter, the interrupt server 60 transmits the regenerated data packet to the destination server 50 through the IP network 40 (S519).

On the other hand, if it is determined in step S516 that the first transmission speed is faster than the second transmission speed, the entry router 20 releases the interrupt according to step S513, And transmits the harmful determination information to the destination server 50 through the sub network 30 and the IP network 40 (S520). In this case, the entry router 20 sends the harmful determination information to the destination server 50 before the data packet, so that the destination server 50 judges it as a harmful data packet.

Thereafter, the destination server 50 routes the received data packet to the interrupt server 60 via the IP network 40 together with the harmful determination information without demodulating the data packet received in step S520, and delivers the packet to the interrupt server 60 (S521).

Thereafter, the interrupt server 60 regenerates the data packet from which the harmfulness is removed using the analysis of the data packet received in step S521 and the harmful determination information (S522).

Thereafter, the interrupt server 60 transmits the regenerated data packet to the destination server through the IP network 40 (S523).

6 is a flowchart specifically showing a transmission speed acquisition process (S514 and S515) in Fig. Referring to FIGS. 1 to 6, the entry router 20 includes a first intermediate router 31-1 having the largest bandwidth for sending data packets among the intermediate routers constituting the intermediate router group 31, The intermediate router 31-2 is extracted based on the routing table stored in the storage unit 25 (S610).

Then, the entry router 20 receives a data packet from the first intermediate router 31-1 and the second intermediate router 31-2 extracted according to the S610 of the ending routers constituting the ending router group 32 In step S620, the first ending router 32-1 and the second ending router 32-2 having the largest bandwidths for extracting the first and second ending routers 32-1 and 32-2 are extracted based on the routing table stored in the storage unit 25.

The entry router 20 then goes to the link L11 to the first intermediate router 31-1 for sending the data packet addressed to the destination server 50 and to the second intermediate router 31-2 The bandwidth for the link L12 is extracted and stored based on the routing table stored in the storage unit 25 (S630).

Thereafter, the entry router 20 transmits the link L21 from the first intermediate router 31-1 to the first ending router 32-1, the link L21 from the first intermediate router 31-1 to the second ending router 32-1 A link L23 from the second intermediate router 31-2 to the first ending router 32-1, a link L23 from the second intermediate router 31-2 to the second ending router 32-1, The bandwidth for the link L24 to the router 32-2 is extracted and stored based on the routing table stored in the storage unit 25 (S640).

Thereafter, the entry router 20 transmits a link L31 from the first ending router 32-1 to the destination server 50 via the IP network 40, a link L31 from the first ending router 32-1 to an IP A link L32 to the interrupt server 60 via the network 40, a link L33 to the destination server 50 via the IP network 40 at the second ending router 32-2, The bandwidth for the link L34 from the router 32-2 to the interrupt server 60 via the IP network 40 is extracted and stored based on the routing table stored in the storage unit 25 at operation S650.

The entry router 20 extracts all the link routes D1, D2 and D3 to which the data packet is directed to the destination server 50 and extracts the minimum link lengths D1, D2 and D3 After extracting the bandwidth, the link route having the maximum minimum bandwidth is selected as the first link route (S660). 4, the link route D1 is formed of a link L11, a link L21, and a link L31, and the link route D2 includes a link L12, a link L23, L31, and the link route D3 is formed of a link L12, a link L24, and a link L33. For example, if the bandwidth of the link L11 in the link route D1 is 1G, the bandwidth of the link L21 is 2G, the bandwidth of the link L31 is 3.1G, the bandwidth of the link L12 in the link route D2, The bandwidth of the link L23 is 2G, the bandwidth of the link L23 is 3G, the bandwidth of the link L31 is 3.1G, the bandwidth of the link L12 is 2G, the bandwidth of the link L24 is 1.5G, (L33) is formed to have a bandwidth of 3.5G. In this case, the entry router 20 determines that 2G corresponding to the bandwidth of the link L12, which is the minimum bandwidth among the links L12, L23, and L31 constituting the link route D2, The link route D2 is selected as the first link route since the minimum bandwidth (D1 in the case of D3 is 1G and in the case of D3, L24 is 1.5G). Accordingly, since the minimum bandwidth of the link route D2 is larger than the minimum bandwidth of the other link routes, the load of the network load is reduced more than that of the data packet delivery, thereby ensuring a fast transmission speed .

Thereafter, the entry router 20 transmits the sum of the distances made by the links included in the first link route to the destination server 50 in a round trip time (RTT) Divide by the measured time, and calculate the first transmission speed (S670).

The entry router 20 then extracts all the link routes D4, D5 and D6 to which the data packets are directed to the interrupt server 60 and extracts the minimum link lengths D4, D5 and D6 After extracting the bandwidth, the link route having the maximum minimum bandwidth is selected as the second link route (S680). 4, the link route D4 is formed by a link L2, a link L24, and a link L34, and the link route D5 is formed by a link L11, a link L22, L34, and the link route D6 is formed of a link L11, a link L21, and a link L32.

Thereafter, the entry router 20 transmits the sum of the distances made by the respective links included in the second link route, to the interrupt server 60 at a time measured by the RTT method according to the measurement signal transmission to the interrupt server 60, , And calculates the second transmission speed (S690).

As described above, the entry router having the wired communication-based security function enhancement function and the wired communication-based security function according to the present invention has a security function in the router of the packet network, It is possible to provide convenience for the maintenance of the packet network by detecting the data packet and automatically routing it to the destination by eliminating the harmfulness at the interrupt server for harmful management before entering the widespread solution. In addition, by considering the load distribution and the transmission speed when determining the link route for transmission of packet data to the interrupt server and the destination server, it is possible to efficiently process harmful data using the link efficiently.

As described above, preferred embodiments of the present invention have been disclosed in the present specification and drawings, and although specific terms have been used, they have been used only in a general sense to easily describe the technical contents of the present invention and to facilitate understanding of the invention , And are not intended to limit the scope of the present invention. It is to be understood by those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

10: wired terminal 20: entry router
21: I / O port 22: Transmitting /
23: control unit 24: system memory unit
24a: node security module 24b: link root module
24b-1: bandwidth extracting means 24b-2: link route creating / determining means
24b-3: transmission speed calculation means 24c: security execution module
25: storage unit 30: subnetwork
31: intermediate router group 31-1: first intermediate router
31-2: second intermediate router 32: ending router group
32-1: first ending router 32-2: second ending router
40: IP network 50: destination server
60: Interrupt server

Claims (5)

(S511) monitoring the data packet sent from the wired terminal 10 to the entry router 20 and addressed to the destination server 50;
A step S512 of generating the hazard judgment information by the entry router 20 if a data packet addressed to the destination server 50 by the entry router 20 is determined to be harmful to the destination server 50 ;
(S513) interrupting transmission of a data packet addressed to the destination server (50) by the entry router (20);
After the entry router 20 performs a first link route extraction that is determined to be fastest in terms of bandwidth among a plurality of link routes directed to the destination server 50 on the sub network 30, Computing (S514) a first transmission speed for packet data transmission to a destination server (50) connected to the IP network (40) via a route;
After the entry router 20 performs the second link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the interrupt server 60 on the sub-network 30 based on the bandwidth, Calculating (S515) a second transmission speed for packet data transmission to the interrupt server (60) connected to the IP network (40) via the second transmission speed;
(S516) whether the entry router 20 determines whether the first transmission speed calculated in step S514 is faster than the second transmission speed calculated in step S515;
If it is determined in step S516 that the first transmission speed is not equal to or faster than the second transmission speed, the entry router 20 releases the interrupt according to step S513 and then transmits the data addressed to the destination server 50 (S517) of transmitting the packet and the harmful determination information generated in step S512 to the interrupt server 60 through the subnetwork 30 and the IP network 40;
A step (S518) of the interrupt server (60) regenerating a data packet from which the harmfulness is removed using the analysis of the data packet received in the step S517 and the harmful determination information;
(S519) of the interrupt server 60 transmitting the regenerated data packet to the destination server 50 through the IP network 40;
If it is determined in step S516 that the first transmission speed is faster than the second transmission speed, the entry router 20 releases the interrupt according to step S513, (S520) transmitting the data packet addressed to the destination server 50 after transmitting the packet to the destination server 50 through the IP network 30 and the IP network 40;
The destination server 50 routes the received data packet to the interrupt server 60 via the IP network 40 together with the harmful determination information without demodulation of the data packet received in step S520, (S521);
(S522) of causing the interrupt server (60) to regenerate a data packet from which harmful information has been removed using the analysis of the data packet received in step S521 and the harmful determination information; And
(S523) the interrupting server (60) transmitting the regenerated data packet to the destination server (50) through the IP network (40). Lt; / RTI >
The method according to claim 1,
In step S514,
The entry router 20 transmits the first intermediate router 31-1 and the second intermediate router 31-2 having the largest bandwidth for sending the data packet among the intermediate routers constituting the intermediate router group 31 to the storage unit (S610) based on a routing table stored in the routing table (25);
The entry router 20 selects one of the ending routers constituting the ending router group 32 from the first intermediate router 31-1 and the second intermediate router 31-2, A step (S620) of extracting one ending router (32-1) and the second ending router (32-2) based on a routing table stored in the storage unit (25);
The entry router 20 sends a link L11 to the first intermediate router 31-1 for sending a data packet addressed to the destination server 50 and a link L11 to the second intermediate router 31-2 (S630) of extracting and storing the bandwidth for the mobile station based on the routing table stored in the storage unit 25;
The entry router 20 transmits the link L21 from the first intermediate router 31-1 to the first ending router 32-1 and the link L21 from the first intermediate router 31-1 to the second ending router 32 And the link L23 from the second intermediate router 31-2 to the first ending router 32-1 and the link L23 from the second intermediate router 31-2 to the second end router 32-1, Extracting and storing the bandwidth for the link L24 to the ending router 32-2 based on the routing table stored in the storage unit 25 (S640);
The entry router 20 transmits a link L31 from the first ending router 32-1 to the destination server 50 via the IP network 40 and a link L31 from the first ending router 32-1 to the IP network 40 to the interrupt server 60 and a link L33 from the second ending router 32-2 to the destination server 50 via the IP network 40 and a second ending The bandwidth for the link L34 from the router 32-2 to the interrupt server 60 through the IP network 40 is extracted and stored based on the routing table stored in the storage unit 25 Wow;
The entry router 20 extracts all the link routes D1, D2 and D3 to which the data packet is directed to the destination server 50 and calculates the minimum bandwidths of the respective links included in each link route D1, D2 and D3 Selecting (S660) a link route having a maximum minimum bandwidth as a first link route after extracting; And
The sum of the distances made by the respective links included in the first link route of the entry router 20 is calculated based on the time measured by a round trip time (RTT) method according to the measurement signal transmission to the destination server 50 and the return signal return , And calculating a first transmission speed (S670) by dividing the first transmission speed (S670) and the first transmission speed (S670).
The method according to claim 1,
In step S515,
The entry router 20 transmits the first intermediate router 31-1 and the second intermediate router 31-2 having the largest bandwidth for sending the data packet among the intermediate routers constituting the intermediate router group 31 to the storage unit (S610) based on a routing table stored in the routing table (25);
The entry router 20 selects one of the ending routers constituting the ending router group 32 from the first intermediate router 31-1 and the second intermediate router 31-2, A step (S620) of extracting one ending router (32-1) and the second ending router (32-2) based on a routing table stored in the storage unit (25);
The entry router 20 sends a link L11 to the first intermediate router 31-1 for sending a data packet addressed to the destination server 50 and a link L11 to the second intermediate router 31-2 (S630) of extracting and storing the bandwidth for the mobile station based on the routing table stored in the storage unit 25;
The entry router 20 transmits the link L21 from the first intermediate router 31-1 to the first ending router 32-1 and the link L21 from the first intermediate router 31-1 to the second ending router 32 And the link L23 from the second intermediate router 31-2 to the first ending router 32-1 and the link L23 from the second intermediate router 31-2 to the second end router 32-1, Extracting and storing the bandwidth for the link L24 to the ending router 32-2 based on the routing table stored in the storage unit 25 (S640);
The entry router 20 transmits a link L31 from the first ending router 32-1 to the destination server 50 via the IP network 40 and a link L31 from the first ending router 32-1 to the IP network 40 to the interrupt server 60 and a link L33 from the second ending router 32-2 to the destination server 50 via the IP network 40 and a second ending The bandwidth for the link L34 from the router 32-2 to the interrupt server 60 through the IP network 40 is extracted and stored based on the routing table stored in the storage unit 25 Wow;
The entry router 20 extracts all the link routes D4, D5 and D6 to which the data packet is directed to the interrupt server 60 and sets the minimum bandwidths of the respective links included in each link route D4, D5 and D6 to Selecting (S680) a link route having a maximum minimum bandwidth as a second link route; And
The entry router 20 divides the sum of the distances made by the respective links included in the second link route to the time measured by the RTT method according to the transmission of the measurement signal to the interrupt server 60 and the return signal return, 2 transmission speed (S690). The method according to claim 1,
A wired terminal 10, an entry router 20 having a wired communication-based security function, a sub network 30 including an intermediate router group 31 and an ending router group 32, an IP network 40, And a destination server (50) and an interrupt server (60), the router system comprising:
The entry router 20 includes an I / O port 21 as an input / output port for performing data transmission / reception with the wired terminal 10; A transmission / reception unit 22 for transmitting / receiving the wired terminal 10 and the sub network 30; A system memory portion 24; A storage unit 25 for storing a routing table; And a control unit 23 connected to and controlling the I / O port 21, the transceiver unit 22, the system memory unit 24, and the storage unit 25,
The system memory unit 24 of the entry router 20 is connected to the I / O port 21 by monitoring the data packets transmitted from the wired terminal 10 connected to the I / O port 21 and addressed to the destination server 50 If the data packet addressed to the destination server 50 is determined to be harmful to the destination server 50, after generating the malicious determination information, the transmission of the data packet addressed to the destination server 50 is interrupted, A node security module 24a; A first link route extracting step of determining that the transmission speed is the fastest among the plurality of link routes toward the destination server 50 on the subnetwork 30 formed by the intermediate router group 31 and the ending router group 32 on the basis of the bandwidth, , And then calculates a first transmission speed for transmission of packet data to the destination server (50) connected to the IP network (40) via the first link route, After performing a second link route extraction in which it is determined that the transmission speed is the fastest among the plurality of link routes directed to the IP network 60, A link route module (24b) for calculating a second transmission speed for transmission of packet data to the mobile station (60); And after the entry router (20) releases the interruption of the transmission of the data packet addressed to the destination server (50) if the first transmission speed is not equal to or faster than the second transmission speed, the destination server (50) (22) to transmit the data packet addressed by the node security module (24a) to the interrupt server (60) via the subnetwork (30) and the IP network (40) ), And when the first transmission speed is faster than the second transmission speed, the entry router (20) releases the interruption of the transmission of the data packet addressed to the destination server (50) To the destination server 50 via the subnetwork 30 and the IP network 40 and transmits the addressed data packet to the destination server 50. The destination server 50 transmits the addressed data packet to the destination server 50, And a security performing module 24c for controlling the security module 24c,
The interrupt server 60 regenerates the data packet from which the harmfulness of the data packet has been removed by using the hazard judgment information generated by the node security module 24a transmitted from the entry router 20 and transmits the regenerated data packet to the IP network 40 to the destination server 50,
The destination server 50 transmits the data packet to the IP network (not shown) together with the harmful determination information without demodulating the data packet using the hazard determination information generated by the node security module 24a transmitted from the entry router 20 40 to the interrupt server 60. The interrupt server 60 uses the hazard information received from the destination server 50 to transmit a data packet in which the harmfulness of the data packet is removed And transmits the regenerated and regenerated data packet to the destination server (50) via the IP network (40).
The method of claim 4,
The link route module (24b)
The first intermediate router 31-1 and the second intermediate router 31-2 having the largest bandwidth for transmitting the data packet among the intermediate routers constituting the intermediate router group 31 are stored in the storage unit 25, And the bandwidth for receiving the data packet from the first intermediate router 31-1 and the second intermediate router 31-2 among the ending routers constituting the ending router group 32 is the most A bandwidth extracting means (24b-1) for extracting the first ending router (32-1) and the second ending router (32-2) based on the routing table;
Link route generation / determination means (24b-2) for extracting the first link route and the second link route based on the transmission speed according to the combination of the intermediate router group (31) and the ending router group (32); And
And transmission speed calculation means (24b-3) for calculating the first transmission speed and the second transmission speed;
The transmission speed calculation means (24b-3)
The sum of the distances formed by the links included in the first link route is divide by a time measured by a round trip time (RTT) method according to the measurement signal transmission to the destination server 50 and the return signal return, To calculate the first transmission speed;
The second transmission speed is calculated by dividing the sum of the distances made by the respective links included in the second link route by a time measured by an RTT method according to a measurement signal transmission to the interrupt server and a return signal return Wherein the entry router system has a security function based on wired communication.

Images