KR101881278B1 - Method for selective inspection of the packet communications using the Secure Sockets Layer - Google Patents

Abstract

The present invention relates to a security relay apparatus capable of selectively inspecting packets using secure socket layer communication,
When the security relay device detects a connection from a client terminal to a web site using secure socket layer communication, the secure relay device transmits a secure socket layer (SSL) between the security relay device and the web site using the certificate of the web site Layer session, establishes a secure socket layer session between the client terminal and the security relay device using a private certificate generated using the certificate of the website, and receives a packet transmitted from the client terminal to the web site Decrypts the packet using the session key of the client terminal, checks whether there is data to be checked in the decrypted packet, and if there is data to be checked in the decrypted packet, And transmits the decrypted packet to the security relay Encrypts it using the session key of the device, and transmits it to the website.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a method for selectively inspecting packets using secure socket layer communication,

The following embodiments relate to a technique for preventing data leakage, and also relates to a method for inspecting data included in a packet even in secure socket layer communication.

In organizations like businesses, a lot of information is being leaked to the outside world through the Internet,

In order to prevent data leakage, an enterprise inspects a packet transmitted from a terminal in an enterprise, confirms whether information that should not be leaked exists, and is approved and transmits an approved packet to an external server via the Internet.

However, when a Web site to which a terminal accesses uses Secure Sockets Layer (SSL) communication, the contents of the packet are encrypted and transmitted, so that it is impossible to confirm whether data is leaked or not.

In order to solve this problem, the company has maintained security by blocking communication with external sites using SSL communication.

However, blocking an external site using SSL communication may hinder the efficiency of the employees of the company, and therefore, there is a need for a method that can check packets transmitted using SSL communication instead of simply blocking.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method for selectively inspecting a packet using secure socket layer communication.

More specifically, the present invention relates to a security relay apparatus for relaying SSL communication between a client terminal and a server of a web site, wherein a security apparatus connects to a web site to which the client terminal intends to access on behalf of the client terminal, Generates a private certificate corresponding to the web site using the certificate of the web site to be accessed and provides the generated private certificate to the client terminal to decrypt and encrypt the packet transmitted and received between the client terminal and the web site server, It is intended to provide a method of inspection.

In addition, the present invention provides a method by which a packet transmitted and received between a client terminal and a web site server is decrypted and the decrypted packet is transmitted to the security device only when the packet includes data to be checked, .

According to another aspect of the present invention, there is provided a method of selectively inspecting a packet using secure socket layer communication in a security relay apparatus, the secure relay apparatus comprising: Detecting a connection to a web site using the communication; Establishing a Secure Sockets Layer (SSL) session between the security relay device and the web site using the certificate of the web site; Establishing a secure socket layer session between the client terminal and the security relay device using a private certificate generated using the certificate of the web site; Decrypting the packet using the session key of the client terminal when receiving the packet transmitted from the client terminal to the website; Checking whether there is data to be checked in the decoded packet; Transmitting the decrypted packet to the security device if there is data to be checked in the decrypted packet; And encrypting the decrypted packet using the session key of the security relay apparatus and transmitting the decrypted packet to the web site.

The step of transmitting the decrypted packet to the security device may include: checking a first final sequence number, which is a sequence number of a last packet transmitted from the client terminal, to the security device; Changing the sequence number of the decrypted packet to a number obtained by adding 1 to the first final sequence number and transmitting the decrypted packet with the changed sequence number to the security device; And updating the first final sequence number.

The method for selectively inspecting a packet using the secure socket layer communication in the security relay device may include transmitting the decrypted packet to the security device if the data to be checked does not exist in the decrypted packet, Encrypting the decrypted packet using the session key of the security device, and transmitting the decrypted packet to the web site.

At this time, establishing a secure socket layer session between the security relay apparatus and the web site includes: generating a session key of the security relay apparatus; And encrypting the session key of the security relay device using a public key included in the certificate of the web site and transmitting the encrypted session key to the server of the web site.

The step of establishing a secure socket layer session between the client terminal and the security relay device comprises: receiving a session key of a client terminal encrypted with a public key included in the private certificate from the client terminal; And acquiring the session key of the client terminal by decrypting the encrypted session key of the client terminal with the secret key corresponding to the private certificate.

A method for selectively inspecting a packet using secure socket layer communication in a security relay apparatus includes receiving a packet to be transmitted from the web site to the client terminal and transmitting the packet to the client terminal using the session key of the security relay apparatus Decoding a packet to be transmitted; Checking whether there is data to be checked in a packet to be transmitted to the decrypted client terminal; Transmitting a packet to be transmitted to the decrypted client terminal to the security device if data to be checked exists in a packet to be transmitted to the decrypted client terminal; And encrypting a packet to be transmitted to the decrypted client terminal using the session key of the client terminal and transmitting the encrypted packet to the client terminal.

The step of delivering a packet to be transmitted to the decrypted client terminal to the security device includes checking a second final sequence number which is a sequence number of a last packet transmitted to the security device from packets to be transmitted to the client terminal step; Changing a sequence number of a packet to be transmitted to the decrypted client terminal to a number obtained by adding 1 to the second final sequence number and transmitting a packet to be transmitted to the decrypted client terminal with a changed sequence number to the security device; And updating the second final sequence number.

The method of selectively inspecting a packet using the secure socket layer communication in the security relay apparatus includes the steps of: if there is no data to be checked in the packet to be transmitted to the decrypted client terminal, Encrypting the decrypted packet to be transmitted to the client terminal using the session key of the client terminal and transmitting the encrypted packet to the client terminal without transmitting the packet to the client terminal.

At this time, the step of connecting secure socket layer communication between the client terminal and the security relay device may include generating the private certificate using the certificate of the website if the private certificate corresponding to the website does not exist Step < / RTI >

At this time, the step of generating the private certificate using the certificate of the web site may include collecting information on validity period, subject, subject alternative name, extended key usage, and basic restriction from the certificate of the web site. Collecting information on issuer, public key and fingerprint algorithm from the certificate of the security relay device; Generating version, serial number, signature algorithm, signature hash algorithm and fingerprint information; And generating the private certificate including the collected and generated information.

A method for selectively inspecting a packet using secure socket layer communication in a security relay apparatus according to another embodiment of the present invention is a method for inspecting a packet from a client terminal connected to a network equipment to a web site using secure socket layer communication ; Establishing a Secure Sockets Layer (SSL) session between the security relay device and the web site using the certificate of the web site; Establishing a secure socket layer session between the client terminal and the security relay device using a private certificate generated using the certificate of the web site; Decrypting the packet using the session key of the client terminal when receiving the packet transmitted from the client terminal to the website; Checking whether there is data to be checked in the decoded packet; Transmitting the decrypted packet to the security device if there is data to be checked in the decrypted packet; And transmitting the decrypted packet to the web site by encrypting the decrypted packet using the session key of the security relay device upon receiving the transmission permission command for the decrypted packet from the security device.

In this case, the method for selectively inspecting a packet using the secure socket layer communication in the security relay apparatus includes the steps of: when receiving a transmission blocking command for the decrypted packet from the security apparatus, And transmitting the message.

A method for selectively inspecting a packet using secure socket layer communication in a security relay apparatus includes receiving a packet to be transmitted from the web site to the client terminal and transmitting the packet to the client terminal using the session key of the security relay apparatus Decoding a packet to be transmitted; Checking whether there is data to be checked in a packet to be transmitted to the decrypted client terminal; Transmitting a packet to be transmitted to the decrypted client terminal to the security device if data to be checked exists in a packet to be transmitted to the decrypted client terminal; And a receiving unit configured to encrypt a packet to be transmitted to the decrypted client terminal using the session key of the client terminal and transmit the encrypted packet to the client terminal when receiving a reception permission command for a packet to be transmitted from the security apparatus to the decrypted client terminal Step < / RTI >

A method for selectively inspecting a packet using secure socket layer communication in a security relay apparatus includes receiving a blocking blocking command for a packet to be transmitted from the security device to the decrypted client terminal, And transmitting a message indicating that reception is blocked.

The present invention relates to a security relay apparatus for relaying SSL communication between a client terminal and a server of a web site, in which a security relay apparatus connects to a web site to which a client terminal wants to access, Generates a private certificate corresponding to the web site using the certificate of the web site and provides the generated private certificate to the client terminal to decrypt and encrypt the packet transmitted and received between the client terminal and the web site server to relay the packet It is possible to provide only a packet requiring inspection to the security device to receive the inspection.

FIG. 1 is a schematic block diagram of a security system operating in a passive mode for selectively checking packets in secure socket layer communication according to an embodiment of the present invention. Referring to FIG.
FIG. 2 is a schematic block diagram of a security system operating in an active mode for selectively checking packets in secure socket layer communication according to an embodiment of the present invention. Referring to FIG.
3 is a diagram illustrating a message flow for connecting secure socket layer communication through a security relay apparatus according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a process of connecting secure socket layer communication between a client terminal and a server of a web site in a security relay apparatus according to an embodiment of the present invention.
5 is a diagram illustrating an example of generating a component of a private certificate according to an embodiment of the present invention.
6 is a diagram illustrating a message flow in which a packet is delivered to a server of a web site through a security relay apparatus in a security system operating in a passive mode according to an embodiment of the present invention.
7 is a diagram illustrating a message flow in which a packet is transmitted to a client terminal through a security relay device in a security system operating in a passive mode according to an embodiment of the present invention.
8 is a diagram illustrating a process of selectively checking a packet transmitted from a client terminal to a server of a web site in a security relay device operating in a passive mode according to an embodiment of the present invention.
9 is a diagram illustrating a process of selectively checking packets when a packet transmitted from a server of a web site is transmitted to a client terminal in a security relay device operating in a passive mode according to an embodiment of the present invention.
10 is a diagram illustrating a message flow in which a packet is transmitted to a server of a web site through a security relay device in a security system operating in an active mode according to an embodiment of the present invention.
11 is a diagram illustrating a message flow in which a packet is transmitted to a client terminal through a security relay device in a security system operating in an active mode according to an embodiment of the present invention.
FIG. 12 is a diagram illustrating a process of selectively checking a packet transmitted from a client terminal to a server of a web site in a security relay apparatus operating in an active mode according to an embodiment of the present invention.
13 is a diagram illustrating a process of selectively checking a packet when a packet transmitted from a server of a web site is transmitted to a client terminal in a security relay apparatus operating in an active mode according to an embodiment of the present invention.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are only for the purpose of illustrating embodiments of the inventive concept, But may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises ", or" having ", and the like, are used to specify one or more other features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

Hereinafter, a method for selectively inspecting packets using secure socket layer communication according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 13.

FIG. 1 is a schematic block diagram of a security system operating in a passive mode for selectively checking packets in secure socket layer communication according to an embodiment of the present invention. Referring to FIG.

1, when connecting to the Internet 150 from a client terminal 110 in a network environment, the client terminal 110 may be connected to the switch 120. The client terminal 110 may be connected to the switch 120 to enable network connection and data transmission. At this time, at least one client of the client terminal 110 can be connected to the Internet. For example, the client may be a terminal such as a PC or a smart phone.

The security relay device 130 corresponds to a kind of gateway device capable of acting as a proxy server and can monitor the web communication of the client terminal 110. [

When the security relay device 130 detects a connection from the client terminal 110 to the server 160 of the web site using secure sockets layer (SSL) communication through monitoring, A Secure Sockets Layer (SSL) session is established between the relay apparatus 130 and the server 160 of the website, and a secure session is established between the client terminal 110 and the client terminal 110 using a private certificate The client terminal 110 and the server 160 of the web site 160 can establish a secure socket layer session between the devices 130 and relay the packets transmitted and received between the client terminal 110 and the web site server 160.

The security relay apparatus 130 decrypts the packet to be transmitted and received, checks whether there is data to be checked in the decrypted packet, and transmits the decrypted packet to the security apparatus 140 if there is data to be checked. At this time, the data to be examined corresponds to all the information except the information for connection or maintenance of the network communication or predetermined information, that is, information that should not be leaked to the outside.

The concrete operation of relaying the connection of the secure socket layer communication in the security relay device 130 will be described in detail later with reference to FIG. 3 to FIG.

The details of the operation of the security relay device 130 in the passive mode will be described later in more detail with reference to FIG. 6 through FIG.

Meanwhile, the security device 140 may store the decrypted packet received from the security relay device 130, and may analyze the log of the decrypted packets. In addition, the security device 140 searches whether the decoded packet meets a predetermined condition, and if the decoded packet is not satisfied, transmits the decoded packet to the network manager, May exist.

FIG. 2 is a schematic block diagram of a security system operating in an active mode for selectively checking packets in secure socket layer communication according to an embodiment of the present invention. Referring to FIG.

2, when connecting from the client terminal 210 to the Internet 250 in a network environment, the client terminal 210 may be connected to the switch 220. [ The client terminal 210 may be connected to the switch 220 to enable network connection and data transmission. At this time, at least one client of the client terminal 210 can be connected to the Internet. For example, the client may be a terminal such as a PC or a smart phone.

The security relay device 230 corresponds to a kind of gateway device capable of acting as a proxy server and can monitor the web communication of the client terminal 210. [

When the security relay device 230 detects a connection from the client terminal 210 to the server 260 of the web site using secure sockets layer (SSL) communication through monitoring, A Secure Sockets Layer (SSL) session is established between the relay apparatus 230 and the server 260 of the website, and a secure session is established between the client terminal 210 and the security relay server 210 using a private certificate The session between the client terminal 210 and the server 230 of the web site can be relayed by establishing a secure socket layer session between the client terminal 210 and the web site server 260.

The security relay device 230 decrypts the packet to be transmitted and received, checks whether there is data to be checked in the decoded packet, and transmits the decrypted packet to the security device 240 when data to be checked exists, Upon receiving the processing command of the decoded packet from the processing unit 240, can process the decoded packet according to the processing command. At this time, the processing command may include a command for permitting transmission / reception of a packet, a command for blocking transmission / reception of a packet, and an command for reporting to the manager.

The concrete operation of relaying the connection of the secure socket layer communication in the security relay device 230 will be described in detail later with reference to FIG. 3 to FIG.

The details of the operation of the security relay apparatus 230 in the active mode will be described later in more detail with reference to FIG. 10 through FIG.

On the other hand, when receiving from the security relay device 230, the security device 240 searches whether the decrypted packet meets a predetermined condition, and if the predetermined condition is satisfied, the security device 240 transmits a permission command for permitting transmission / And transmits a blocking command to the security relay device 230 to block transmission / reception of the decoded packet if the predetermined condition is not satisfied.

3 is a diagram illustrating a message flow for connecting secure socket layer communication through a security relay apparatus according to an exemplary embodiment of the present invention.

Referring to FIG. 3, the client terminal 110, 210 may attempt to connect to a web site using secure socket layer communication (310).

When the security relay apparatuses 130 and 230 detect a connection from the client terminals 110 and 210 to a web site using secure socket layer communication 110, the security relay apparatuses 130 and 230 access the web site on behalf of the client terminals 110 and 210 (312).

If there is no certificate of the web site, the security relay apparatuses 130 and 230 request the certificate of the web site to the servers 160 and 260 of the web site and receive the certificate (314). In this case, in step 314, when a certificate is requested and received, the certificate can be received through a process of Client Hello, Server Hello, and Certificate.

The security relay apparatuses 130 and 230 authenticate the certificate of the website and the security relay apparatuses 130 and 230 and the servers 160 and 260 of the web site authenticate the security relay apparatus 130 And establishes a Secure Sockets Layer (SSL) session between the server 230 and the servers 160 and 260 of the website.

The security relay devices 130 and 230 use the certificates of the website and the certificates of the security relay devices 130 and 230 to generate private certificates corresponding to the web sites, Can be generated in the same way (318).

5 is a diagram illustrating an example of generating a component of a private certificate according to an embodiment of the present invention.

Referring to FIG. 5, components of a private certificate are generated by three generation methods.

The three methods include a method 510 generated by the security relay devices 130 and 230, a method 520 of fetching from the actual certificate of the site to which the client terminal 260 intends to access, and the security relay devices 130 and 230, Lt; RTI ID = 0.0 > 530 < / RTI >

520 generates information on the validity period, the subject, the subject alternative name, the extended key usage, and the basic restriction from the actual certificate of the site to which the client terminal 110 or 210 wants to access, thereby generating a component of the private certificate.

The method 530 takes information about the issuer, the public key, and the fingerprint algorithm from the certificates of the security intermediaries 130 and 230 to generate the components of the private certificate.

510 method generates version, serial number, signature algorithm, signature hash algorithm, and fingerprint information according to the setting criteria of the security relay device 130, 230. At this time, the fingerprint can be generated using the fingerprint algorithm obtained from the certificate of the security relay device 130, 230.

Referring back to FIG. 2, the security relay apparatuses 130 and 230 provide a private certificate to the client terminals 110 and 210 (120).

The client terminals 110 and 210 and the security relays 130 and 230 authenticate the private certificates at the client terminals 110 and 210. The client terminals 110 and 210 and the security relays 130 and 230 use the private certificates, 230) with each other (122).

That is, the security relay apparatuses 130 and 230 establish an SSL session with the client terminals 110 and 210 between the client terminals 110 and 210 and the servers 160 and 260 of the website, And establishes an SSL session, thereby relaying packets transmitted and received.

4 is a flowchart illustrating a process of connecting secure socket layer communication between a client terminal and a server of a web site in a security relay apparatus according to an embodiment of the present invention.

Referring to FIG. 4, when the security relay apparatuses 130 and 230 detect a connection from the client terminals 110 and 210 to a web site using secure socket layer communication (410), the security relay apparatuses 130 and 230 And attempts to access the web site on behalf of the client terminal 110, 210 (412).

Then, the security relay device 130 or 230 confirms whether a certificate of the web site exists (414).

If it is determined in step 414 that there is no certificate of the web site, the security relay device 130 or 230 requests the web site server 160 or 260 of the web site for a certificate of the web site and receives the certificate.

Then, the security relay devices 130 and 230 authenticate the certificate of the web site, and establish a secure socket layer (SSL) session between the security relay device and the web site using the certificate of the web site (418).

In step 418, when the SSL relay session is established between the security relay apparatuses 130 and 230 and the servers 160 and 260 of the website, the security relay apparatuses 130 and 230 perform SSL communication with the servers 160 and 260 of the website And may transmit the session key of the security relay device to the server 160, 260 of the web site by encrypting the session key using the public key included in the certificate of the web site. The servers 160 and 260 of the web site receiving the encrypted session key of the security relay apparatus decrypt the encrypted session key of the security relay apparatus using the secret key corresponding to the certificate of the web site, Can be obtained. Thereafter, the security relay apparatuses 130 and 230 and the servers 160 and 260 of the web site can perform encrypted communication using the session key of the security relay apparatus.

Then, the security relay devices 130 and 230 check whether there is a private certificate corresponding to the website (420).

If it is determined in operation 420 that there is no private certificate corresponding to the web site, the security relay device 130 or 230 uses the certificate of the web site and the certificate of the security relay device 130 or 230, A certificate is generated (422). At this time, the security relay devices 130 and 230 collect information on the valid period, the subject, the subject alternative name, the extended key usage, and the basic restriction from the certificate of the web site, Collects information about the issuer, public key, and fingerprint algorithm, and generates a private certificate that generates and collects information about the version, serial number, signature algorithm, signature hash algorithm, and fingerprint, and uses the generated information as a component .

Then, the security relay devices 130 and 230 provide the generated or retrieved private certificate to the client terminals 110 and 210 (424).

The security relay devices 130 and 230 establish a secure socket layer session between the client terminals 110 and 210 and the security relay devices 130 and 230 using the private certificate generated using the certificate of the website ).

In step 426, when the SSL session is established between the client terminals 110 and 210 and the security relay devices 130 and 230, the security relay devices 130 and 230 transmit the public key included in the private certificate from the client terminals 110 and 210 Upon receiving the encrypted session key of the client terminal, the session key of the client terminal can be obtained by decrypting the session key of the client terminal encrypted with the secret key corresponding to the private certificate. Then, the security relay apparatuses 130 and 230 can perform encrypted communication with the client terminals 110 and 210 using the session key of the client terminal.

6 is a diagram illustrating a message flow in which a packet is delivered to a server of a web site through a security relay apparatus in a security system operating in a passive mode according to an embodiment of the present invention.

Referring to FIG. 6, when the security relay device 130 receives a packet transmitted from the client terminal 110 to the web site (610), it decrypts the packet using the session key of the client terminal (612).

Then, the security relay apparatus 130 confirms whether data to be checked exists in the decoded packet (614).

If it is determined in step 614 that there is data to be checked, the security relay apparatus 130 transmits the decrypted packet to the security apparatus 140 (step 616).

The secure device 140 receiving the decrypted packet stores the decrypted packet (618).

The security relay apparatus 130 encrypts the decrypted packet using the session key of the security relay apparatus regardless of whether there is data to be checked in the decrypted packet (620), and transmits the decrypted packet to the security relay apparatus And transmits the packet to the website (622).

7 is a diagram illustrating a message flow in which a packet is transmitted to a client terminal through a security relay device in a security system operating in a passive mode according to an embodiment of the present invention.

7, when the secure relay apparatus 130 receives the packet transmitted from the server 160 of the web site to the client terminal 110 (710), the secure relay apparatus 130 decrypts the packet using the session key of the security relay apparatus (712).

Then, the security relay apparatus 130 checks whether there is data to be checked in the decrypted packet (714).

If it is determined in step 714 that there is data to be checked, the security relay device 130 transmits the decrypted packet to the security device 140 (step 716).

The secure device 140 receiving the decrypted packet stores the decrypted packet (618).

Meanwhile, the security relay apparatus 130 encrypts the decrypted packet using the session key of the client terminal regardless of whether there is data to be checked in the decrypted packet (720), and transmits the packet encrypted with the session key of the client terminal To the client terminal 110 (722).

8 is a diagram illustrating a process of selectively checking a packet transmitted from a client terminal to a server of a web site in a security relay device operating in a passive mode according to an embodiment of the present invention.

Referring to FIG. 8, when the security relay 130 receives a packet to be transmitted to the website from the client terminal 110 (810), the security relay 130 decrypts the packet using the session key of the client terminal (812).

Then, the security relay device 130 checks whether data to be checked exists in the decoded packet (814).

If it is determined in step 814 that there is data to be checked, the security relay device 130 transmits the decrypted packet to the security device 140 (step 816). At this time, the data to be examined corresponds to all the information except the information for connection or maintenance of the network communication or predetermined information, that is, information that should not be leaked to the outside.

Thereafter, the security relay apparatus 130 encrypts the decrypted packet using the session key of the security relay apparatus regardless of whether there is data to be checked in the decrypted packet (818), and transmits the decrypted packet encrypted with the session key of the security relay apparatus The packet is transmitted to the website (820).

Meanwhile, since the security relay apparatus 130 selectively transmits the decrypted packet to the security device 140, the sequence number included in the decrypted packet may not consistently increase sequentially, An error may occur in the device 140. In order to solve this problem, when the decrypted packet is transmitted to the security device 140, the security relay device 130 transmits the decrypted packet to the security device 140, which is the sequence number of the last packet transmitted from the client terminal 110 to the secure device 140 Changes the sequence number of the decoded packet to a number obtained by adding 1 to the first final sequence number, transmits the decoded packet whose sequence number is changed to the secure device 140, The number can be updated.

5-tuple value (source IP, destination IP, source port, destination port, protocol (udp or tcp)) included in the header of the decoded packet is changed when the security relay device 130 changes the sequence number of the decrypted packet .

9 is a diagram illustrating a process of selectively checking packets when a packet transmitted from a server of a web site is transmitted to a client terminal in a security relay device operating in a passive mode according to an embodiment of the present invention.

9, when the security relay device 130 receives a packet to be transmitted from the server 160 of the web site to the client terminal (910), the security relay device 130 transmits the packet to be transmitted to the client terminal using the session key of the security relay device (912).

Then, the security relay apparatus 130 checks whether there is data to be checked in the packet to be transmitted to the decrypted client terminal (914).

If it is determined in step 914 that there is data to be checked, the security relay device 130 transmits a packet to be transmitted to the decrypted client terminal to the security device 140 (916).

Thereafter, the security relay 130 encrypts the packet to be transmitted to the decrypted client terminal using the session key of the client terminal regardless of whether there is data to be checked in the packet to be transmitted to the decrypted client terminal (step 918) , And transmits a packet to be transmitted to the client terminal 110 encrypted by the session key of the client terminal to the client terminal 110 (920).

Meanwhile, since the security relay apparatus 130 selectively transmits the decrypted packet to the security device 140, the sequence number included in the decrypted packet may not consistently increase sequentially, An error may occur in the device 140. In order to solve this problem, when the security relay device 130 transmits a packet to be transmitted to the decrypted client terminal to the security device 140, the security relay device 130 transmits the packet to be transmitted to the security device 140, The sequence number of the packet to be transmitted to the decrypted client terminal is changed to the number obtained by adding 1 to the second final sequence number and is transmitted to the decrypted client terminal with the changed sequence number Send the packet to the secure device 140, and update the second final sequence number.

When the sequence number of a packet to be transmitted to the decrypted client terminal is changed, the security relay apparatus 130 transmits a 5-tuple value (source IP, destination IP, source port, destination port, protocol (udp or tcp)).

10 is a diagram illustrating a message flow in which a packet is transmitted to a server of a web site through a security relay device in a security system operating in an active mode according to an embodiment of the present invention.

Referring to FIG. 10, when the security relay 230 receives a packet transmitted from the client terminal 210 to the web site (1010), it decrypts the packet using the session key of the client terminal (1012).

Then, the security relay apparatus 230 checks whether there is data to be checked in the decrypted packet (1014).

If it is determined in step 1014 that there is data to be checked, the security relay apparatus 230 transmits the decrypted packet to the security apparatus 240 (1016).

The security device 240 checks the data to be checked included in the decoded packet (1018), and transmits the transmission permission command to the security relay device 230 if the data to be checked is not related to the information leakage (1020 ). At this time, the security device 240 may store and manage decrypted packets.

When there is no data to be checked in the decrypted packet or the transmission permission command is received from the security device 240, the security relay device 230 encrypts the decrypted packet using the session key of the security relay device (1022 , And transmits the packet encrypted with the session key of the security relay device to the web site (1024).

In step 1018, the security device 240 determines whether data to be checked satisfies a predetermined condition by determining whether data to be checked satisfies a predetermined condition, and determines whether transmission is allowed or blocked or transmits a decoded packet to a network manager. It is possible to determine the transmission permission or the transmission blocking from the manager by receiving the response.

11 is a diagram illustrating a message flow in which a packet is transmitted to a client terminal through a security relay device in a security system operating in an active mode according to an embodiment of the present invention.

11, when the secure relay apparatus 230 receives a packet transmitted from the server 160 of the web site to the client terminal 110 (1110), it decrypts the packet using the session key of the security relay apparatus (1112).

Then, the security relay apparatus 230 checks whether data to be checked exists in the decoded packet (1114).

If it is determined in step 1114 that there is data to be checked, the security relay apparatus 230 transmits the decrypted packet to the secure apparatus 240 (step 1116).

The security device 240 checks the data to be checked included in the decoded packet (1118). If the data to be checked is a receivable data (for example, it is not harmful data), the security device 240 transmits a reception permission command to the security relay device (Step 1120). At this time, the security device 240 may store and manage decrypted packets.

When there is no data to be checked in the decrypted packet or the reception permission command is received from the security device 2240, the security relay device 230 encrypts the decrypted packet using the session key of the client terminal (1122) , And transmits the packet encrypted with the session key of the client terminal to the client terminal 110 (1124).

In step 1118, the security device 240 determines whether the data to be checked satisfies predetermined conditions by determining whether the data to be checked satisfies a predetermined condition, or decides to block reception or block reception, or transmits the decoded packet to the network manager, It is possible to determine the reception permission or the reception blocking from the manager in response.

FIG. 12 is a diagram illustrating a process of selectively checking a packet transmitted from a client terminal to a server of a web site in a security relay apparatus operating in an active mode according to an embodiment of the present invention.

Referring to FIG. 12, when the security relay 230 receives a packet transmitted from the client terminal 210 to the web site (1210), it decrypts the packet using the session key of the client terminal (1212).

Then, the security relay apparatus 230 checks whether data to be checked exists in the decrypted packet (1214).

If it is determined in step 1214 that there is data to be checked, the security relay device 230 transmits the decrypted packet to the security device 240 (1216). At this time, the data to be examined corresponds to all the information except the information for connection or maintenance of the network communication or predetermined information, that is, information that should not be leaked to the outside.

If it is determined in step 1214 that there is no data to be checked and the transmission permission command is received from the security device 240 in step 1218, the security relay device 230 encrypts the decrypted packet using the session key of the security relay device (1222), and transmits the packet encrypted with the session key of the security relay device to the website (1224).

In step 1220, the secure relay apparatus 230 transmits the decrypted packet to the secure device 240 in step 1216 and then receives a transmission blocking command from the secure device 240 in step 1220. The secure relay apparatus 230 transmits the decrypted packet to the client terminal 210, (1226) a message indicating that the packet transmitted from the mobile station 210 has been blocked.

On the other hand, since the security relay device 230 selectively transmits the decrypted packet to the security device 240, the sequence number included in the decrypted packet may not consistently increase sequentially, An error may occur in the device 240. The security relay apparatus 230 transmits the decrypted packet to the secure apparatus 240. The secure relay apparatus 230 transmits the decrypted packet to the secure apparatus 240 by using the sequence number of the last packet transmitted from the secure terminal 240, Changes the sequence number of the decoded packet to a number obtained by adding 1 to the first final sequence number, transmits the decoded packet whose sequence number is changed to the secure device 240, The number can be updated.

5-tuple value (source IP, destination IP, source port, destination port, protocol (udp or tcp)) included in the header of the decoded packet is changed when the security relay device 230 changes the sequence number of the decrypted packet .

13 is a diagram illustrating a process of selectively checking a packet when a packet transmitted from a server of a web site is transmitted to a client terminal in a security relay apparatus operating in an active mode according to an embodiment of the present invention.

13, when the security relay device 230 receives a packet to be transmitted from the server 260 of the web site to the client terminal (1310), the security relay device 230 transmits the packet to be transmitted to the client terminal using the session key of the security relay device (1312).

Then, the security relay apparatus 230 checks whether there is data to be checked in the packet to be transmitted to the decrypted client terminal (1314).

If it is determined in step 1314 that there is data to be checked, the security relay device 230 transmits a packet to be transmitted to the decrypted client terminal to the security device 240 (1316).

If it is determined in step 1314 that there is no data to be checked or a reception permission command is received from the security device 240 in step 1318, the security relay 230 transmits a packet to be transmitted to the decrypted client terminal, (1322), and transmits to the client terminal 210 a packet to be transmitted to the client terminal encrypted with the session key of the client terminal (1324).

The secure relay 230 transmits the packet to be transmitted to the client terminal decrypted by the secure device 240 in step 1216 and then receives the reception blocking command from the secure device 240 The network manager transmits a message indicating that the packet transmitted to the client terminal 210 is blocked (1326).

On the other hand, since the security relay device 230 selectively transmits the decrypted packet to the security device 240, the sequence number included in the decrypted packet may not consistently increase sequentially, An error may occur in the device 240. In order to solve this problem, when the security relay device 230 transmits a packet to be transmitted to the decrypted client terminal to the security device 240, the security relay device 230 transmits the packet to be transmitted to the security device 240 among the packets to be transmitted to the client terminal 210 The sequence number of the packet to be transmitted to the decrypted client terminal is changed to the number obtained by adding 1 to the second final sequence number and is transmitted to the decrypted client terminal with the changed sequence number Send the packet to the secure device 240, and update the second final sequence number.

When the sequence number of a packet to be transmitted to the decrypted client terminal is changed, the security relay apparatus 230 transmits the 5-tuple value (source IP, destination IP, source port, destination port, protocol (udp or tcp)).

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. The apparatus and components described in the embodiments may be implemented, for example, as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) unit, a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments and equivalents to the claims are within the scope of the following claims.

110; Client terminal
120; switch
130; Security relay device
140; Security device
150; Internet
160; Web site server

Claims (14)

Detecting from a security relay device a connection from a client terminal connected to the network equipment to a website using secure socket layer communication;
Establishing a Secure Sockets Layer (SSL) session between the security relay device and the web site using the certificate of the web site;
Establishing a secure socket layer session between the client terminal and the security relay device using a private certificate generated using the certificate of the web site;
Decrypting the packet using the session key of the client terminal when receiving the packet transmitted from the client terminal to the website;
Checking whether there is data to be checked in the decoded packet;
Transmitting the decrypted packet to the security device if there is data to be checked in the decrypted packet; And
Encrypting the decrypted packet using the session key of the security relay apparatus and transmitting the decrypted packet to the website
Lt; / RTI >
Wherein establishing a secure socket layer session between the client terminal and the security gateway comprises:
If the private certificate corresponding to the website does not exist,
A first collection step of collecting information on validity period, subject, subject alternative name, extended key usage and basic restriction from the certificate of the website;
A second collection step of collecting information on the issuer, the public key and the fingerprint algorithm from the certificate of the security relay device;
A first generation step of generating information on a version, a serial number, a signature algorithm, and a signature hash algorithm;
A second generating step of generating a fingerprint using the fingerprint algorithm collected in the second collecting step; And
A generating step of generating the private certificate including information collected in the first collecting step, information collected in the second collecting step, information generated in the first generating step, and information generated in the second generating step Containing
A method for selectively inspecting a packet using secure socket layer communication in a security relay device.
The method according to claim 1,
Wherein the step of delivering the decrypted packet to the security device comprises:
Checking a first final sequence number which is a sequence number of a last packet transmitted from the client terminal to the security device;
Changing the sequence number of the decrypted packet to a number obtained by adding 1 to the first final sequence number and transmitting the decrypted packet with the changed sequence number to the security device; And
Updating the first final sequence number
The method comprising the steps of: receiving a packet from a secure relaying device;
The method according to claim 1,
If it is determined that there is no data to be checked in the decrypted packet, the decrypted packet is transmitted to the web site without encrypting the decrypted packet using the session key of the security device without transmitting the decrypted packet to the security device step
Further comprising the steps of: receiving a packet from the secure relay layer;
The method according to claim 1,
Wherein establishing a secure socket layer session between the security gateway and the web site comprises:
Generating a session key of the security relay device; And
Encrypting the session key of the security relay device using a public key included in the certificate of the website and transmitting the encrypted session key to the server of the website
The method comprising the steps of: receiving a packet from a secure relaying device;
The method according to claim 1,
Wherein establishing a secure socket layer session between the client terminal and the security gateway comprises:
Receiving a session key of a client terminal encrypted with a public key included in the private certificate from the client terminal; And
Acquiring a session key of the client terminal by decrypting the encrypted session key of the client terminal with a private key corresponding to the private certificate
The method comprising the steps of: receiving a packet from a secure relaying device;
The method according to claim 1,
Decrypting a packet to be transmitted to the client terminal using a session key of the security relay apparatus upon receiving a packet to be transmitted from the website to the client terminal;
Checking whether there is data to be checked in a packet to be transmitted to the decrypted client terminal;
Transmitting a packet to be transmitted to the decrypted client terminal to the security device if data to be checked exists in a packet to be transmitted to the decrypted client terminal; And
Encrypting a packet to be transmitted to the decrypted client terminal using the session key of the client terminal and transmitting the encrypted packet to the client terminal
Further comprising the steps of: receiving a packet from the secure relay layer;
The method according to claim 6,
Wherein the step of delivering a packet to be transmitted to the decrypted client terminal to the security device comprises:
Confirming a second final sequence number which is a sequence number of a last packet transmitted to the security device from packets to be transmitted to the client terminal;
Changing a sequence number of a packet to be transmitted to the decrypted client terminal to a number obtained by adding 1 to the second final sequence number and transmitting a packet to be transmitted to the decrypted client terminal with a changed sequence number to the security device; And
Updating the second final sequence number
The method comprising the steps of: receiving a packet from a secure relaying device;
The method according to claim 6,
If it is determined that there is no data to be checked in the packet to be transmitted to the decrypted client terminal, it is determined that it is not necessary to check and the packet is not transmitted to the security device
Further comprising the steps of: receiving a packet from the secure relay layer;
delete delete Detecting from a security relay device a connection from a client terminal connected to the network equipment to a website using secure socket layer communication;
Establishing a Secure Sockets Layer (SSL) session between the security relay device and the web site using the certificate of the web site;
Establishing a secure socket layer session between the client terminal and the security relay device using a private certificate generated using the certificate of the web site;
Decrypting the packet using the session key of the client terminal when receiving the packet transmitted from the client terminal to the website;
Checking whether there is data to be checked in the decoded packet;
Transmitting the decrypted packet to the security device if there is data to be checked in the decrypted packet; And
Encrypting the decrypted packet using the session key of the security relay device and transmitting the decrypted packet to the web site upon receiving a transmission permission command for the decrypted packet from the security device
Lt; / RTI >
Wherein establishing a secure socket layer session between the client terminal and the security gateway comprises:
If the private certificate corresponding to the website does not exist,
A first collection step of collecting information on validity period, subject, subject alternative name, extended key usage and basic restriction from the certificate of the website;
A second collection step of collecting information on the issuer, the public key and the fingerprint algorithm from the certificate of the security relay device;
A first generation step of generating information on a version, a serial number, a signature algorithm, and a signature hash algorithm;
A second generating step of generating a fingerprint using the fingerprint algorithm collected in the second collecting step; And
A generating step of generating the private certificate including information collected in the first collecting step, information collected in the second collecting step, information generated in the first generating step, and information generated in the second generating step Containing
A method for selectively inspecting a packet using secure socket layer communication in a security relay device.
12. The method of claim 11,
When receiving a transmission blocking command for the decrypted packet from the security device, transmitting a message to the client terminal or the network manager indicating that the transmission is blocked
Further comprising the steps of: receiving a packet from the secure relay layer;
13. The method of claim 12,
Decrypting a packet to be transmitted to the client terminal using a session key of the security relay apparatus upon receiving a packet to be transmitted from the website to the client terminal;
Checking whether there is data to be checked in a packet to be transmitted to the decrypted client terminal;
Transmitting a packet to be transmitted to the decrypted client terminal to the security device if data to be checked exists in a packet to be transmitted to the decrypted client terminal; And
Encrypting a packet to be transmitted to the decrypted client terminal using the session key of the client terminal and transmitting the encrypted packet to the client terminal upon receiving a reception permission command for a packet to be transmitted from the security device to the decrypted client terminal;
Further comprising the steps of: receiving a packet from the secure relay layer;
14. The method of claim 13,
When receiving a reception blocking command for a packet to be transmitted from the security device to the decrypted client terminal, transmitting to the client terminal or the network manager a message informing that the reception is blocked
Further comprising the steps of: receiving a packet from the secure relay layer;

Images