KR101978685B1 - Method and System for Synchronizing Security Policy in 3-tier CASB Service System - Google Patents

Abstract

The security policy synchronization method of a 3-tier CASB service system according to an embodiment of the present invention is a method of security policy synchronization of a 3-tier CASB service system by inserting policy related metadata into an HTTP header when a security policy is set in a private CASB or a public CASB, Receiving a security policy received by the public CASB; A security policy checking step of receiving packet data from the public CASB and confirming the security policy of the private CASB by checking the policy related metadata inserted in the HTTP header of the packet data; A response step of transmitting, to the private CASB, confirmation packet data indicating that the security policy has been normally received in response to the confirmed private CASB security policy; And the private CASB compares the security policy version information included in the confirmation packet data received from the public CASB with the version information of the security policy set in the private CASB, and when the version of the security setting policy of the public CASB is the latest version, And a policy re-setting step of modifying and reflecting the security policy according to the security setting policy attached to the version information of the version information.

Description

TECHNICAL FIELD [0001] The present invention relates to a 3-tier CASB service system and a method of synchronizing its security policy with a 3-tier CASB service system,

The present invention relates to a 3-tier CASB service system and a security policy synchronization method thereof, and more particularly, to a 3-tier CASB service system and a security policy synchronization method using the 3-tier CASB service system and its security policy synchronization method. , Cloud Access Security Broker) services, and a security policy synchronization method for the CASB service system.

Cloud computing is a computing service that pays a large amount of IT resources for computing resources using virtualization technology and distributed processing technology. In other words, cloud computing can be regarded as 'Internet based user-centered on-demand outsourcing service technology' that integrates computing resources (memory, CPU, storage, etc.) existing in different physical locations into one through virtualization technology.

If the Internet is provided, you can use your own computing environment regardless of time and place, charge a fee for the time you use, and all services such as hardware / software and post-service can be provided in the cloud computing environment Therefore, system maintenance and repair costs, hardware / software purchase cost, and energy savings can be expected.

There are four types of cloud computing services: public cloud service, private cloud service, communication cloud service, and hybrid cloud service.

A public cloud service is a service provider that lends computing resources such as servers and storage to an unspecified number of enterprises, organizations, and individuals via the public Internet network. Public cloud services do not mean free or open data and sources, and provide services such as user access control and billing. Companies, organizations, and individuals who use public cloud services physically share common resources with other companies, organizations, or individuals. Services provided to each company, organization, or individual are logically separated by virtualization technology Because it is used, it is vulnerable to the protection of personal information, and the security function is an important factor in the service.

A private cloud service is a service that provides a computing environment such as a public cloud service and manages services, data, and processes directly from a specific company or organization. For security reasons, it is a closed cloud service model that can be accessed only by authorized persons while avoiding contact with outside.

The communication cloud service is a cloud computing service for a specific group, granting access only to members. Members of the group share data and applications with each other.

Hybrid cloud service is a combination of public cloud service and private cloud service. It provides public cloud service basically, and data and service that do not want to share follow private cloud service policy.

CASB is currently being developed for the security of public cloud service because of its vulnerability to privacy protection. This CASB is designed to protect the security of public cloud service, which is physically independent security device between public cloud service user and public cloud service system, It grasps the authority for the service and performs the access control function.

1 shows a configuration diagram of a 3-tier (three-tiered) CASB service system 1000 including a security agent 100, a private CASB 200, and a public CASB 300. [

CASB is responsible for ensuring the security of public cloud services by allowing independent security equipment to perform access control functions for users of public cloud services.

As shown in FIG. 1, in the case of the private CASB 200, there is an advantage that the security service can be installed and operated in the own company in using the cloud service 400 to provide more stable security according to the policy of the company. Also, since it operates in a proxy mode, even if the open cloud service is encrypted with SSL (Secure Sockets Layer), it can decrypt it and enable more precise security access control. Here, a proxy is a service technology used as a method of accessing a proxy server from a web browser. When a proxy is specified in a web browser, a uniform resource locator (URL) requested by the web client is not connected to the server, The server is connected to the server. The proxy server that receives the proxy request connects with the corresponding server of the URL, sends the request, receives the response on behalf of the client, and hands it to the client. SSL is an industry-standard protocol for securely sending and receiving data between a world-wide web browser and a web server. SSL can be applied to other TCP / IP applications such as file transfer protocols (FTP) as well as web products. have. The disadvantage of private CASB is that there is a cost incurred by installing equipment separately for each company.

As shown in FIG. 1, in the case of the public CASB 300, all traffic to the managed cloud service must be processed in accordance with the security policy, so it is suitable for a small-sized cloud service. However, in a cloud service in which a large amount of traffic occurs, Normal service due to the problem may be difficult. The advantage is that it can be installed without changing the existing network and it can take the same security policy as Proxy.

However, the security control-related policies applied through the private CASB 200 and the public CASB 300 in the security agent 100 include mandatory access control (MAC), role-based access control (RBAC) ), But there is a disadvantage in that the security control policy between the private CASB and the public CASB is not the same. Here, the MAC collects and classifies information at the center, attaches security levels to each, and performs policy access control on the security levels. Here, RBAC is a method of granting access rights to a user group having a corresponding role, rather than a specific user, based on the role of the user in the organization.

One of the disadvantages of the 3-tier CASB service system is that the security policy must be individually set when the security policy is set in the private CASB and the public CASB. In the 3-tier CASB service system structure, when the security policies operated by the private CASB and the public CASB are operated differently, there is a problem in the consistency of the security control service of the 3-tier CASB service system do.

Second, in the case of a public CASB that has a different security policy than that of the private CASB, security control technology based on the security policy operated by the public CASB is applied to packets passing through the private CASB according to a certain method. There is a disadvantage in that it is necessary to decide whether to re-execute.

KR 10-2013-0046155 (Access Control System in Cloud Computing Service)

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a 3-tier CASB service system using a metadata generation and analysis technique for improving the safety of a public cloud service, And a method for synchronizing the service policy and the security policy.

However, the object of the present invention is not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

The security policy synchronization method of a 3-tier CASB service system according to an embodiment of the present invention is a method of security policy synchronization of a 3-tier CASB service system by inserting policy related metadata into an HTTP header when a security policy is set in a private CASB or a public CASB, Receiving a security policy received by the public CASB; A security policy checking step of receiving packet data from the public CASB and confirming the security policy of the private CASB by checking the policy related metadata inserted in the HTTP header of the packet data; A response step of transmitting, to the private CASB, confirmation packet data indicating that the security policy has been normally received in response to the confirmed private CASB security policy; And the private CASB compares the security policy version information included in the confirmation packet data received from the public CASB with the version information of the security policy set in the private CASB, and when the version of the security setting policy of the public CASB is the latest version, And a policy re-setting step of modifying and reflecting the security policy according to the security setting policy attached to the version information of the version information.

Preferably, the policy-related meta data includes at least one of security policy version information, a security policy setting method, and a callback address.

Preferably, in the response step, the information about the identity indicating whether the security policy set in the public CASB is identical to the received private CASB security policy and the version information of the security setting policy are included in the confirmation packet data, To the mobile terminal.

In the HTTP communication-based CASB security policy synchronization method according to another embodiment of the present invention, when a user uses the CASB service by his / her computer, the public CASB uses a synchronization Field identification step; A security policy changing step of setting a CASB operator to access the private CASB and change the security policy in the private CASB; When the security policy is changed, the private CASB inserts the security policy related metadata in the HTTP header, and transmits the HTTP packet data in which the metadata is inserted to the public CASB. A security policy checking step of receiving packet data in which the metadata is inserted in the public CASB and verifying the security policy of the private CASB by checking the metadata; And a response to transmit the HTTP packet data for the acknowledgment indicating that the public CASB security policy is normally received by the private CASB in response to the reception of the security policy based on the information about the security policy set by the private CASB The method comprising the steps of:

Preferably, the security policy checking step compares the metadata information based security policy setting HTTP header information included in the packet data transmitted from the private CASB with the security policy version information set in the public CASB when the public CASB receives the HTTP header information. And the latest version is confirmed.

Preferably, in the response step, the information about the security policy set in the public CASB, the identity of the received private CASB security policy, and the version information of the security setting policy are transmitted together to the private CASB.

Preferably, the private CASB receives the HTTP packet data for the acknowledgment, compares the security policy version information received from the public CASB with the version information of the security policy set in the private CASB, and if it is newer version information, And a security policy re-setting step of reflecting and reflecting the security policy according to the security setting policy of the security policy setting unit.

In the security policy synchronization method in the public CASB according to another embodiment of the present invention, the public CASB receives the cloud packet data, extracts the security policy information metadata included in the HTTP header field of the received cloud packet data, An analysis step for analyzing information; A version checking step of determining whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB; A policy changing step of changing the security policy of the public CASB to the version of the received private CASB security policy if the latest version is determined; A response step of checking whether the security policy of the public CASB has been changed, and transmitting the HTTP packet data for responding to the private CASB that the public CASB security policy has been changed when the security policy is changed; And transmitting the received cloud packet data according to the established security policy when it is determined that the security policy is not changed or the security policy is not changed.

A computer-readable recording medium according to another embodiment of the present invention records a program for executing a security policy synchronization method.

In a 3-tier CASB service system according to another embodiment of the present invention, when a security policy is set, policy-related metadata is inserted into an HTTP header, and HTTP packet data is transmitted to a network so that the public CASB receives the public- And compares the security policy version information included in the confirmation packet data with the version information of the security policy set in the private CASB, and when the version of the security setting policy of the public CASB is the more recent version, A private CASB that modifies and reflects its own security policy according to the security setting policy assigned to the version information; And receives the packet data, confirms the policy related metadata inserted in the HTTP header of the packet data to check the security policy of the private CASB, notifies that the security policy is normally received in response to the confirmed private CASB security policy And a public CASB for transmitting the acknowledgment packet data to the private CASB.

Preferably, the policy-related meta data includes at least one of security policy version information, a security policy setting method, and a callback address.

Preferably, the public CASB includes information on the identity indicating whether the set security policy is the same as the private CASB security policy received, and version information of the security setting policy together with the confirmation packet data to the private CASB .

In the 3-tier CASB service system according to another embodiment of the present invention, when a user (or an external accessor) uses a CASB service with his / her computer, it checks whether an HTTP header field for security setting policy synchronization exists Receives the packet data in which the metadata is inserted in the public CASB, verifies the security policy of the private CASB by checking the metadata, and reflects the public CASB security policy based on the information about the security policy set by the private CASB A public CASB for transmitting HTTP packet data for an acknowledgment notifying the private CASB of the normal reception of the changed security policy in response to the reception of the security policy; And when the CASB operator accesses the private CASB and changes the security policy in the private CASB, if the security policy is changed, the security policy related metadata is inserted in the HTTP header, and the HTTP packet data in which the metadata is inserted is transmitted to the public CASB To the private CASB.

Preferably, the public CASB compares the security policy version information set in the public CASB with the metadata-based security policy setting HTTP header information included in the packet data transmitted from the private CASB, And verifies whether or not it is a version.

Preferably, the public CASB transmits information about the identity of the security policy set in the public CASB and the received private CASB security policy together with the version information of the security setting policy to the private CASB.

Preferably, the private CASB receives the HTTP packet data for the acknowledgment, compares the security policy version information received from the public CASB with the version information of the security policy set in the private CASB, and if it is newer version information, And reflects its own security policy according to the security setting policy of the server.

The public CASB that performs security policy synchronization according to another embodiment of the present invention receives cloud packet data and extracts security policy information metadata included in the HTTP header field of the received cloud packet data to analyze security policy information Analysis means; A version checking unit that determines whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB; Policy change means for changing the security policy of the public CASB to the version of the received private CASB security policy when the latest version is determined; A response unit for confirming whether or not the security policy of the public CASB has been changed, and transmitting HTTP packet data for responding to the private CASB that the public CASB security policy has been changed when the security policy is changed; And means for transmitting the received cloud packet data according to a security policy established when it is determined that the security policy is not changed or that the security policy is not changed.

As described above, the present invention has an effect of avoiding different security policy settings by transmitting and receiving policy information in real time on the basis of a security policy between a private CASB and a public CASB based on metadata generation and analysis technology.

1 shows a configuration diagram of a 3-tier CASB service system.
FIG. 2 illustrates a method of synchronizing HTTP communication-based CASB security policy in a 3-tile CASB service system according to an embodiment of the present invention.
FIG. 3 illustrates a method of synchronizing HTTP communication-based public CASB security policies in a 3-tier CASB service system.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the term " comprising " or " comprising " or the like is intended to specify the presence of stated features, integers, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In order to solve the security policy setting problem of the conventional access control technology of the 3-tier CASB service system, the present invention proposes a security policy between the private CASB and the public CASB as policy information In order to avoid different security policy settings.

1, a 3-tier CASB service system according to the present invention includes a security agent 100, a private CASB 200, and a public CASB 200, which are included in a conventional 3-tier CASB service system. 300, but it is different in that it further provides a security policy synchronization method between the private CASB 200 and the public CASB 300.

1, in a 3-tier CASB service system according to an embodiment of the present invention, the private CASB 200 inserts policy related metadata in an HTTP header when a security policy is set, Transmits the HTTP packet data to the network, receives the confirmation packet data from the public CASB, compares the security policy version information included in the confirmation packet data with the version information of the security policy set in the private CASB, If the version of the configuration policy is the more recent version, its security policy is modified and reflected according to the security configuration policy assigned to the latest version information. In addition, the public CASB receives the packet data, checks the policy related metadata inserted in the HTTP header of the packet data to check the security policy of the private CASB, and receives the security policy normally in response to the confirmed private CASB security policy And sends the confirmation packet data to the private CASB. Here, HTTP is a Hyper Text Transfer Protocol, a protocol for transmitting and receiving information on the WWW, and a request response protocol between the client and the server. In the present invention, the private CASB and the public CASB communicate with each other using the HTTP protocol.

1, in the 3-tier CASB service system according to another embodiment of the present invention, when the user (or the external accessor 600) uses the CASB service with his or her computer, Checks whether there is an HTTP header field for security setting policy synchronization, receives packet data in which metadata is inserted in the public CASB 300, checks the metadata to check the security policy of the private CASB, The public CASB security policy is reflected on the basis of the security policy information set by the CASB and the HTTP packet data for the acknowledgment indicating that the changed security policy is normally received is transmitted to the private CASB in response to the security policy reception. 2, when the CASB 200 accesses the private CASB and changes the security policy in the private CASB, if the security policy is changed, the private CASB 200 transmits the security policy metadata Transmits the HTTP packet data in which the metadata is inserted to the public CASB, receives the HTTP packet data for the acknowledgment, and outputs the security policy version information received from the public CASB to the public CASB with the version information of the security policy set in the private CASB If the version information is newer, the security policy of the public CASB is modified and reflected according to the security setting policy of the public CASB.

1, the public CASB that performs security policy synchronization according to another embodiment of the present invention receives cloud packet data and extracts security policy information metadata included in the HTTP header field of the received cloud packet data An analysis means for analyzing the security policy information; A version checking unit that determines whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB; Policy change means for changing the security policy of the public CASB to the version of the received private CASB security policy when the latest version is determined; A response unit for confirming whether or not the security policy of the public CASB has been changed, and transmitting HTTP packet data for responding to the private CASB that the public CASB security policy has been changed when the security policy is changed; And transmission means for transmitting the received cloud packet data according to the security policy established when it is determined that the security policy is not changed or that the security policy is not changed.

The security policy synchronization method of a 3-tier CASB service system according to an embodiment of the present invention is a method of security policy synchronization of a 3-tier CASB service system by inserting policy related metadata into an HTTP header when a security policy is set in a private CASB or a public CASB, Receiving a security policy received by the public CASB; A security policy checking step of receiving packet data from the public CASB and confirming the security policy of the private CASB by checking the policy related metadata inserted in the HTTP header of the packet data; A response step of transmitting, to the private CASB, confirmation packet data indicating that the security policy has been normally received in response to the confirmed private CASB security policy; And the private CASB compares the security policy version information included in the confirmation packet data received from the public CASB with the version information of the security policy set in the private CASB, and when the version of the security setting policy of the public CASB is the latest version, And a policy resetting step of modifying and reflecting the security policy according to the security setting policy given to the version information of the version information.

A CASB security policy synchronization method in a 3-tier CASB service system according to an embodiment of the present invention will be described in detail below.

In the first step, when a security policy is set in a private CASB or a public CASB in a 3-tier CASB service system, policy-related metadata is inserted into an HTTP header and then HTTP packet data is sent to a network (e.g., the Internet) Allow the CASB to receive. Policy related metadata may include security policy version information (e.g., 1.0.0.13), security policy setting methods (e.g., RBAC), or callback addresses (https://abc.com/url/callback).

In the second step, the public CASB receives the packet data and verifies the policy related metadata inserted in the HTTP header of the packet data, thereby confirming the security policy of the private CASB.

In the third step, in response to the security policy of the private CASB, it transmits confirmation packet data informing the private CASB that the changed security policy has been normally received. At this time, information on the identity indicating whether the security policy set in the public CASB is the same as the received private CASB security policy and version information of the security setting policy are included in the confirmation packet data and are transmitted to the private CASB.

In the fourth step, in the private CASB, the security policy version information included in the confirmation packet data received from the public CASB is compared with the version information of the security policy set in the private CASB, and the version of the security setting policy of the public CASB is updated High version), it reflects and reflects its own security policy according to the security setting policy assigned to the latest version information. In this way, the same CASB and public CASB can be operated at the same time, and the same security policy can be set and services can be provided.

FIG. 2 illustrates a method of synchronizing HTTP communication-based CASB security policy in a 3-tile CASB service system according to an embodiment of the present invention. In the HTTP communication-based CASB security policy synchronization method of the present invention, when the user (or the external accessor 600) uses the CASB service with his or her computer, the public CASB checks whether or not an HTTP header field for synchronization of the security setting policy exists A synchronization field validation step; A security policy changing step of setting a CASB operator to access the private CASB and change the security policy in the private CASB; When the security policy is changed, the private CASB inserts the security policy related metadata in the HTTP header, and transmits the HTTP packet data in which the metadata is inserted to the public CASB. A security policy checking step of receiving packet data in which the metadata is inserted in the public CASB and verifying the security policy of the private CASB by checking the metadata; And the public CASB security policy based on the information on the security policy set by the private CASB and transmits the HTTP packet data for the acknowledgment indicating that the security policy received to the private CASB is normally received in response to the security policy reception And a response step.

As shown in FIG. 2, the CASB security policy synchronization method according to the present invention performs security policy synchronization based on metadata communication. The communication-based security policy synchronization method of the 3-tier CASB service system shown in FIG. 2 is applied to the private CASB 200 and the public CASB 300, and the detailed procedure is as follows.

In operation S10, when the user first uses the CASB service 400 with his / her computer (PC, mobile phone, smart phone, portable device, etc.), the public CASB checks whether or not an HTTP header field for security setting policy synchronization exists . Security setting policy If the HTTP header field for synchronization exists, the public CASB checks the version information of the security policy.

In step S20, the CASB operator 600 accesses the private CASB 200 and sets the security policy in the private CASB to change. In operation S30, the private CASB generates security policy metadata. In operation S40, the private CASB inserts the security policy related metadata generated in the HTTP header, and then transmits the HTTP packet data including the inserted metadata to the public CASB. In operation S50, the public CASB receives the packet data including the inserted metadata, and verifies the security policy of the private CASB by checking the metadata. The checking process includes checking the version information of the security policy. Here, the packet data may be cloud packet data.

In step S60, when the metadata-based security policy setting HTTP header information included in the packet data transmitted from the private CASB is received from the public CASB, the security policy version information is compared with the security policy version information set in the public CASB, Analysis of policy recognition. In operation S70, if the security policy is the latest version, the public CASB security policy is corrected and reflected based on the security policy information set by the private CASB. In step S80, in response to the reception of the security policy, the server transmits to the private CASB the HTTP packet data for the acknowledgment indicating that the changed security policy has been normally received. At this time, the security policy set in the public CASB transmits the information about the identity of the received private CASB security policy and the version information of the security setting policy together to the private CASB.

In step S90, the private CASB compares the security policy version information received from the public CASB with the version information of the security policy set in the private CASB, and reflects the security policy according to the security setting policy assigned to the latest version information.

FIG. 3 illustrates a method of synchronizing HTTP communication-based public CASB security policies in a 3-tier CASB service system. In the security policy synchronization method in the public CASB according to another embodiment of the present invention, the public CASB receives the cloud packet data, extracts the security policy information metadata included in the HTTP header field of the received cloud packet data, An analysis step for analyzing information; A version checking step of determining whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB; A policy changing step of changing the security policy of the public CASB to the version of the received private CASB security policy if the latest version is determined; A response step of checking whether the security policy of the public CASB has been changed, and transmitting the HTTP packet data for responding to the private CASB that the public CASB security policy has been changed when the security policy is changed; And a transmission step of transmitting the received cloud packet data according to a security policy established when it is determined that the security policy is not changed or that the security policy is not changed.

The public CASB security policy synchronization method of the HTTP communication-based security policy in the 3-tier CASB service system of FIG. 3 will be described in more detail below.

As shown in FIG. 3, in operation S100, the public CASB receives cloud packet data. The packet data is transmitted by the HTTP communication method. In operation S200, security policy information included in the HTTP header field of the received cloud packet data is extracted to analyze the security policy information.

In operation S300, it is determined whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB.

In step S400, if it is determined in step S300 that the current version is the latest version, the security policy of the public CASB is modified and changed to the version of the received private CASB security policy.

In step S500, it is determined whether or not the security policy of the public CASB is changed.

In step S600, when the security policy is changed, HTTP packet data for responding to the private CASB is transmitted indicating that the public CASB security policy has been changed.

In step S700, if it is determined in step S300 that the current version is not the latest version, the received cloud packet data is transmitted according to the established security policy. If it is determined in step S500 that the security policy has not been changed, the received cloud packet data is transmitted according to the security policy established in the previous step.

Table 1 shows the HTTP header fields for CASB security policy synchronization. Table 1 shows the HTTP header fields applied to the security policy setting metadata generation.

HTTP header field for CASB security policy synchronization Header field Explanation example X-CASB-CFG-VER CASB security policy setting information version X-CASB-CFG-VER: 1.0.0.13 X-CASB-CFG-POLICY CASB security policy setting method X-CASB-CFG-POLICY: RBAC X-CASB-CFG-CALLBACK CASB Security Policy Settings Callback Address X-CASB-CFG-CALLBACK: https://abc.com/url/callback

Meanwhile, the security policy synchronization method according to an exemplary embodiment of the present invention may be implemented in the form of a program command that can be executed through a variety of means for processing information electronically and recorded in a storage medium. The storage medium may include program instructions, data files, data structures, and the like, alone or in combination.

Program instructions to be recorded on the storage medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software. Examples of storage media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, magneto-optical media and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as devices for processing information electronically using an interpreter, for example, a high-level language code that can be executed by a computer

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (17)

A security policy synchronization method for a 3-tier CASB service system that simultaneously operates a public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
Setting a security policy in the private CASB, inserting policy related metadata in the HTTP header, transmitting the HTTP packet data to the network, receiving the security policy received by the public CASB;
A security policy checking step of receiving the HTTP packet data in the public CASB and confirming the policy related metadata of the private CASB inserted in the HTTP header of the HTTP packet data to confirm the security policy set in the private CASB;
An acknowledgment step of transmitting acknowledgment packet data to the private CASB informing that the security policy has been normally received in response to the confirmed security policy of the private CASB in the puble CASB; And
Comparing the version information of the security policy of the public CASB included in the confirmation packet data received from the public CASB with the version information of the set security policy in the private CASB and comparing the version information of the security policy of the public CASB with the version information of the security policy of the public CASB A policy resetting step of modifying and reflecting the security policy according to the security setting policy given to the latest version information;
/ RTI >
The confirmation packet data of the response step
Wherein the information about the identity of the security policy set in the public CASB and the security policy of the private CASB are identical to each other and information about the security policy set in the public CASB is transmitted. Way.
The method according to claim 1,
Wherein the policy related metadata includes at least one of a security policy version information, a security policy setting method, and a callback address.
delete A 3-tier CASB security policy synchronization method for simultaneously operating an HTTP communication-based public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
If the user uses the 3-tier CASB service as his / her computer, the public CASB checks whether a HTTP header field for security setting policy synchronization exists or not;
A security policy changing step of the CASB operator accessing the private CASB and changing the security policy in the private CASB;
When the security policy is changed, the private CASB inserts the security policy related metadata in the HTTP header, and transmits the HTTP packet data in which the metadata is inserted to the public CASB.
A security policy checking step of receiving packet data in which meta data is inserted in the public CASB, checking the metadata and confirming the changed security policy of the private CASB; And
The security policy of the public CASB is corrected based on the information about the security policy set by the private CASB and the HTTP packet data for the acknowledgment indicating that the security policy received to the private CASB is normally received in response to the security policy reception A response step of transmitting;
The method comprising the steps of:
5. The method of claim 4,
The security policy checking step
Based security policy setting HTTP header information contained in the packet data transmitted from the private CASB is compared with the security policy version information set in the public CASB when the public CASB receives the HTTP header information, How to synchronize security policies. 5. The method of claim 4,
Wherein the response message includes information about the identity of the security policy set in the public CASB and the received private CASB security policy and version information of the security setting policy together with the private CASB.
5. The method of claim 4,
When the private CASB receives the HTTP packet data for the acknowledgment and compares the security policy version information received from the public CASB with the version information of the security policy set in the private CASB, The method further comprises a step of resetting the security policy to reflect the security policy of the security policy according to the security policy.
A security policy synchronization method in a public CASB included in a 3-tier CASB that simultaneously operates a public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
An analysis step of receiving the cloud packet data by the public CASB and extracting the security policy information metadata included in the HTTP header field of the received cloud packet data to analyze the security policy information;
A version checking step of determining whether the version information of the analyzed security policy information is newer than the version information of the security policy of the existing public CASB;
A policy changing step of changing the security policy of the public CASB to the version of the received private CASB security policy if the latest version is determined;
A response step of confirming whether or not the security policy of the public CASB has been changed, and transmitting HTTP packet data for responding to the private CASB that the security policy of the public CASB has been changed when the security policy is changed; And
A transmission step of transmitting received cloud packet data according to a security policy established when it is determined that the security policy is not the latest version or that the security policy is not changed;
The method comprising the steps of:
A computer-readable recording medium having recorded thereon a program for executing the method according to any one of claims 1, 2, and 4 to 8.
In a 3-tier CASB service system that simultaneously operates a public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
The 3-tier CASB service system
When the security policy is set, the security policy related metadata is inserted into the HTTP header, and the HTTP packet data is transmitted to the network to be received by the public CASB, the confirmation packet data is received from the public CASB, and the public CASB Compares the version information of the set security policy with the version information of the security policy set in the private CASB, and when the version of the security policy of the public CASB is newer, A private CASB that modifies and reflects the policy; And
Receives the packet data, checks the security policy metadata inserted in the HTTP header of the packet data to check the security policy of the private CASB, and informs that the security policy is normally received in response to the security policy of the private CASB A public CASB for transmitting acknowledgment packet data to the private CASB;
And,
The public CASB
Information on the identity indicating whether the security policy set in the public CASB is identical to the security policy of the received private CASB and the version information of the security policy set in the public CASB are included in the confirmation packet data. 3-tier CASB service system.
11. The method of claim 10,
The security policy related metadata
A security policy version information, a security policy setting method, or a callback address.
delete In a 3-tier CASB service system that simultaneously operates a public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
The 3-tier CASB service system
When the user uses the 3-tier CASB service with his or her computer, it checks whether there is an HTTP header field for security setting policy synchronization, receives the packet data in which the metadata is inserted in the public CASB, Checks the security policy of the private CASB, reflects the security policy of the public CASB based on the security policy information set by the private CASB, and receives the security policy changed to the private CASB in response to the security policy reception normally A public CASB for transmitting HTTP packet data for an acknowledgment notifying of an acknowledgment; And
When the CASB operator accesses the private CASB and changes the security policy of the private CASB, if the security policy is changed, the security policy related metadata is inserted in the HTTP header, and the HTTP packet data in which the metadata is inserted is transmitted to the public CASB Private CASB;
And,
The public CASB
Information on identity indicating whether the security policy set in the public CASB is identical to the security policy of the received private CASB and version information of the security policy set in the public CASB are included in the HTTP packet data for the acknowledgment,
The private CASB
A security policy setting unit configured to receive the HTTP packet data for the acknowledgment, compare the version information of the security policy set in the public CASB received from the public CASB with the version information of the security policy set in the private CASB, The security policy of the 3-tier CASB service system according to the security setting policy assigned to the version information of the security policy set in the public CASB when the version information of the public CASB is the latest version information. .
14. The method of claim 13,
The public CASB
Based security policy setting HTTP header information contained in the packet data transmitted from the private CASB is compared with the security policy version information set in the public CASB when the public CASB receives the HTTP header information, 3-tier CASB service system.
delete delete In a public CASB that performs security policy synchronization by being included in a 3-tier CASB that simultaneously operates a public cloud service and a private cloud service,
The public cloud service is secured by grasping the access right of the user of the public cloud service through the public access service broker (CASB) located between the public cloud service user and the public cloud service system,
The private cloud service can be provided only by an authenticated user, and is secured according to a predetermined security policy through a private CASB,
The public CASB
Analyzing means for receiving the cloud packet data of the private CASB and extracting the security policy information metadata of the private CASB included in the HTTP header field of the received cloud packet data to analyze the security policy information;
Version checking means for determining whether the version information of the security policy set in the private CASB among the analyzed security policy information is newer than the version information of the security policy of the existing public CASB;
Policy changing means for changing the security policy of the public CASB to the version of the security policy set in the received private CASB when it is determined that the security policy is the latest version;
Response means for transmitting HTTP packet data for responding to the private CASB that the security policy set in the public CASB is changed when the security policy is changed; And
Transmitting means for transmitting the received cloud packet data according to a security policy established when it is judged that the security policy is not the latest version or that the security policy is not changed;
And a public CASB for performing security policy synchronization.

Images