KR102007913B1 - System and method for controlling network at software defined perimeters based on endpoint group label - Google Patents

Abstract

The present invention proposes a network control method and system in an endpoint group label-based software defined boundary. Provided are a method and system for controlling network resources at an endpoint group label-based software defined boundary, in a network resource control system at a software defined boundary based on a group label, comprising: a platform recognition unit for allocating group labels, which are identifiers for classifying endpoints on the network, according to preset conditions, to the endpoints detected in the network; a policy setting unit for setting a policy for the endpoint based on a group label of the endpoint; and an access control unit for performing at least one of resource allocation and control of the network to the endpoint according to the determined policy.

Description

TECHNICAL AND METHOD FOR CONTROLLING NETWORK AT SOFTWARE DEFINED PERIMETERS BASED ON ENDPOINT GROUP LABEL}

Embodiments disclosed herein relate to a method and system for controlling network resources at an endpoint group label based software defined boundary, and more particularly to assigning a group label for an endpoint and assigning the assigned group. A network control method and system for resource allocation and control of a network for an endpoint based on a label.

Recently, various types of IT devices such as PCs, various servers, printers, and sensors have been developed, and these devices generally operate by connecting to a network.

The corporate environment using various IT devices connected to the network has brought convenience, but in terms of the network, it is possible to maintain the security of the network by identifying whether the IT devices connected to the network are safe and controlling access to the network.

However, due to the variety of types of IT devices that can access the network, it is difficult to identify the IT devices connected to the network, thereby degrading the security of the network.

In addition, there is a problem that a policy for resource allocation or control of the network must be individually set for each IT device connected to the network.

In the related art, Korean Patent No. 10-0226781, which relates to a node recognition method, relates to a node recognition method, and a newly added network interface card switches by transmitting information about itself and information indicating whether or not to receive data to a switching hub. Although a hub easily configures an information table and a plurality of network interface cards are added, a technology has been described in which a switching hub easily configures an information table to prevent an increase in data traffic. Identify devices and do not quickly assign network resources to identified IT devices.

Therefore, there is a need for a technique for solving the above problems.

On the other hand, the background art described above is technical information that the inventors possess for the derivation of the present invention or acquired in the derivation process of the present invention, and is not necessarily a publicly known technique disclosed to the general public before the application of the present invention. .

Embodiments disclosed herein are directed to presenting a network control method and system at an endpoint group label based software defined boundary.

Embodiments disclosed herein are aimed at presenting a network control method and system for identifying a device by obtaining information about an endpoint newly accessing the network as an endpoint.

Embodiments disclosed herein are intended to provide a network control method and system for learning a policy for an endpoint based on a policy corresponding to a group label.

Embodiments disclosed herein are aimed at presenting a network control method and system for setting a policy for allocating and controlling network resources for an identified endpoint.

As a technical means for achieving the above technical problem, according to an embodiment of the present invention, in a network resource control system at a software defined boundary based on a group label,

A platform recognition unit for assigning a group label, which is an identifier classifying an endpoint on the network, to an endpoint detected in the network according to a preset condition, and setting a policy for the endpoint based on the group label of the endpoint. The network controller may include an access control unit configured to perform at least one of resource allocation and control of the network to the endpoint according to a policy setting unit and the determined policy.

According to another embodiment, in a method of controlling a network resource at a software defined boundary based on a group label, the network controller detects a group label which is an identifier for classifying an endpoint on the network according to a predetermined condition. Assigning to a point, setting a policy for the endpoint based on the group label of the endpoint, and performing at least one of resource allocation and control of the network for the endpoint in accordance with the determined policy. It may include.

According to another embodiment, a computer-readable recording medium in which a program for performing a network control method is recorded, the group label being an identifier for classifying an endpoint on the network according to a predetermined condition, is assigned to an endpoint detected in the network. Assigning, setting a policy for the endpoint based on the group label of the endpoint, and performing at least one of resource allocation and control of the network for the endpoint in accordance with the determined policy. Can be.

According to another embodiment of the present invention, a computer program executed by a network control system and stored in a recording medium for performing a network control method, the group label being an identifier for classifying an endpoint on the network according to a predetermined condition, is generated in the network. Assigning to the detected endpoint, setting a policy for the endpoint based on the group label of the endpoint, and performing at least one of resource allocation and control of the network for the endpoint according to the determined policy It may include the step.

According to any one of the above-described problem solving means, it is possible to provide a network control method and system capable of quickly identifying an endpoint, which is a device that accesses a network using a group label.

According to any one of the aforementioned problem solving means, it is possible to provide a network control method and system for learning a policy for an endpoint based on a policy corresponding to a group label.

According to any one of the foregoing problem solving means, it is possible to provide a network resource control method and system for automatically setting a policy for allocating and controlling network resources for an identified device according to a group label assigned to an endpoint.

The effects obtainable in the disclosed embodiments are not limited to the effects mentioned above, and other effects not mentioned above are apparent to those skilled in the art to which the embodiments disclosed from the following description belong. Can be understood.

1 is a network diagram illustrating a network control system according to an exemplary embodiment.
2 is a block diagram of a network control system according to an embodiment.
3 is a flowchart illustrating a network control method according to an embodiment.

Hereinafter, various embodiments will be described in detail with reference to the accompanying drawings. The embodiments described below may be embodied in various different forms. In order to more clearly describe the features of the embodiments, detailed descriptions of the matters well known to those skilled in the art to which the following embodiments belong are omitted. In the drawings, parts irrelevant to the description of the embodiments are omitted, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a configuration is "connected" to another configuration, this includes not only 'directly connected' but also 'connected' between different configurations. In addition, when a configuration "includes" a certain configuration, this means that, unless specifically stated otherwise, it may further include other configurations other than the other configuration.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings.

However, before describing this, the meanings of the terms used below are first defined.

Hereinafter, the 'endpoint' is a node connected through a virtual network or a wireless communication network, a local area network (LAN), etc., for example, PC, mobile, server, network equipment, wireless access equipment, routers, switches, security equipment, printers Or a cloud, such as a VOIP, a multifunction device, or the like.

 "Endpoint Detection Information" is information collected to identify a node's platform and includes SNMP response packets, MAC address response packets, HTTP pages, HTTPS pages, TELNET Banner messages, and NMAP scan information for SNMP queries.

"Individual Identification" means the SNMP OID, MAC address, SNMP Description, HTTP Top page, HTTPS Top page, TELNET Banner, Open Port, and NMAP OS of the endpoint. Individual identification items can be deleted, added, or edited and can be used to recognize new terminals with new operating systems or protocols.

1 is a diagram illustrating a configuration of a network N showing a network control system 100 according to an embodiment.

Referring to FIG. 1, the network control system 100 assigns a group label by identifying a plurality of detection sensors 10 and platforms of an endpoint E that detect an endpoint E that has accessed the network N. FIG. It may include a platform identification device 20 and the access control device 30 for assigning or controlling network resources by setting a policy on the network for the endpoint (E).

First, the detection sensor 10 may detect not only endpoints having legitimate access to the network, but also endpoints attempting illegal access, and the detection sensor 10 may detect a platform when a detection event of the endpoint E occurs. It may transmit to the identification device 20.

In addition, the platform identification device 20 stores the platform recognition program and platform identification information, and obtains individual identification items from the endpoint E through the detection sensor 10 and compares the platform identification information with the platform of the endpoint E. Can be identified and a group label can be created or assigned to the endpoint (E).

In addition, the access control device 30 may learn a policy for allocating or controlling network resources for the group label, and automatically sets a policy for the endpoint E based on the group label of the endpoint E. FIG. have.

The network control system 100 may be implemented as a computer that can be connected to a remote server through a network (N), or can be connected to other terminals and servers, and via a network directly or through another information processing device. It may be connected to or connected to another terminal. Here, the computer may include, for example, a laptop, a desktop, a laptop, etc. equipped with a web browser.

Meanwhile, the detection sensor 10, the platform recognition device 20, and the access control device 30 constituting the network control system 100 may be implemented as one system to which a physically separated server is connected, or one according to an embodiment. It can be implemented as a server of.

2 is a block diagram showing each configuration of a network control system 100 according to an embodiment. Referring to FIG. 2, the network control system 100 according to an embodiment may include a platform recognition unit 110, a policy setting unit 120, and an access control unit 130.

First, the platform recognition unit 110 may assign a group label, which is an identifier for classifying the endpoint E on the network N, to the endpoint E detected in the network N, according to a preset condition.

First, the platform recognition unit 110 may detect the endpoint (E) connected to the network (N), and obtain the individual identification item information required for platform identification of the endpoint from the detected endpoint (E). have.

For example, the platform recognition unit 110 may detect the endpoint (E) requesting access to the network (N) through the detection sensor (10), SNMP from the detected endpoint (E) as an individual identification item OID, MAC address, SNMP Description, HTTP Top page, HTTPS Top page, TELNET Banner, Open Port, NMAP OS, etc. can be obtained.

The platform recognition unit 110 may identify the platform of the endpoint E based on the individual identification item information of the endpoint E, and may assign a group label for the endpoint according to the identified platform. .

For example, the platform recognition unit 110 may identify the platform of the endpoint E by comparing the individual identification item information with the individual identification item information of the plurality of previously stored platform identification information, based on the extracted platform A group label, which is an identifier for classifying an endpoint E, may be assigned. In contrast, if identified as a new platform, the platform recognition unit 110 may generate and assign a new group label for the endpoint (E).

The policy setting unit 120 may set the policy of the endpoint E according to the policy corresponding to the group label of the endpoint E based on the group label of the endpoint E. FIG.

Prior to this, the policy setting unit 120 may learn the policy for the endpoint (E) through machine learning based on the individual identification item information of the endpoint (E) according to the embodiment.

For example, the policy setting unit 120 learns a predetermined policy according to the platform of the endpoint E using the supervised learning method, or is determined from at least one policy for the platform using the decision tree ensemble method. You can learn a single policy.

The policy setting unit 120 may store a policy corresponding to the group label of the endpoint E, and may update a previously stored policy.

For example, the policy setting unit 120 assigns the first to third levels of access rights of the first to fourth levels to the first group label assigned to the endpoint E having the Linux platform. You can match and save the policy you assign.

Alternatively, for example, the policy setting unit 120 grants access rights of the first to third levels, which are pre-stored policies, to the first group label as the security of the endpoint E having the Linux platform is increased. The policy may be updated to a policy granting access rights of the first to fourth steps.

At this time, the policy is for the node policy, which is a policy for managing the node corresponding to the endpoint (E), the control policy, which is a policy for blocking or allowing access of the endpoint (E), and for the wireless information usage node using the wireless network. The policy may be configured of at least one policy of the WLAN policy.

These policies can be set to block access to all devices by default, but access can be set differently by platform, or set to allow access to all devices by default but block access by platform. Can be set.

The policy setting unit 120 may set a policy for the endpoint E based on the group label assigned to the endpoint E by the platform recognition unit 110.

For example, the policy setting unit 120 may identify the first group label assigned to the mobile terminal having the Linux platform, and set the policy of the endpoint E as a policy corresponding to the first group label. .

Thereafter, the access control unit 130 may allocate or control resource of the network for the endpoint E according to the determined policy.

For example, the access controller 130 controls the allocation of network resources to the endpoint E according to a policy set at the endpoint E through a sensor that is an access point of the network to which the endpoint E is connected. You can do that.

Meanwhile, the network control system 100 may further include a communication unit 140, and the communication unit 140 may perform wired or wireless communication with another device or a network. To this end, the communication unit 140 may include a communication module supporting at least one of various wired and wireless communication methods. For example, the communication module may be implemented in the form of a chipset.

Wireless communication supported by the communication unit 140 may be, for example, Wi-Fi (Wireless Fidelity), Wi-Fi Direct, Bluetooth, UWB (Ultra Wide Band), or NFC (Near Field Communication). In addition, the wired communication supported by the communication unit 140 may be, for example, USB or High Definition Multimedia Interface (HDMI).

3 is a flowchart illustrating a network control method according to an embodiment.

The network control method according to the embodiment shown in FIG. 3 includes steps processed in time series in the network control system 100 shown in FIG. 2. Therefore, even if omitted below, the above description of the network control system 100 shown in FIG. 2 may be applied to the network control method according to the embodiment shown in FIG. 3.

First, the network control system 100 may assign a group label, which is an identifier for classifying an endpoint E on the network, to an endpoint E detected in the network according to a preset condition (S3001).

To this end, the network control system 100 can detect the endpoint (E) connected to the network, and obtains individual identification item information necessary for platform identification of the endpoint (E) from the detected endpoint (E) The platform of endpoint E can be identified.

For example, the network control system 100 may store the individual identification item information corresponding to the at least one platform, and select the platform of the endpoint E based on the individual identification item information obtained from the endpoint E. FIG. Can be identified.

The network control system 100 may assign a group label for the endpoint E according to the identified platform.

For example, the network control system 100 may assign a group label for classifying the endpoint E for each platform, and if the group label is identified as a platform different from that of the endpoint E that is previously assigned. You can create and assign a group label to.

The network control system 100 may set a policy on the network for the endpoint E based on the group label of the endpoint E (S3002).

Prior to this, the network control system 100 may learn a policy corresponding to the endpoint E to which the group label is assigned based on the policy set for the group label.

For example, the network control system 100 may learn a predetermined policy for access authority to a network according to a platform corresponding to a group label.

And according to the embodiment, the network control system 100 may update the policy based on the learned policy for the endpoint (E).

For example, when a new policy is learned about the endpoint E assigned to the existing group label, the network control system 100 may update the previously stored policy matched with the existing group label to the newly learned policy. .

The network control system 100 may allow resource allocation or control of the network for the endpoint E according to the determined policy (S3003).

For example, the network control system 100 may set a policy corresponding to a group label assigned to the endpoint E according to the learning result, and through a sensor that is an access point of a network to which the endpoint E connects. The network resource allocation can be controlled according to the policy for the endpoint (E).

The term '~' used in the above embodiments refers to software or a hardware component such as a field programmable gate array (FPGA) or an ASIC, and '~' serves a part. However, '~' is not meant to be limited to software or hardware. '~ Portion' may be configured to be in an addressable storage medium or may be configured to play one or more processors. Thus, as an example, '~' means components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, procedures, and the like. Subroutines, segments of program patent code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables.

The functionality provided within the components and 'parts' may be combined into a smaller number of components and 'parts' or separated from additional components and 'parts'.

In addition, the components and '~' may be implemented to play one or more CPUs in the device or secure multimedia card.

The network control method according to the embodiment described with reference to FIG. 3 may also be implemented in the form of a computer readable medium for storing instructions and data executable by a computer. In this case, the command and data may be stored in the form of program code, and when executed by the processor, a predetermined program module may be generated to perform a predetermined operation. In addition, computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer readable medium may be a computer recording medium, which is volatile and non-implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Both volatile, removable and non-removable media may be included. For example, computer recording media may be provided via magnetic storage media such as HDDs and SSDs, optical recording media such as CDs, DVDs and Blu-ray discs, or via network access. It may be a memory included in the server.

In addition, the network control method according to the embodiment described with reference to FIG. 3 may be implemented as a computer program (or computer program product) including instructions executable by a computer. The computer program includes programmable machine instructions processed by the processor and may be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language. . The computer program may also be recorded on tangible computer readable media (eg, memory, hard disks, magnetic / optical media or solid-state drives, etc.).

Accordingly, the network control method according to the embodiment described with reference to FIG. 3 may be implemented by executing the computer program as described above by the computing device. The computing device may include at least a portion of a processor, a memory, a storage device, a high speed interface connected to the memory and a high speed expansion port, and a low speed interface connected to the low speed bus and the storage device. Each of these components are connected to each other using a variety of buses and may be mounted on a common motherboard or otherwise mounted in a suitable manner.

Here, the processor may process instructions within the computing device, such as to display graphical information for providing a graphical user interface (GUI) on an external input, output device, such as a display connected to a high speed interface. Instructions stored in memory or storage. In other embodiments, multiple processors and / or multiple buses may be used with appropriately multiple memories and memory types. The processor may also be implemented as a chipset consisting of chips comprising a plurality of independent analog and / or digital processors.

The memory also stores information within the computing device. In one example, the memory may consist of a volatile memory unit or a collection thereof. As another example, the memory may consist of a nonvolatile memory unit or a collection thereof. The memory may also be other forms of computer readable media, such as, for example, magnetic or optical disks.

In addition, the storage device can provide a large amount of storage space to the computing device. The storage device may be a computer readable medium or a configuration including such a medium, and may include, for example, devices or other configurations within a storage area network (SAN), and may include a floppy disk device, a hard disk device, an optical disk device, Or a tape device, flash memory, or similar other semiconductor memory device or device array.

The above-described embodiments are for illustrative purposes, and those of ordinary skill in the art to which the above-described embodiments belong may easily change to other specific forms without changing the technical spirit or essential features of the above-described embodiments. I can understand. Therefore, it is to be understood that the above-described embodiments are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope to be protected by the present specification is represented by the following claims rather than the above description, and should be construed to include all changes or modifications derived from the meaning and scope of the claims and their equivalents. .

100: network control system
10: detection sensor
20: platform identification device
30: access control device
110: platform recognition unit
120: policy setting
130: access control unit
140: communication unit

Claims (13)

A network control system for controlling network resources at a software defined boundary based on a group label,
A platform recognition unit for allocating group labels, the identifiers for classifying endpoints on the network, to endpoints detected in the network according to a preset condition;
A policy setting unit for setting a policy for the endpoint based on the group label of the endpoint; And
An access control unit configured to perform at least one of resource allocation and control of the network to the endpoint according to the determined policy;
The policy setting unit,
Learning policy for the endpoint based on the individual identification item information for the endpoint, and updating the policy for the group label of the endpoint based on the learned policy for the endpoint. The method of claim 1,
The platform recognition unit,
Detect the endpoint connected to the network, identify the platform of the endpoint by obtaining the individual identification item information necessary for platform identification of the endpoint from the detected endpoint, and for the endpoint according to the identified platform A network control system that assigns group labels. The method of claim 1,
The policy setting unit,
And storing a policy corresponding to each group label. delete delete The method of claim 1,
The access control unit,
And at least one of resource allocation and control of the network in accordance with the policy via a sensor that is an access point of the network to which the endpoint connects. A network control method in which a network control system controls network resources at a software defined boundary based on a group label,
Assigning a group label, which is an identifier for classifying an endpoint on the network, to an endpoint detected in the network according to a preset condition;
Determining a policy for the endpoint based on the group label of the endpoint; And
Performing at least one of resource allocation and control of the network for the endpoint in accordance with the determined policy;
The network control method,
Learning a policy for the endpoint based on the individual identification item information for the endpoint; And
Updating the policy for the group label of the endpoint based on the learned policy for the endpoint. The method of claim 7, wherein
Assigning the group label to an endpoint detected in the network,
Detecting an endpoint accessing the network;
Identifying the platform of the endpoint by obtaining individual identification information necessary for identifying the platform of the endpoint from the detected endpoint; And
Assigning a group label for the endpoint according to the identified platform. delete delete The method of claim 7, wherein
Performing at least one of resource allocation and control of the network for the endpoint according to the determined policy,
And performing at least one of resource allocation and control of the network according to the policy through a sensor which is an access point of the network to which the endpoint connects. A non-transitory computer-readable recording medium having recorded thereon a program for performing the method of claim 7. A computer program carried out by a network control system and stored in a computer-readable non-transitory recording medium for carrying out the method of claim 7.

Images