KR102020986B1 - Trust network system based block-chain - Google Patents

Abstract

The present invention relates to a blockchain-based trust network system capable of providing a trusted environment with secured reliability. According to the present invention, the blockchain-based trust network system comprises: a plurality of trust network devices comparing access information of an originator with a white/blacklist stored in a distributed ledger when receiving a traffic to determine connection or blockage, wherein the trust network devices determine the connection or the blockage through traffic analysis when the access information is not matched with the white/blacklist; and an infra support system determining a first agreement result of an agreement-joined trusted network device with respect to a fast diagnosis result (black or white) corresponding to the connection or the blockage by the traffic analysis and a second agreement result in accordance with an agreement determined by an expert and the agreement of the agreement-joined trusted network device. When receiving the first agreement result, the trusted network device records the first agreement result in the distributed ledger, and adds and records the second agreement result received later to the distributed ledger to update.

Description

Trust network system based block-chain}

A blockchain based trust network system.

More specifically, when the traffic inflow is compared to determine the connection or blocking by comparing the access information of the sender and the white / black list previously stored in the distributed ledger, if the access information does not match the white / black list, the connection or Consensus on a plurality of trust network devices that determine blocking and fast diagnosis results (white or black) corresponding to the connection or blocking by the traffic analysis. As a result of the first agreement of the trust network devices, whether to agree or not according to expert judgment And an infrastructure support system for determining a result of the second agreement according to whether or not the participant trust network device is agreed. The plurality of trust network devices, when receiving the first agreement result, are recorded in the distributed ledger, and then the second received Blockchain-based trust network, characterized in that the results of the agreement are further recorded and updated in the distributed ledger It relates to the system.

In recent years, the possession of computing devices such as personal fish is gradually increasing, and fish users perform most of their tasks through PCs from simple paper work to professional tasks required for work. In particular, the spread of wireless communication terminals such as smart phones and laptops is rapidly increasing, but the company's confidentiality or personal privacy is exposed by the wireless security network, which is relatively less secure than wired communication, and is used for crime. It is happening frequently.

In addition, the use of wireless communication terminals such as leaking important confidentiality or hacking into the corporate network by using wireless communication terminals that are not authorized by individuals or companies or public institutions, etc., wirelessly increases. Doing.

Technically, hacking, viruses, worms, trojans, phishing, pharming

Techniques for diagnosing or removing vulnerabilities from various threats, such as Pharming, have been developed. One such patent document is Korean Patent Registration No. 10-1637912 (hereinafter, Patent Document 1).

Patent Literature 1 prevents security accidents by detecting a wired / wireless router with DNS information tampered with based on white / blacklist based on IP information. However, although IP may be changed to black even if it is registered as white, Patent Literature 1 is difficult to determine whether the IP is white / black in real time, and a disguised list may be distributed when the list is hacked, resulting in low network reliability. There is a problem that you can not defend hacking and so on.

Accordingly, the present applicant intends to provide a blockchain-based trust network system that can fundamentally control the access of network fraudulent accessors by generating and managing white / blacklists of source information based on the blockchain.

Korean Patent Registration No. 10-1637912 (announced on July 20, 2016)

An object of the present invention is to store a white / black list in a distributed ledger of a member trust network device for determining whether to connect a trust network device, and to control connection connection and disconnection using the stored white / black list. It is to provide a blockchain-based trust network system that can provide a secured trust environment.

In addition, if the access information does not match the white / black list, the connection or blocking is determined through fast diagnosis and agreement, and recorded in the distributed ledger, and the distributed ledger is updated according to the final decision through log analysis and agreement. The present invention provides a blockchain-based trust network system that can provide a white / black list.

In the blockchain-based trust network system according to an embodiment of the present invention for achieving the above object, it is determined whether to connect or block by comparing the access information of the sender with the previously stored white / black list when traffic is introduced. If the connection information does not match the white / black list, a plurality of trust network devices that determine connection or blocking through traffic analysis and fast diagnosis results (white or black) corresponding to connection or blocking by the traffic analysis It may include an infrastructure support system for determining the result of the first agreement of the participating participant trust network device, whether the agreement according to expert judgment and the result of the second agreement according to the agreement of the participating participant trust network device.

The plurality of trust network apparatuses may be updated in the distributed ledger upon receiving the first agreement result, and thereafter additionally recording the received second agreement result in the distributed ledger.

In addition, the log analysis system for analyzing the log generated during the traffic analysis to determine whether the white / black of the unmatched access information and whether the white / black judged by the log analysis system received according to expert judgment It may further include an expert judgment system for determining whether to agree.

The infrastructure support system may assign and manage an ID to the trust network device, and transmit the first agreement result and the second agreement result only when the trust network device is assigned an ID.

The infrastructure support system may determine a predetermined number of trusted network devices as a consensus participating trust network device by prioritizing the number of connected access terminals or the inflow traffic amount among the plurality of trusted network devices.

In addition, when receiving the quick diagnosis result, the infrastructure support system transmits a result of the agreement request packet to the agreement participating trust network device, and the result of the first agreement indicates that the total agreement ratio according to the agreement determination result received is greater than the standard agreement rate. Can be determined.

In addition, the respective ratios of the expert judgment system and the consensus participating trust network device are set, respectively, and upon receiving an agreement from the expert judgment system according to the expert judgment, the ratio of the total consensus of the expert judgment system and the consensus participating trust network device is based. The result (white or black) larger than the agreed rate can be determined as the result of the second sum.

In addition, the consensus participation trust network device may determine the white or black through traffic analysis when receiving the agreement request packet required for the agreement determination and respond to the infrastructure support system.

The access information may be a source IP, a Mac address and a destination IP, a destination service port, and a trust network device ID connected to the corresponding trust network device, and the log analysis system may access the connection from a log generated during the traffic analysis. A server that extracts information and quick diagnosis results, and judges white or black through a plurality of linked online IP real-time analysis systems, and the linked online IP real-time analysis system collects IPs on a network to determine whether they are harmful or not. Can be

The agreement request packet may be an IP address and a Mac address of a destination, an IP address and a service port of a destination, and the white / blacklist may include a flag distinguishing whether the access information is white or black.

The blockchain-based trust network system according to an embodiment of the present invention creates and updates a white / black list based on the blockchain to determine the connection / disconnection of the trust network device, and distributes and stores them in the authenticated member trust network device. This can be used to control the connection and disconnection of the trust network device.

Thus, the white / black list stored in the blockchain-based distributed ledger can not provide hacking and modifying arbitrary information to provide a secure environment with security, and it can reduce costs in terms of decentralized system construction.

In addition, if the access information of the traffic inflow destination does not match the white / black list, the connection or blocking is determined through a quick diagnosis (traffic analysis), and the log generated from the quick diagnosis is analyzed to determine whether it is white or black. It can increase the reliability.

In addition, the distributed ledger is verified by verifying the white / black status determined through quick diagnosis and log analysis through the consensus process, and transmitting the verified final result (white / black status for the connection information to be diagnosed) only to the member trust network device. Updates can be made by adding to the pre-stored white / black list. Thus, trusted trust network devices maintain distributed ledgers where the same white / black list is stored.

In addition, reliability can be improved by adjusting the weight of consensus (voting rate) and the standard consensus rate of the expert judgment system.

1 is a view for explaining a schematic configuration of a blockchain-based trust network system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing the configuration of the trust network apparatus of FIG.
3 is a block diagram showing the configuration of the infrastructure support system of FIG.

The terms or words used in this specification and claims are not to be construed as limiting in their usual or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent all of the technical idea of the present invention, various equivalents that may be substituted for them at the time of the present application It should be understood that there may be water and variations.

Before describing the present invention with reference to the drawings, it is not shown or specifically described for the matters that are not necessary to reveal the gist of the present invention, that is, those skilled in the art can obviously add. Make a note.

1 is a view for explaining a schematic configuration of a blockchain-based trust network system according to an embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of the trust network apparatus of FIG. 3 is a block diagram showing the configuration of the infrastructure support system of FIG.

In a blockchain-based trust network system according to an embodiment of the present invention, a blockchain-based distributed ledger (harmfulness (white / black) information of an incoming traffic transmission source) is distributed to each trust network device (100: 100a, 100b). By storing and managing, you can provide enhanced security and reliable network environment. Here, the trust network apparatus 100 may be configured in the form of a trust embedded device 100b and a trust external device 100a.

Referring to FIG. 1, a blockchain-based trust network system may include a plurality of trust network devices 100: 100a and 100b, a log analysis system 200, an expert judgment system 300, and an infrastructure support system 400. Can be.

Here, the trust network apparatus 100 may have an additional function for providing a trusted network environment according to an embodiment of the present invention, in addition to the conventional network network function. Accordingly, the trust network device 100 is coupled to the trust embedded device 100b or the conventional network network device 10 according to an embodiment of the present invention having an integrated function (normal network network function and additional functions). And may be provided in the form of a trust enclosure 100a that can provide additional functions.

In this case, the network apparatus may include an access point (AP), a gateway, a node B, a radio network controller (RNC), an enode B, a base station controller (BSC), a base transceiver station (BTS), a base station (BS), and a transceiver function (TF). ), May include, or be implemented as a Wi-Fi router, radio transceiver, or some other terminology.

Referring to FIG. 2, the trust network apparatus 100a or 100b includes a white / blacklist 110, a connection determination unit 120, a quick diagnosis unit 130, a log transmission unit 140, and an agreement unit 150. can do.

When the trust network apparatus 100a or 100b is registered through the member manager 310 of the infrastructure support system 400, the trust network apparatus 100a or 100b may be given an ID. The trust network apparatuses 100a and 100b given the ID may store a white black list that is generated and updated based on the block chain.

The white / black list 110 generates the first agreement result determined through the first agreement process as a new block and first records the result, and the second agreement result determined through the second agreement process is the final result. Can be updated and recorded.

Here, the first agreement process transmits the quick diagnosis result (black or white decision) that is quickly diagnosed through traffic analysis in the quick diagnosis unit 130 to the infrastructure support system 400, and the fast diagnosis in the infrastructure support system 400. Upon receipt of the result, the agreement request packet is transmitted to the agreement participating trust network devices 100a and 100b to receive the agreement of each of the participating trust network devices, and the result of the agreement is calculated as a result of the first agreement. Can be a process of transmitting to.

Here, the agreement request packet may be packet data including an IP address and a MAC address of a destination (remote destination), an IP address and a service port of a destination.

In addition, the second agreement process transmits the quick diagnosis log generated during the traffic analysis of the quick diagnosis unit 130 in the log transmission unit 140 to the log analysis system 200, and the big data analysis in the log analysis system 200. The white or black is judged through the judges to transmit the results of the judging to the expert judgment system 400, the expert judgment system 300 determines whether to agree on the basis of expert judgment and transmits to the infrastructure support system 400, Upon receiving the agreement of the expert judgment system 300 from the support system 400, the agreement request packet is transmitted to the agreement participation trust network devices 100a and 100b to receive the agreement of each agreement participation trust network device, and use the same. It can be a process of transmitting the calculated second agreement result to the member trust network device as a final result.

In this case, the white / black list 110 is recorded in a blockchain manner, and when a block recording instruction (first agreement result and second agreement result) is received from the infrastructure support system 400, the white / black list 110 is previously stored in the distributed ledger. You can update the list by appending to the black list. Accordingly, the member trust network apparatus 100a or 100b may store the same white / blacklist 110.

Specifically, the white / blacklist 110 may store the whitelist and the blacklist separately, and the whitelist and the blacklist may be a destination IP address and a MAC address, a destination IP address and a service port, a trust network device ID, and a flag. Can be stored separately. Here, the flag is information distinguishing whether the connection information is white or black, and the trust network device ID may be an ID assigned to the member trust network devices 100a and 100b.

Accordingly, the connection determination unit 120 may connect the traffic inflow of the transmission destination classified as white and block the traffic inflow of the transmission destination classified as black according to the information of the white / black list 110 generated based on the reliability. have.

Here, the access information may further include an IP address and MAC address of the destination, an IP address and a service port of the destination, and a trust network device ID (an ID assigned to the member trust network devices 100a and 100b).

The connection determination unit 120 may compare the access information included in the corresponding packet header with the pre-stored white / black list 110 when determining the network connection or blocking. In this case, when the connection information of the destination is included in the white list, the network connection is controlled to receive the information according to the traffic flowing into the access terminal 20, and the network blocking is performed when the access information is included in the black list. Blocking control may be such that traffic is not provided to the terminal 20.

The connection determination unit 120 determines connection or blocking by using the last updated white / black list 110 based on the traffic inflow time, and may be performed for each network connection device 100a and 100b.

In addition, the connection determination unit 120 may determine the amount of incoming traffic and the number of access terminals at a predetermined cycle and transmit the same to the infrastructure support system 400.

On the other hand, if the access information of the incoming traffic does not match the white / black list, that is, if not included through the traffic analysis (fast diagnosis) of the quick diagnosis unit 130 to determine the connection or blocking (hereinafter, referred to as a quick diagnosis result Can be done).

The quick diagnosis unit 130 may analyze the traffic introduced according to a predetermined algorithm and block network connection of the corresponding destination when an abnormal pattern occurs, such as when detecting abnormal data and detecting an inflow of try traffic.

For example, when detecting a SYN flooding attack, nmap port scanning, SSH authentication attempt, etc., a quick diagnosis result may be determined in black.

The quick diagnosis unit 130 transmits a quick diagnosis result (black or white determined by the quick diagnosis of the quick diagnosis unit 130) to the infrastructure support system 400, and the fast diagnosis agreement process of the infrastructure support system 400 ( That is, the white / black list 110 may be additionally recorded in the distributed ledger by the quick diagnosis result (black or white) received through the first agreement process.

The log transmitter 140 may transmit the logs (system log, quality log, diagnostic log, health check log, and event log, etc.) generated in the trust network device 100a or 100b to the log analysis system 200 at predetermined intervals. have.

In particular, the log transmitter 140 may transmit a log (fast diagnostic diagram) generated during the traffic analysis of the quick diagnosis unit 130 to the log analysis system 200.

The agreement unit 150 operates only when an agreement request packet is received from the infrastructure support system 400. The trust network devices 100a and 100b are adopted as the agreement participating trust network devices to determine white or black information on access information. It is driven when the agreement is required for, and controls the quick diagnosis unit 130 to diagnose whether the requested connection information is white or black using the received agreement request packet, and the diagnostic result of the quick diagnosis unit 130 As a result of agreement or not, it may be transmitted to the infrastructure support system 400.

Meanwhile, the agreement unit 150 may receive a first agreement result, which is the result of the agreement according to the first agreement of the participating trust network devices, from the infrastructure support system 400, and stores the received first agreement result in white / black. The list 110 may be continuously recorded in the distributed ledger.

Subsequently, when the consensus unit 150 receives the final result, which is the result of the second agreement according to the second agreement of the participating network of the participating trust network, from the infrastructure support system 400, the consensus unit 150 records the result of the second agreement (final result) in the distributed ledger. can do.

At this time, the member trust network device (100a, 100b) in the infrastructure support system 400 can be updated to the same white / black list 110 in the distributed ledger. Therefore, hacking and random information modification of the white / black list stored in the blockchain-based distributed ledger are impossible, thereby enhancing security. In particular, it is possible to further increase the reliability by transmitting the agreement result only to the member trust network device.

The log analysis system 200 may perform big data analysis by receiving logs from the plurality of trust network devices 100a and 100b. At this time, the log analysis system 200 predicts a failure / failure by using logs (system log, quality log, diagnostic log, health check log, event log, etc.) received at a predetermined cycle, and supports infrastructure when predicting a failure / failure. The trust network device information may be transmitted to the system 400, and the trust network device may be excluded when the agreement is selected.

In addition, the log analysis system 200 determines the white or black determination result of the quick diagnosis unit 130 for the connection information of the source and the destination traffic from the quick diagnosis log generated during the traffic analysis of the quick diagnosis unit 130 (quick diagnosis). Result) can be extracted.

Using this, the log analysis system 200 may analyze whether the connection information of the corresponding destination is black or white through a plurality of on-line IP real-time analysis systems linked thereto. Here, the online IP real-time analysis system may be a service server that collects the IP on the network (Internet) and determines whether the collected IP is harmful.

The log analysis system 200 may re-determine the white or black determination result (fast diagnosis result) of the quick diagnosis unit 130 and transmit the judgment result to the infrastructure support system 400.

 At this time, the log analysis system 200 judges the result (harm or non-harm) that the IP harmfulness (result of whether the connection information of the sender is black or white) received from a plurality of on-line IP real-time minute systems is equal to or greater than a preset ratio. It can be determined to be a black (hazardous black, non-hazardous white), and transmitted to the expert judgment system 300.

In addition to the external IP analysis (analysis through the online IP real-time analysis system), it is also possible to determine the judging result by combining the collected and analyzed IP harmfulness.

The expert judgment system 300 is a highly reliable server participating in the consensus process, and may receive an expert judgment. The expert judgment system 300 may receive and provide a result of the judging of the log analysis system 200, and transmit the expert final judgment thereof to the infrastructure support system 400.

The infrastructure support system 400 may request to record the agreed first agreement result in the distributed ledger of the member trust network device by performing the first agreement process upon receiving the quick diagnosis result from the fast diagnosis unit 130. When the support system 400 receives a decision on whether or not to agree on the result of the judgment from the expert judgment system 300, the support system 400 performs a second agreement process through the consensus participation trust network device to perform the second agreement process in the member trust network devices 100a and 100b. Combined with the result of the first agreement, it is possible to update to the result of the second agreement finally decided.

Referring to FIG. 3, the infrastructure support system 400 may include a member management unit 310, an agreement participation selection unit 320, and an agreement request and determination unit 330. The infrastructure support system 400 allows the access information to be updated in the white / blacklist 110 through the agreement upon receiving a decision (white or black) on the result of the judgment from the expert judgment system 300. . At this time, the infrastructure support system 400 may control to be updated only in the member trust network device (100a, 100b).

The member manager 310 may assign IDs (via authentication) of the trust network apparatuses 100a and 100b and register them as members, and manage the trust network apparatuses 100a and 100b using the assigned IDs.

Meanwhile, the infrastructure support system 400 may transmit an instruction only to the registered trust network apparatuses 100a and 100b by performing authentication through the member manager 310.

The agreement participation selecting unit 320 classifies the traffic amount and the number of access terminals received from the trust network apparatuses 100a and 100b in a predetermined cycle by the trust network apparatus ID, and prioritizes the received traffic amount and the number of access terminals. A predetermined number of trust network devices 100a and 100b may be selected as a consensus participating trust network device.

For example, a plurality of terminals may be connected to a reliable trust network device, which may generate a large amount of traffic. When there are 100 member trust network devices 100a and 100b, the traffic amount and the number of access terminals are received from 100 trust network devices at predetermined intervals, and 20 trusts (preset number (rate)) are based on priority. The network devices 100a and 100b may be selected as a consensus participating trust network device.

In this case, in addition to the member trust network apparatuses 100a and 100b, the expert judgment system 300 for verifying the determination result may be configured to participate in the second consensus process regardless of the traffic amount and the number of access terminals.

The agreement request and decision unit 330 transmits an agreement request packet to an agreement participating trust network device to perform a first agreement or a second agreement according to the received data (quick diagnosis result or judicial result). The result can be received.

The agreement request and decision unit 330 may calculate an agreement result using the agreement determination result received from the agreement participating trust network devices. Here, the first agreement may be performed by the selected consensus participating trust network device (for example, 20 out of 100), and the second agreement may be performed by the infrastructure support system 300 in addition to the selected consensus participating trust network device. Can participate

At this time, the agreement request and decision unit 330 may set the weight ratio (consensus voting rights ratio) and the standard agreement rate of the expert judgment system 300, and may calculate the agreement result according to the agreement policy.

Here, the standard agreement rate is a ratio for determining the agreement. For example, if the result of the agreement decision of the participating network is 20% black and 80% white, the standard agreement rate is 60%. White (greater than 60%) can be decided as a result of the settlement.

In addition, the weight ratio of the expert judgment system 300 is the percentage of voting rights in the agreement. For example, if the weight ratio of the expert judgment system 300 is 80%, the weight ratio of the trust network apparatus participating in the agreement may be 20%. . Thus, if there are 20 consensus participating trust network devices, each consensus participating trust network device has a 1% consensus share.

As a result, the infrastructure support system 400 may determine that the result of the black and white according to the weight of each agreement is greater than or equal to the reference agreement rate as the agreement result at the time of the second agreement.

At this time, the overall agreement ratio may depend on the ratio of the agreement of the expert judgment system 300 based on the reliability. Thus, the final result can have a high reliability.

The agreement request and decision unit 330 may transmit the final result to the member trust network device.

On the other hand, the consensus participation selection unit 320 applies a + weighting value to the trust network device that has made a determination corresponding to the result of the second agreement among the consensus participating trust network devices, thereby applying a high reputation to the trust network device to give priority to the consensus selection process. Can provide. On the other hand, the consensus participant selection unit 320 may apply a -weight value to the trust network device that has made a judgment that does not correspond to the result of the second agreement among the consensus participating trust network devices, and may apply a low reputation and exclude it from the consensus selection selection. have. The more you participate in the agreement, the higher your reputation.

In addition, what was described above using FIGS. 1-3 is only the main matter of this invention, and as long as various designs are possible within the technical range, this invention is not limited to the structure of FIGS. Is self explanatory.

100: trust network device
100a: Trust external device 100b: Trust internal device
10: network device 20: access terminal
200: log analysis system 300: expert judgment system
400: Infrastructure Support System

Claims (8)

When inflow of traffic, the connection information of the sender is compared with the white / black list previously stored in the distributed ledger, and the connection or blocking is determined. If the connection information does not match the white / black list, the connection or blocking is determined through traffic analysis. A plurality of trust network devices;
As a result of the first agreement of the consensus participating trust network device for the fast diagnosis result corresponding to the connection or blocking by the traffic analysis, the result of the second agreement according to the agreement of the expert and the agreement of the participating trust network device. Infrastructure support system to determine;
A log analysis system for extracting the access information and the quick diagnosis result from the log generated during the traffic analysis, and judging white or black through a plurality of linked online IP real-time analysis systems; And
Receiving the white / black judged by the log analysis system includes an expert judgment system for determining whether to agree on the basis of expert judgment,
The infrastructure support system,
Upon receipt of the quick diagnosis result, the result of the first agreement determines that the total agreement ratio according to the agreement decision result received by transmitting the agreement request packet to the agreement participating trust network device is greater than the standard agreement rate as the result of the first agreement. Set the ratio of the agreement between the network and the participating trust network, and when receiving the agreement from the expert judgment system according to the expert's judgment, the ratio of the total agreement between the expert judgment system and the participating trust network is greater than the standard agreement rate. Determined as a result of the second sum,
Among the plurality of trust network devices, a predetermined number of trust network devices are determined as a consensus participating trust network device, with priority given to the number of connected access terminals or the amount of inflow traffic,
The plurality of trust network devices, when receiving the result of the first agreement, writes in the distributed ledger, and further records and updates the received second agreement result in the distributed ledger,
The interlocked online IP real-time analysis system is a server that collects IP on the network to determine whether or not harmful, the access information is the IP and Mac address of the destination connected to the trust network device, the IP and service port of the destination, own Block network based trust network system, characterized in that the trust network device ID.
delete The method of claim 1,
The infrastructure support system assigns and manages an ID to a trust network device, and transmits a first agreement result and a second agreement result only when the trust network device is assigned an ID. .
delete delete The method of claim 1,
The agreement participating trust network device,
Block chain-based trust network system, characterized in that the response to the infrastructure support system to determine the white or black through the traffic analysis when receiving the agreement request packet required for the agreement decision.
delete The method of claim 1,
The agreement request packet is a source IP and a Mac address, a destination IP and a service port,
And the white / black list includes access information and a flag distinguishing whether the access information is white or black.

Images