KR102030764B1 - Security device and method for virtual network - Google Patents

Abstract

The present invention provides a virtual network security device and a virtual network, which realizes a security control technique that improves security vulnerabilities and enhances security in view of the characteristics of a virtual network environment that is dynamically configured / modified using a common network infrastructure on a network. We propose a network security method.

Description

Virtual network security devices and virtual network security methods {SECURITY DEVICE AND METHOD FOR VIRTUAL NETWORK}

The present invention relates to a virtual network technology, and more particularly, in consideration of the characteristics of a virtual network environment that is dynamically configured / modified using a common network infrastructure in a network, a security that can improve security vulnerabilities and enhance security. Control technology.

A virtual network is a virtual network configured on a network, and is typically used for a cloud service that is rapidly evolving in recent years.

Cloud service (or cloud computing) is a technology that provides a data service based on a virtual network configured on a network by using internet technology. The function (process) of various arithmetic processing such as data classification, calculation, processing and analysis by a user It is a conceptual technology that borrows and uses network resources (Information Technology resources) such as storage spaces as needed.

Therefore, the virtual network-based cloud service can rapidly process a large amount of data that cannot be accommodated at the resource level that a user actually possesses, and enable the use of a high performance / high speed data service based on the same. do.

On the other hand, the security method employed in the network is a method of allowing / restricting access based on a security tool (eg, a firewall, etc.) in an environment that opens visibility and accessibility of network elements.

In case of applying the existing general network security method to the virtual network environment, various security vulnerabilities such as Denial of Service attack exposure to Application connection port, risk of losing control of server due to Credential Theft, Connection Hijacking, APT / Lateral Movement exposure Will have

In recent years, network slicing (network slicing) technology has emerged that separates a physical common network infrastructure into a plurality of independent virtual networks and provides independent data services for each service characteristic.

In such a network slicing technology, since a virtual network is dynamically configured for each data service using a common network infrastructure on a network, each segment of the virtual network has an environmental characteristic of dynamically changing.

Therefore, in view of the environmental characteristics of the virtual network, which is dynamically configured / modified in particular, the above-described security vulnerability for each segment of the virtual network may be more critical.

Accordingly, the present invention, in consideration of the characteristics of the virtual network environment that is dynamically configured / changed, to propose a new security control technology that can improve security vulnerabilities and enhance the security.

The present invention was created in view of the above circumstances, and considering the characteristics of a virtual network environment that is dynamically configured / modified using a common network infrastructure on a network, a security control that can improve security vulnerabilities and enhance security. To provide technology.

The virtual network security device according to the first aspect of the present invention for achieving the above object, based on the tenants policy defined in a specific service, a virtual network for the specific service using a network resource selected on the network. A network configuration control unit configured to constitute; And a network security control unit for controlling a dynamic security function implemented for each segment of the virtual network based on the tenant policy to apply individual security to the specific service on a segment basis of the virtual network.

Preferably, the virtual network may include a core computing node that provides a cloud service for the specific service, and an edge computing node that provides the cloud service with the core computing node.

Preferably, the dynamic security function is based on a specific security setting (All deny setting) that blocks all access, and can only allow access to a specific access under the control of the network security control unit.

Preferably, the network security control unit, the dynamic security function implemented for each segment of the virtual network configured to provide the access information required for access to the specific service to the access subject authenticated for the specific service, By controlling the access, it is possible to allow access to the access from the access subject.

Preferably, the tenant policy configures a virtual network by setting a data path between segments for each of a plurality of service functions provided by the specific service, and configures the plurality of service functions for each level of access authority granted to an access subject. You can allow access to each differently.

Preferably, the network security control unit, the access information required for access to a specific service function that allows access to the level of access authority granted to the access principal among the plurality of service functions, the access subject authenticated for the specific service. Provide only and control only the dynamic security function implemented in the segment that sets the data path of the specific service function among the segments of the virtual network configured for the specific service to allow access to the access from the access subject. Can be.

The virtual network security method according to the second aspect of the present invention for achieving the above object, based on the tenants policy defined in a specific service, using the network resources selected on the network to establish a virtual network for the specific service A network configuration step of configuring; And a network security control step of controlling a dynamic security function implemented for each segment of the virtual network based on the tenant policy, so that individual security can be applied to the specific service on a segment basis of the virtual network.

Preferably, the dynamic security function is based on a specific security setting (All deny setting) that blocks all access, and can only allow access to a specific access under the control in the network security control step.

Preferably, in the network security control step, the dynamic security implemented for each segment of the virtual network configured for providing the access information required for access to the specific service to an access subject authenticated for the specific service, and configured for the specific service. The function can be controlled to allow access for access from the access subject.

Therefore, according to the virtual network security device and the virtual network security method according to the present invention, by implementing a new security control technology in consideration of the characteristics of the virtual network environment that is dynamically configured / changed using a common network infrastructure on the network, The effect is to improve and enhance security.

1 is a configuration diagram showing an example of implementing a cloud service based on a virtual network to which the present invention is applied.
2 is an exemplary view showing the configuration and function of a virtual network security device according to an embodiment of the present invention.
3 is an exemplary view showing a structure in which a security control technology implemented according to the present invention is implemented in a distributed cloud service.
4 is a control flowchart illustrating a virtual network security method according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

1 illustrates an example of implementing a cloud service based on a virtual network to which the present invention is applied.

Virtual networks are typically used for cloud services, which are rapidly evolving in recent years.

Cloud service (or cloud computing) is a technology that provides a data service based on a virtual network configured on a network by using internet technology. The function (process) of various arithmetic processing such as data classification, calculation, processing and analysis by a user It is a conceptual technology that borrows and uses network resources (Information Technology resources) such as storage spaces as needed.

Such cloud services are evolving rapidly in recent years, and as a part thereof, as illustrated in FIG. 1, cloud services provided on a network are distributed at an edge of a location closer to a user (terminal) than a core network and a core network. A hybrid service environment (hereinafter, a distributed cloud service environment) to provide has emerged.

The present invention relates to a security control technology for a virtual network, ie, a virtual network, configured on a network.

Therefore, the present invention proposes a security procedure that can be applied not only to a virtual network in a service environment (hereinafter, a cloud service environment) that provides cloud services only in a core network, but also to a virtual network in the aforementioned distributed cloud service environment. I want to realize it.

As shown in FIG. 1, a distributed cloud service environment includes a user, that is, a terminal 10, a core network 1, and a cloud service by performing data operation processing according to an application executed in the terminal 10. Located between the core computing node 200 and the terminal 10 and the core computing node 200 to provide a, selectively performing some data operation processing of the data operation processing according to the application running in the terminal 10 The edge computing node 100 provides a cloud service with the core computing node 200.

Accordingly, the core computing node 200 provides a cloud service for a specific service by an application running on the terminal 10, and the edge computing node 100 distributes the cloud service with the core computing node 200. Done.

On the other hand, the general cloud service environment, although not shown in the separate drawings, except for the edge computing node 100 in Figure 1 may be viewed as an environment consisting of only the core computing node 200.

In addition, although FIG. 1 illustrates the service use subject (in other words, the access subject) as the terminal 10 of the user, this is only an example for convenience of description and may be a separate server (not shown).

On the other hand, the security method employed in the network is a method of allowing / restricting access based on a security tool (eg, a firewall, etc.) in an environment that opens visibility and accessibility of network elements.

In case of applying the existing general network security method to the virtual network environment, various security vulnerabilities such as Denial of Service attack exposure to Application connection port, risk of losing control of server due to Credential Theft, Connection Hijacking, APT / Lateral Movement exposure Will have

In recent years, network slicing (network slicing) technology has emerged that separates a physical common network infrastructure into a plurality of independent virtual networks and provides independent data services for each service characteristic.

In such a network slicing technology, since a virtual network is dynamically configured for each data service using a common network infrastructure on a network, each segment of the virtual network has an environmental characteristic of dynamically changing.

Therefore, in view of the environmental characteristics of the virtual network, which is dynamically configured / modified, in particular, the aforementioned security vulnerability for each segment of the virtual network may be more critical.
Accordingly, the present invention, in consideration of the characteristics of the virtual network environment that is dynamically configured / changed, to propose a new security control technology that can improve security vulnerabilities and further enhance security.

delete

The virtual network security device 300 of the present invention shown in FIG. 1 controls a security function for a virtual network configured to provide a specific service.

In the distributed cloud service environment as illustrated in FIG. 1, the edge computing node 100 and the core computing node 200 may be referred to as a virtual network. In this case, the virtual network security device 300 may be a virtual network, that is, edge computing. Security functions may be controlled for the node 100 and the core computing node 200.

Hereinafter, the configuration and function of a virtual network security device according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

As shown in FIG. 2, the virtual network security device 300 of the present invention uses a network resource selected on a network based on a tenant policy defined in a specific service to establish a virtual network for the specific service. The network configuration control unit (hereinafter referred to as the dynamic network configuration control unit 310) and the dynamic security function implemented for each segment of the virtual network are controlled based on the tenant policy, and the specific service is performed on a segment basis of the virtual network. It includes a network security control unit (hereinafter referred to as Dynamic Perimeter security control unit 320) to apply the individual security.

The dynamic network configuration controller 310 configures a virtual network for the specific service using the network resource selected on the network based on the tenant policy defined in the specific service.

That is, the dynamic network configuration controller 310 configures a virtual network for providing a specific service on a network.

In detail, the dynamic network configuration controller 310 selects a network resource (information technology resource) required from a physical common network infrastructure on a network based on a tenant policy defined in a specific service and uses a selected network resource to select a specific service. You will configure a virtual network for.

At this time, the dynamic network configuration controller 310 obtains a tenant policy defined in the specific service when the implementation of the specific service is determined. The subject providing the tenant policy is not limited.

Here, in the tenant policy, basically, configuration information (setting values) for various elements required for providing a specific service in the form of a virtual network-based cloud service will be defined.

For example, the tenant policy defines whether a virtual network for a specific service is configured in a general cloud service form (environment) or a distributed cloud service form (environment), and the hardware required for the characteristic service. All the information (hereinafter, service setting information) necessary for configuring a virtual network for implementing a specific service, such as specification information of software resources is defined.

In FIG. 2, a general cloud service environment including a core computing node 200 ′ is shown as an example.

In this case, the dynamic network configuration control unit 310, based on the tenant policy defined in the specific service, recognizes that the configuration as a general cloud service form (environment) and the virtual network for the specific service based on the recognition / service setting information That is, it is understood that the core computing node 200 'is configured.

Specifically, the dynamic network configuration controller 310 may select a processor (processing H / W) of a specific processing function that is fixedly operated by the core computing node 200 ′.

For example, as illustrated in FIG. 2, the dynamic network configuration control unit 310 may select a specific hardware chip (or card or device), for example, a plurality of virtual swith 210, for speeding up processing.

Alternatively, the dynamic network configuration controller 310 selects a processor (processing H / W) as a hardware resource that can be dynamically operated in the core computing node 200 ', and provides a specific processing function to the selected processor (processing H / W). Can be set.

For example, as shown in FIG. 2, the dynamic network configuration control unit 310 selects the processors (processing H / W) 210 as hardware resources that can be dynamically operated, and selects the selected processor (processing H / W). In the 210, a function of the virtual swith for processing acceleration may be set.

The dynamic network configuration control unit 310 may configure a virtual network for a specific service by setting a hardware resource, that is, a software function to operate on the virtual swith 210.

For example, the dynamic network configuration controller 310 allocates a network function and storage 220 for a specific service to the core computing node 200 ′.

That is, the dynamic network configuration control unit 310, the core computing node (200 ') provides a network function to enable network communication for providing a specific service, and a storage function to support the network communication and interworking with its storage. To allocate.

In addition, the dynamic network configuration control unit 310 may operate on the core computing node 200 'using a network function and storage 220 on a selected (and set) hardware resource, that is, a virtual swith 210. Install it.

Specifically, the dynamic network configuration controller 310 installs a software function 230 on the core computing node 200 ′ that operates by using the network function and storage 230 on the network resource 210, that is, the hardware resource. Can be.

In FIG. 2, as a software function 230, v EPC (Virtual Evolved Packet Core), FW (Fire Wall), LB (Load Balancing), and most services for providing a specific service are installed.

As such, the dynamic network configuration controller 310 uses a network resource (ie, hardware / software resource) selected on the network based on a tenant policy defined for a specific service, that is, a virtual network, that is, a core computing node. 200 'can be configured.

The dynamic network configuration controller 310 is a node that uses hardware / software resources in a physical common network infrastructure and configures a virtual network, and manages and operates physical / virtual resources based on cloud technology (VIM). It may correspond to, or may be a separate node interworking with the VIM.

In this way, the dynamic network configuration control unit 310 dynamically configures a virtual network for a specific service, and separates a physical common network infrastructure into a plurality of independent virtual networks to provide independent data services according to the characteristics of each service. It is based on the Network Slicing technology provided.

Therefore, the virtual network, that is, the core computing node 200 'dynamically configured by the dynamic network configuration control unit 310 according to the network slicing technology, is dynamically configured only for a specific service using a common network infrastructure on the network. Each segment of the network has an environmental characteristic that changes dynamically.

Accordingly, the dynamic network configuration controller 310 may be defined as a software defined network (SDN) controller.

Dynamic Perimeter security control unit 320, based on the tenant policy defined in a specific service, the dynamic network configuration control unit 310 is a dynamic security function implemented for each segment of the dynamically configured virtual network, that is, core computing node (200 ') To control.

Specifically, each segment of the virtual network means a component of a unit in which input / output is made through an intercommunication port in the virtual network. Referring to FIG. 2, each hardware resource (processing H / W) is described. May refer to each software function that is operated on.

As illustrated in FIG. 2, a dynamic security function is implemented in each segment of the virtual network configured by the dynamic network configuration controller 310, that is, the core computing node 200 ′.

Here, the dynamic security function implemented in each segment is based on a specific security setting (All deny setting) that blocks all access, and allows access only for a specific access under the control of the network security controller 310.

For example, as shown in FIG. 2, each segment corresponding to a software resource constituting a virtual network, that is, FW, LB, or Service, has a dynamic security function in the form of Soft Defined Perimeter (SDP) G / W in the case of FW. In the case of each of the remaining LBs and services, the dynamic security function can be implemented in the form of SDP enabled kernel with SDP applied.

As another example, the dynamic security function is implemented in the form of Soft Defined Perimeter (SDP) G / W at the front of the access path of the software resource constituting the virtual network, and each segment corresponding to the FW, LB, and Service in the software resource is SDP. Dynamic security can be implemented in the form of SDP Enabled kernel.

Such a dynamic security function may be implemented by a technique (or a form) suitable for each segment for each segment constituting the virtual network configured by the dynamic network configuration controller 310, that is, the core computing node 200 ′, and its implementation. There is no restriction on the technique.

Accordingly, the dynamic perimeter security control unit 320 is a dynamic security implemented for each segment of the virtual network, that is, the core computing node 200 ', in which the dynamic network configuration control unit 310 is dynamically configured based on a tenant policy defined in a specific service. Functions can be controlled so that individual security can be applied to specific services on a segment basis of a virtual network.

More specifically, for example, in the tenant policy defined for a specific service, in addition to the service setting information described above, all information (hereinafter, security control information) necessary for allowing / restricting access for each tenant / user may be defined.

As an example, in the tenant policy, tenant-specific security control information may be defined to allow an access subject authenticated with respect to a specific service to all the specific services.

In this case, the dynamic perimeter security control unit 320 provides access information required for access to a specific service to an authorized access subject based on the tenant policy, in particular, the tenant security control information.

Referring to the terminal 10 of the user as the access subject, for example, the dynamic perimeter security control unit 320, only when the terminal 10 attempting to access a specific service is authenticated by performing all the authentication procedures, It provides the terminal 10 with access information necessary for access to a specific service.

When the dynamic perimeter security control unit 320 provides access information to the terminal 10, the dynamic perimeter security control unit 240 implements the dynamic security function 240 implemented for each segment of the virtual network configured for a specific service, that is, the core computing node 200 ′. By controlling, access is allowed to access from the terminal 10.

For example, the dynamic perimeter security control unit 320 controls the security setting of the dynamic security function 240 implemented for each segment to allow access by opening a pin hole for access from the terminal 10.

In this case, the virtual network security device 300 can implement the security control technique (technique) proposed by the present invention in each data service unit, that is, the tenant unit, including the above-mentioned specific service realized by dynamically constructing the virtual network. have.

Meanwhile, as another example, in the tenant policy, security control information for each user may be defined to allow an access subject authenticated with respect to a specific service to access a specific service differently according to the level of access authority the access subject has.

In this case, the tenant policy configures a virtual network by setting data paths between segments for a plurality of service functions provided by a specific service, and for each of the plurality of service functions for each level of access authority granted to an access subject. It is desirable to allow access differently.

More specifically, in the tenant policy defined in a specific service, more precisely, the service setting information described above, in order to implement a plurality of service functions provided by a specific service, a data path between each segment may be set for each service available. Information may be included.

In addition, the tenant policy defined in the specific service, more specifically, the security control information for each user described above, will include information for allowing access to each of a plurality of service functions provided by the specific service for each level of access authority.

For example, if the level of access is assumed to be high / medium / low, the access subject of the high level of access is allowed to access all of the multiple services provided by a particular service (all access to a specific service). In this case, the access sphere at the level of access authority is allowed only access to the remaining service functions except the service functions related to information deletion / modification among the multiple services provided by the specific service, and the access sphere at the lower level of access authority is provided at the specific service. Among the plurality of services, only the access to the service functions related to the viewing / searching of the information information may be allowed.

In this case, the dynamic perimeter security control unit 320 is required for access to a specific service function that allows an authorized access subject to access a level of access authority granted to the access subject among the plurality of service functions. Provide only information.

Referring to the terminal 10 of the user as the access subject, for example, the dynamic perimeter security control unit 320, only when the terminal 10 attempting to access a specific service is authenticated by performing all the authentication procedures, Only access information necessary for access to a specific service function that allows access to the level of access authority granted to the terminal 10 may be provided.

For example, if the terminal 10 is at the level of the access authority, the dynamic perimeter security control unit 320 grants the terminal 10 only when the terminal 10 is authenticated by performing all the authentication procedures. Only access information necessary for access to a specific service function (other than service functions related to deletion / change of information) that allows access to a level of access authority may be provided.

When the dynamic perimeter security controller 320 provides access information to the terminal 10, the dynamic perimeter security control unit 320 sets a data path of a specific service function among segments of a virtual network configured for a specific service, that is, the core computing node 200 ′. By controlling only the dynamic security function implemented in the segment to allow access to the access from the terminal 10.

For example, the dynamic perimeter security control unit 320 may, in the dynamic security function 240 implemented for each segment, access a specific service function (service function related to information deletion / change) that allows access to a level of access authority granted to the terminal 10. By controlling only the security setting of the dynamic security function implemented in the segment for setting the data path of the remaining service functions, except for access from the terminal 10 to allow access by opening a pin hole.

In this case, the virtual network security device 300 can implement the security control technique (technique) proposed by the present invention for each data service including the above-mentioned specific service realized by dynamically constructing a virtual network. have.

As such, the dynamic perimeter security control unit 320 may apply individual security to a specific service on a segment basis of a virtual network based on a tenant policy defined for a specific service.

The dynamic perimeter security control unit 320 may be a node that controls a security function for a virtual network, may correspond to a VIM, or may be a separate node interworking with the VIM.

As described above, the present invention provides network isolation for implementing a dynamic security function based on a specific security setting for each segment of a virtual network that is dynamically configured based on a tenant policy according to a network slicing technology. Under the structure (model), access to network elements may not be opened by applying individual security in each segment by controlling the dynamic security function of each segment based on tenant policy.

In particular, each segment of the virtual network that is dynamically configured according to the network slicing technology can be changed dynamically in accordance with the characteristics, the present invention can flexibly respond to such a segment change situation because the dynamic security function for each segment is implemented.

Furthermore, the present invention may not open the visibility to the network element by providing the access subject with the minimum connection information necessary only for authentication, under the network isolation structure (model) described above.

As described above, the present invention provides a network isolation that implements a dynamic security function based on a specific security setting for each segment of the virtual network, unlike an existing general network security method that opens visibility and accessibility to network elements. Based on the structure (model), considering the characteristics of the virtual network environment, that is, the characteristics of each segment can be changed dynamically without opening visibility and accessibility, new security control technology that enables flexible response and minimizes exposure is realized. have.

Accordingly, the present invention provides security vulnerabilities such as exposure of Denial of Service attack on Application connection port, risk of loss of server control due to Credential Theft, connection hijacking, and exposure of APT / Lateral Movement, compared to the existing general network security methods. By improving, the effect of strengthening the security is derived.

2 illustrates a case where a core computing node 200 ′ in a general cloud service form (environment) is configured as a virtual network configured for a specific service.

In contrast, FIG. 3 briefly illustrates an edge computing node and a core computing node in the form of a distributed cloud service (environment) as a virtual network configured for a specific service.

As shown in FIG. 3, when the virtual network is configured in a distributed cloud service form (environment), the present invention may be applied not to be different from the case of configuring a virtual network in the general cloud service form (environment) described above. .

In brief, the dynamic network configuration control unit 310 recognizes the configuration as a distributed cloud service form (environment) based on a tenant policy defined for a specific service, and recognizes / based service setting information for a specific service. The virtual network, that is, the edge computing node 100 and the core computing nodes 200A and B will be configured.

In this case, in FIG. 3, the process of configuring the virtual network, that is, the edge computing node 100 and the core computing nodes 200A and B, is not described in detail. Collectively referred to as Resource Pool.

In addition, the dynamic perimeter security control unit 320 is based on the tenant policy defined in a specific service, the dynamic network configuration control unit 310 dynamically configured, that is, the edge computing node 100 and the core computing node (200A, B) By controlling the dynamic security function implemented for each segment of), individual security can be applied for each specific service by segment of virtual network.

At this time, the virtual network security device 300 can also implement the security control technique (technique) proposed in the present invention in each data service unit, that is, the tenant unit, including the above-mentioned specific service realized by dynamically configuring the virtual network. Each data service can be implemented on a user basis.

Hereinafter, a virtual network security method according to a preferred embodiment of the present invention will be described with reference to FIG. 4.

Here, for the convenience of description, the configuration shown in FIG. 2 described above will be described with reference to the corresponding reference numerals.

According to the virtual network security method of the present invention, when the implementation of the specific service is determined, the virtual network security device 300 obtains a tenant policy defined in the specific service (S100).

Accordingly, according to the virtual network security method of the present invention, the virtual network security device 300 selects a network resource (information technology resource) required in the physical common network infrastructure on the network, based on the tenant policy defined in a specific service. Using the selected network resources to configure a virtual network for a specific service (S110).

Specifically, referring to FIG. 2, the virtual network security device 300 may be configured to process a processor (processing H //) of a specific processing function that is fixedly operated in the core computing node 200 ′ based on a tenant policy defined in a specific service. W) can be selected.

For example, as shown in FIG. 2, the virtual network security device 300 may select a specific hardware chip (or card or device), for example, a plurality of virtual swith 210, for speeding up processing.

Alternatively, the virtual network security device 300 selects a processor (processing H / W) as a hardware resource that can be dynamically operated in the core computing node 200 'and provides a specific processing function to the selected processor (processing H / W). Can be set.

For example, the virtual network security device 300 selects the processors (processing H / W) 210 as hardware resources that can be dynamically operated, as shown in FIG. 2, and selects the selected processor (processing H / W). In the 210, a function of the virtual swith for processing acceleration may be set.

The virtual network security device 300 may configure a virtual network for a specific service by setting a hardware resource, that is, a software function to operate on the virtual swith 210.

For example, the virtual network security device 300 allocates a network function and storage 220 for a specific service to the core computing node 200 ′.

That is, the virtual network security device 300 includes a network function that enables the core computing node 200 ′ to enable network communication for providing a specific service, and a storage function that supports network communication and interworking with its storage. To allocate.

The virtual network security device 300 is a software function that is operated by utilizing the network function and storage 220 on the selected (and configured) hardware resource, that is, the virtual computing node 200 ′, to the core computing node 200 ′. Install it.

In detail, the virtual network security device 300 installs a software function 230 on the core computing node 200 ′ by operating the network function and the storage 230 on the network resource 210, that is, the hardware resource. Can be.

The virtual network security device 300 may set a data path between segments for each of a plurality of service functions provided by a specific service based on the tenant policy.

The virtual network security device 300 may implement the dynamic security function 240 for each segment.

Thus, according to the virtual network security method of the present invention, the virtual network security device 300 is specified by using the network resources (that is, hardware / software resources) selected on the network based on the tenants (tenants) policy defined in the specific service. A virtual network for a service, that is, a core computing node 200 ′ may be configured.

In addition, according to the virtual network security method of the present invention, the virtual network security device 300 is set based on a specific security setting (All deny setting) to block all access to the dynamic security function 240 implemented for each segment by default. (S120).

In this case, the dynamic security function implemented in each segment is based on a specific security setting (All deny setting) that blocks all access, and allows access only for a specific access according to the security control described below.

For example, as shown in FIG. 2, each segment corresponding to a software resource constituting a virtual network, that is, FW, LB, or Service, has a dynamic security function in the form of Soft Defined Perimeter (SDP) G / W in the case of FW. In the case of each of the remaining LBs and services, the dynamic security function can be implemented in the form of SDP enabled kernel with SDP applied.

As another example, the dynamic security function is implemented in the form of Soft Defined Perimeter (SDP) G / W at the front of the access path of the software resource constituting the virtual network, and each segment corresponding to the FW, LB, and Service in the software resource is SDP. Dynamic security can be implemented in the form of SDP Enabled kernel.

Such a dynamic security function may be implemented by a technique (or a form) suitable for each segment for each segment constituting the virtual network, that is, the core computing node 200 ', and the implementation technique is not limited.

In addition, according to the virtual network security method of the present invention, the virtual network security device 300 is implemented for each segment of the previously configured virtual network, that is, core computing node 200 ', based on a tenant policy defined in a specific service. By controlling the dynamic security function, individual security can be applied to each service by segment of virtual network.

More specifically, for example, in the tenant policy defined for a specific service, in addition to the service setting information described above, all information (hereinafter, security control information) necessary for allowing / restricting access for each tenant / user may be defined.

Hereinafter, for convenience of description, it will be assumed that the security control information for each user is defined in the tenant policy.

In this case, the tenant policy defined in the specific service, more specifically, the security control information for each user described above, will include information allowing different access to each of a plurality of service functions provided by the specific service for each level of access authority.

For example, if the level of access is assumed to be high / medium / low, the access subject of the high level of access is allowed to access all of the multiple services provided by a particular service (all access to a specific service). In this case, the access sphere at the level of access authority is allowed only access to the remaining service functions except the service functions related to information deletion / modification among the multiple services provided by the specific service, and the access sphere at the lower level of access authority is provided at the specific service. Among the plurality of services, only the access to the service functions related to the viewing / searching of the information information may be allowed.

In this case, the virtual network security device 300 requires an access subject authenticated with respect to a specific service to access a specific service function that allows access to a level of access authority granted to the access subject among the plurality of service functions. Provide only information.

Referring to the terminal 10 of the user as the access subject, for example, the virtual network security device 300 is a terminal only when the terminal 10 attempting to access a specific service is authenticated by performing all the authentication procedures. Only access information necessary for access to a specific service function allowing access to the level of access authority granted to 10 may be provided (S140).

For example, when the terminal 10 is at the level of the access right, the virtual network security device 300 performs the access granted to the terminal 10 only when the terminal 10 is authenticated by performing all the authentication procedures. Only the access information necessary for access to a specific service function (other than service functions related to deletion / change of information) that allows access to the middle level of authority may be provided.

In this case, the security control technique (technique) proposed in the present invention does not open the visibility of the network element to the unspecified subject by providing visibility to the access subject by providing the minimum access information necessary only for authentication. Can be.

When the virtual network security device 300 provides access information to the terminal 10, the virtual network security device 300 sets a data path of a specific service function among segments of a virtual network configured for a specific service, that is, the core computing node 200 ′. By controlling only the dynamic security function implemented in the segment, to allow access to the access from the terminal 10 (S150).

For example, the virtual network security device 300 provides a specific service function (service function related to information deletion / change) that allows access to a level of access authority granted to the terminal 10 in the dynamic security function 240 implemented for each segment. By controlling only the security setting of the dynamic security function implemented in the segment for setting the data path of the remaining service functions, except for the access from the terminal 10 to allow access.

In this case, in the case of the security control technique (technique) proposed in the present invention, for each segment of the virtual network dynamically configured based on the tenant policy according to the network slicing technique, a dynamic based on a specific security setting (All deny setting) Under the network isolation structure (model) that implements the security function, the individual security is applied to each segment by controlling the dynamic security function of each segment based on the tenant policy. It can provide limited access without opening.

In particular, each segment of the virtual network that is dynamically configured according to the network slicing technology can be changed dynamically in accordance with the characteristics, the present invention can flexibly respond to such a segment change situation because the dynamic security function for each segment is implemented.

As described above, according to the present invention, unlike conventional network security schemes that open up visibility and accessibility of network elements, dynamic security based on a specific security setting for each segment of the virtual network is provided. Based on the network isolation structure (model) that implements the function, it is possible to respond flexibly while minimizing the exposure, considering the characteristics of the virtual network environment, that is, each segment can be changed dynamically without opening visibility and accessibility. Security control technology is realized.

Accordingly, the present invention provides security vulnerabilities such as exposure of Denial of Service attack on Application connection port, risk of loss of server control due to Credential Theft, connection hijacking, and exposure of APT / Lateral Movement, compared to the existing general network security methods. By improving, the effect of strengthening the security is derived.

The virtual network security method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

According to the virtual network security device and the virtual network security method according to the present invention, in view of the characteristics of the virtual network environment that is dynamically configured / changed using a common network infrastructure in the network, it is possible to improve the security weakness and to further enhance security In this regard, the invention is an industrially applicable invention because the possibility of marketing or operating the applied device is not only sufficient for the use of the related technology as well as the possibility of practically making it clear as it exceeds the limitation of the existing technology. .

10: terminal
100: edge computing node
200: core computing node
300: virtual network security device

Claims (9)

A network configuration controller configured to configure a virtual network for the specific service using a network resource selected on a network based on a tenant policy defined in a specific service; And
For each segment of the virtual network, a dynamic security function that is individually implemented is controlled according to the function of the segment or the position of the segment on the access path of the software resource constituting the virtual network, so that the specific service is individually divided by the segment of the virtual network. Virtual network security device comprising a network security control unit for applying security. The method of claim 1,
The virtual network,
And a core computing node for providing a cloud service to the specific service, and an edge computing node for distributing and providing the cloud service with the core computing node. The method of claim 1,
The dynamic security function,
A virtual network security device based on a specific security setting (All deny setting) to block all access, characterized in that the access is allowed only for a specific access under the control of the network security control unit. The method of claim 1,
The network security control unit,
Providing access information required for access to the specific service to an authorized access subject for the specific service,
And controlling access to the access from the access subject by controlling a dynamic security function implemented for each segment of the virtual network configured for the specific service. The method of claim 1,
The tenant policy is,
To configure a virtual network by setting a data path between each segment for each of a plurality of service functions provided by the specific service,
And virtually allowing access to each of the plurality of service functions according to the level of access rights granted to an access subject. The method of claim 5,
The network security control unit,
Providing only the access information necessary for access to a specific service function to allow access to a level of access authority granted to the access subject, among the plurality of service functions, to the access subject authenticated with respect to the specific service;
Among the segments of the virtual network configured for the specific service, only the dynamic security function implemented in the segment for setting the data path of the specific service function is controlled to allow access to the access from the access subject. Virtual network security device. A network configuration step of configuring a virtual network for the specific service using a network resource selected on a network based on a tenant policy defined in a specific service; And
For each segment of the virtual network, a dynamic security function that is individually implemented is controlled according to the function of the segment or the position of the segment on the access path of the software resource constituting the virtual network, so that the specific service is individually divided by the segment of the virtual network. Virtual network security method comprising the step of applying a security network security. The method of claim 7, wherein
The dynamic security function,
A virtual network security method, which is based on a specific security setting (All deny setting) that blocks all accesses, and allows access only for a specific access according to the control in the network security control step. The method of claim 7, wherein
The network security control step,
Providing access information required for access to the specific service to an authorized access subject for the specific service,
And controlling access to the access from the access subject by controlling a dynamic security function for each segment of the virtual network configured for the specific service.

Images