KR102175745B1 - Apparatus and system for providing security solution platform corresponding to security object and method thereof - Google Patents

Abstract

The present invention discloses a security platform device, a security platform system, and a security platform method that provide a security solution suitable for a security target object. A security platform device according to the present invention includes: a security solution registration unit for registering a server-side policy program and a client-side agent program of the security solution based on a virtual machine; A permission information management unit that generates and manages permission information of an Internet Protocol (IP) address and a certificate that permits the use of the security solution according to the selected protection target; A service portal for downloading and providing an installation program of an agent program to a terminal to be protected, and providing policy information of a security solution to an agent program executed in the terminal; And a virtual machine unit that generates a virtual machine of a policy program on the server side in response to a service request of the agent program, and provides a security solution service to the agent program through the generated virtual machine. According to the present invention, vendors register each security solution suitable for a security target through a security platform, and a user downloads and installs a security solution suitable for the security target.

Description

A security platform device, a security platform system, and a security platform method that provide a security solution suitable for a security target object {Apparatus and system for providing security solution platform corresponding to security object and method thereof}

The present invention relates to a security platform technology, and more particularly, to a security platform device, a security platform system, and a security platform method for providing a security platform service equipped with security solutions suitable for a security target object of a service subscriber.

The security service system consists of a vendor providing security services and a user receiving security services. The vendor builds a security solution on the user's security target object at the user's request.

Here, when there are n users, the vendor is required to provide n security solutions to the security target objects designated by n users. Then, the same n security solutions, but the vendor must support n security solutions to meet the requirements of each n users. Therefore, the labor cost and construction cost consumed by the vendor to manage the security service increase. The operation cost of managing n objects to be secured increases. Also, since there are n failure points according to n security target objects, Voice of Customer (VOC) increases.

Furthermore, the cost of service subscribers as well as Ben-Tha increases. As the equipment price of the security solution is high, small operators are burdened with equipment introduction. Even if the introduction of equipment is made in the form of a lease, considerable costs are consumed. In addition, compared to the case where service subscribers actually use the service of the security solution, the service cost is basically fixed at a flat rate, so subscribers hesitate to subscribe to the service.

Korean Patent Registration 2006-604063 (2006.07.14)

The present invention was created under the recognition of the prior art as described above, and the security platform device and security platform system and security that provide security solutions through the environment of one security platform by registering each solution with different protection targets from vendors. It aims to provide a platform method.

Another object of the present invention is to provide a security solution for user terminals, servers, and network equipment according to the object to be protected.

Another object of the present invention is to receive security services desired by users through a security solution platform based on virtualization technology and to charge a usage fee in proportion to the use of the security solution.

A security platform device that provides a security solution suitable for a security target object according to the present invention for achieving the above technical problem is a security platform device that controls a security platform that provides each security solution suitable for a protection target, a virtual machine A security solution registration unit for registering a server-side policy program and a client-side agent program of the security solution based on; A permission information management unit that generates and manages permission information of an Internet Protocol (IP) address and certificate that permits the use of the security solution according to the selected protection target; A service portal for downloading and providing an installation program of the agent program to a terminal to be protected, and providing policy information of a security solution to an agent program executed in the terminal; And a virtual machine unit that generates a virtual machine of a policy program on the server side in response to a service request of the agent program, and provides a security solution service to the agent program through the generated virtual machine.

In the present invention, the security solution registration unit registers the security solution corresponding to at least one or more of a user terminal, a server, and a network device corresponding to the terminal to be protected.

Here, the installation program is generated by inserting the permission information into a copy of the agent program.

In addition, the service portal unit may include a download providing unit that provides a file download service for installation and version processing of the agent program at the request of the terminal; And a policy information providing unit that provides information including monitoring, reporting, and policy application to the agent program executed in the terminal.

Furthermore, the permission information management unit may include an account management unit for managing accounts of members who have subscribed to the service of the security solution; A certificate management unit that manages certificates for authentication of execution of the agent program; And an IP management unit that manages an IP address for authentication of execution of the agent program.

Here, the virtual machine unit receives the permission information from the agent program, performs authentication to the permission information management unit, and responds to an authentication result.

According to an aspect of the present invention, the terminal downloads and installs the agent program, transmits an authentication request by execution of the agent program, receives policy information when authentication is successful, and receives policy information by reflection of the policy information. Execute the processing of the security solution.

Here, the user terminal is provided with a service of a security solution including the prevention and treatment of viruses and unauthorized behaviors by the resident of the corresponding agent program, and the server prevents unauthorized access and malicious behavior by the resident of the corresponding agent program. The network device receives the service of a security solution including defense, and the network device communicates with the traffic monitoring and control processing by the resident of the corresponding agent program, and the packet is passed through the virtual router based on the virtual machine. You are provided with the services of this controlled security solution.

The security platform system according to the present invention for achieving the above technical problem is a security platform system that provides each security solution suitable for a protection target using a security platform, by providing a security platform to the server side policy of the security solution. Registers a program and an agent program on the client side, provides an installation program of the agent program, creates a virtual machine of the policy program in response to a service request from the executed agent program, and sends the agent program to the agent program through the created virtual machine. A security platform device that provides a security solution service; And a protection target device that downloads the installation program and installs an agent program, and the executed agent program receives a service from the virtual machine and executes a security solution.

Here, the device to be protected corresponds to a user terminal, a server, or a network device.

According to the security platform method for providing a security solution suitable for a security target object of the present invention for achieving the above technical problem, the security platform device provides a security platform method for controlling a security platform that provides each security solution suitable for the protection target. In the following, (a) a security solution registration step of registering a server-side policy program and a client-side agent program of the security solution based on a virtual machine; (b) a permission information management step of generating and managing permission information of an Internet Protocol (IP) address and certificate permitting the use of the security solution according to the protection target; And (c) generating a virtual machine of a policy program on the server side in response to a service request of the agent program, and providing a virtual machine providing a security solution service to the agent program through the generated virtual machine.

In the security platform method according to the present invention for achieving the above technical problem, in the security platform method for providing each security solution suitable for the protection target using a security platform, (a) the security platform device provides a security platform A security solution registration step of registering a policy program on the server side of the security solution and an agent program on the client side; (b) a permission information management step of generating and managing, by the security platform device, permission information of an Internet Protocol (IP) address and certificate that permits the use of the security solution according to the selected protection target; (c) The user terminal applies for service subscription by selecting the type of the protection target with the security platform device, downloads the installation program in which the permission information is inserted for the agent program suitable for the selected protection target, and installs the installation program. Installing an agent to install; And (d) the security platform device receives a request to provide a service including the permission information from an agent program executed in the user terminal, and when authentication of the permission information is successful, creates a virtual machine of the policy program, and the created virtual machine. And a service providing step of providing a service of a security solution to the agent program through.

According to an aspect of the present invention, a security platform in an ecosystem environment in which registration and distribution of a security solution is provided for each device to be protected is provided, so that a user can apply for a service suitable for the protection target through the security platform.

In addition, the security solution platform provides security services based on virtual machines for the agent program installed in the security target, so it is possible to flexibly cope with the increase in subscribers, and users are billed on a pay-as-you-go basis according to the use of the security solution.

The following drawings attached to the present specification illustrate preferred embodiments of the present invention, and serve to further understand the technical idea of the present invention together with the detailed description of the present invention described later, the present invention is the matter described in such drawings. It should not be interpreted as being limited to
1 is a schematic configuration diagram of a security platform system according to an embodiment of the present invention.
2 is a schematic internal structure diagram of the security platform server of FIG. 1.
3 is a schematic flowchart of a security platform server of FIG. 1 providing a security service to a user terminal.
4 is a schematic flowchart of a security platform server of FIG. 1 providing a security service to a server.
5 is a schematic flowchart of a security platform server of FIG. 1 providing a security service to a network device.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms or words used in the specification and claims should not be construed as being limited to their usual or dictionary meanings, and the inventors appropriately explain the concept of terms in order to explain their own invention in the best way. Based on the principle that it can be defined, it should be interpreted as a meaning and concept consistent with the technical idea of the present invention.

Accordingly, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiment of the present invention, and do not represent all the technical spirit of the present invention, and thus various alternatives that can be substituted for them at the time of application It should be understood that there may be equivalents and variations.

1 is a schematic configuration diagram of a security platform system 1 according to an embodiment of the present invention.

The security platform system (1) according to an embodiment of the present invention is built on a wired and wireless network, and is a security platform server that provides security services to the protection target (2) and the protection target (2) to which security services are applied. It is composed of (3).

The wired and wireless networks in the present invention encompass all communication networks capable of data communication using various protocols, such as a mobile communication network and a wired and wireless public network such as the Internet or a dedicated network.

In addition, the security platform in the present invention is built on the security platform server 3 to register security solutions of vendors according to the objects of various protection targets (2), and provide the registered security solutions according to the protection target (2). It provides ecosystem services of security solutions. Therefore, the development of high-quality security solutions is accelerated by the competition of vendors, and a market for affordable security solutions is formed on the security platform.

The protection target 2 includes a user terminal 201, a server 202, and a network device 203 as a device to be protected according to the present invention.

Here, the user terminal 201 receives a security solution for end point security from the security platform server 3. The user terminal 201 corresponds to a computer terminal, a smart terminal, an IoT terminal, and the like. The endpoint security solution resides in the user terminal 201 corresponding to the client and detects viruses and unauthorized behavior. For example, the security solution includes security services such as Anti-virus, APT Solution, and DLP.

In addition, the server 202 receives a security solution for server security from the security platform server 3. The server security security solution resides in the server 202 and protects against unauthorized access and malicious behavior. For example, server security solutions include security services such as DB access control and DB encryption.

Further, the network device 303 receives a security solution for network communication security from the security platform server 3. The network communication security solution resides in the network device 303 and monitors traffic communicated through the network path. The network device 303 is not limited in its kind, such as a routing device or a switch device. For example, security solutions for network communication include security services such as Web filtering, firewall, WAF, IPS, and IDS.

The security platform server 3 corresponds to the security platform device of the present invention. The security platform server 3 provides ecosystem services of the security platform to vendors connected to the home page 300 and users of the protection target 2. Vendors can distribute a security solution to users by registering a security solution on the home page 300, and users can sign up for a security service by selecting a security solution suitable for the protection target (2) on the home page 300. have.

Here, the home page 300 may be operated like an app market. The vendor uploads the application of the security solution to the app market, and the user downloads and installs the desired application through the app market. Here, the user is charged a service fee based on a pay-as-you-go basis only for the amount of security service used. And the revenue from billing is distributed between the security platform's operators and vendors.

2 is a schematic internal structure diagram of the security platform server 3 of FIG. 1.

The security platform server 3 according to an embodiment of the present invention includes a security solution registration unit 31 for registering a security solution suitable for each protection target 2, and a permission information management unit 32 for managing authentication services of the security solution. , A service portal unit 33 that provides sales and download services of a security solution, and a virtual machine unit 34 that manages execution control of the security solution executed on the protected object 2 based on a virtual machine. .

The security solution registration unit 31 includes agent programs 312 and server-side policy programs installed and executed in the user terminal 201, the server 202 and the network device 203 corresponding to the protection target 2 Register and store the security solution including 311.

Here, in the security solution applied to the server 202, the virtual machine of the security platform server 3 provides a security gateway, and the security gateway approves various access and processing requests requested by the server 202 from the user, and the server ( 202). In addition, the security solution applied to the network device 203 provides a security service for traffic control in which the security platform server 3 provides a virtual router so that communication packets of the network device 203 pass through the virtual router.

The permission information management unit 32 manages authentication of the member who has subscribed to the service and the execution of the agent program 312. The permission information management unit 32 includes an account management unit 321 that manages the member, a certificate management unit 322 that manages the creation, change, and destruction of certificates, and an IP management unit that manages registration, change, deletion, etc. of IP addresses ( 323).

For example, the account management unit 321 stores and manages the member registration information by the user's service subscription to perform the user's login process, and the member registration information may be referred to. For a member's subscription service, the certificate management unit 322 may issue a member's certificate. In addition, the IP management unit 323 may manage the user's IP address for the member's subscription service. Then, only the user who successfully authenticates the certificate and IP address for the user's service execution can receive the security solution execution service.

The service portal unit 33 provides a UI interface for a vendor, a user, and an agent program 312 through a home page 300 and an app market.

Here, the service portal unit 33 is a policy information providing unit 331 that provides information including monitoring, reporting, and policy application to the agent program 312 executed on the protected object 2 It may further include. In addition, the service portal unit 33 further includes a download providing unit 332 that provides a file download service for installation and version processing of the agent program 312 at the request of the protection target 2.

Preferably, the installation program of the agent program 312 provided through the download providing unit 332 is generated by inserting the permission information (certificate and IP address) into a copy of the agent program 312. Then, the agent program 312 installed and executed in the protected object 2 transmits the permission information to request execution of the party user.

The virtual machine unit 34 generates a virtual machine based on the server-side policy program 311 in response to a service request of the agent program 312 executed in the protection target 2. Then, the created virtual machine performs real-time communication with the agent program 312 to control and manage the service of the security solution. Of course, it is obvious that since the security solution service is provided based on the virtual machine, it is possible to flexibly cope with the increase of subscribers and to reduce the cost of additional HW and SW construction.

Here, the virtual machine unit 34 further includes a solution server VM 341 and a virtual router 342. The solution server VM 341 receives permission information from the agent program 312, performs authentication with the permission information management unit 32, and responds to the authentication result. In addition, the solution server VM 341 provides services such as security instance collection and security control processing to the agent program 312. The virtual router 342 provides a router function for allowing a communication packet passing through the network device 203 to pass through the virtual router 342 in the security service of the network device 203. The communication packet of the network device 203 passing through the virtual router 342 is capable of various control processing such as drop and relay through the traffic analysis of the solution server VM 341, and the control-processed packet Is sent to its original destination.

FIG. 3 is a schematic flowchart in which the security platform server 3 of FIG. 1 provides a security service to the user terminal 201.

The security solution registration unit 31 provides a UI to register the security solution of the policy program 311 and the agent program 312 from the vendor terminal 4 (S301).

When a user subscribes to the service, the account management unit 321, the certificate management unit 322, and the permission information management unit 32 of the IP management unit 323 entails generating and controlling unique information.

Here, when the certificate management unit 322 issues a unique certificate and the IP management unit 323 registers the IP address, the certificate and the IP address are provided to the policy information providing unit 331 (S302). Then, the policy information providing unit 331 creates an installation program by inserting the certificate and IP address into the copy of the agent program 312 with reference to the policy information, and the generated installation program is downloaded to the user terminal 201 ( S303).

The user terminal 201 installs the agent program 312 with the downloaded installation program, and executes the installed agent program 312 (S304).

The solution server VM 341 based on the policy program 311 is created by the execution of the agent program 312. The generated solution server VM 341 performs authentication processing on the certificate and IP address received from the agent program 312 using the permission information management unit 32 (S305).

If authentication is successful, the solution server VM 341 applies the policy information to the agent program 312 (S306), and provides a real-time service of the security solution to the agent program 312 (S307). By the real-time service, the agent program 312 of the user terminal 201 detects viruses and unauthorized behaviors in advance and processes them as a policy of a security solution.

4 is a schematic flowchart in which the security platform server 3 of FIG. 1 provides a security service to the server 202.

The security solution registration unit 31 provides a UI to register the policy program 311 and the security solution of the agent program 312 corresponding to the security solution of the server 202 from the vendor terminal 4 (S311).

When a user subscribes to the service, the account management unit 321, the certificate management unit 322, and the permission information management unit 32 of the IP management unit 323 entails generating and controlling unique information.

Here, when the certificate management unit 322 issues a unique certificate and the IP management unit 323 registers the IP address, the certificate and the IP address are provided to the policy information providing unit 331 (S312). Then, the policy information providing unit 331 creates an installation program by inserting the certificate and IP address into the copy of the agent program 312 with reference to the policy information, and the generated installation program is downloaded to the server 202 (S313 ).

The server 202 installs the agent program 312 with the downloaded installation program, and executes the installed agent program 312 (S314).

The solution server VM 341 based on the policy program 311 is created by the execution of the agent program 312. The generated solution server VM 341 performs authentication processing on the certificate and IP address received from the agent program 312 using the permission information management unit 32 (S315).

If authentication is successful, the solution server VM 341 applies the control policy information to the agent program 312 (S316), and provides a real-time service of the security solution to the agent program 312 (S317). When the user's access to the server 202 is authorized through the solution server VM 341 serving as a security gateway by the real-time service, the user's access to the server 202 and a service request is permitted.

FIG. 5 is a schematic flowchart in which the security platform server 3 of FIG. 1 provides a security service to the network device 203.

The security solution registration unit 31 provides a UI to register the security solution of the policy program 311 and the routing agent program 313 suitable for the security solution of the network device 203 from the vendor terminal 4 (S321).

When a user subscribes to the service, the account management unit 321, the certificate management unit 322, and the permission information management unit 32 of the IP management unit 323 entails generating and controlling unique information.

Here, when the certificate management unit 322 issues a unique certificate and the IP management unit 323 registers the IP address, the certificate and the IP address are provided to the policy information providing unit 331 (S322). Then, the policy information providing unit 331 creates an installation program by inserting the certificate and IP address into the copy of the routing agent program 313 with reference to the policy information, and the generated installation program is downloaded to the network device 203 (S323).

The network device 203 installs the routing agent program 313 with the downloaded installation program, and executes the installed routing agent program 313 (S324).

By the execution of the routing agent program 313, the solution server VM 341 and the virtual router 342 based on the policy program 311 are created. The generated solution server VM 341 performs authentication processing on the certificate and IP address received from the routing agent program 313 using the permission information management unit 32 (S325).

If authentication is successful, the solution server VM 341 applies the control policy information to the routing agent program 313 and provides a real-time service of the security solution to the routing agent program 313 (S326). Here, a communication packet processed by the network device 203 by the real-time service is communicated through the virtual router 342, and the solution VM server 341 controls traffic processing of the packet passing through the virtual router 342.

In the above-described embodiment, the term "~ unit" is not used as a term that refers to hardware classification of the security platform server 3. Therefore, a plurality of components may be integrated into one component, or one component may be divided into a plurality of components. Further, the configuration unit may mean a configuration unit of hardware, but may also mean a configuration unit of software. Therefore, it will be understood that the present invention is not particularly limited by the term "~ unit".

Although the present invention has been described by limited embodiments and drawings, the present invention is not limited thereto, and the technical idea of the present invention and claims to be described below by those of ordinary skill in the art to which the present invention pertains. Of course, various modifications and variations are possible within the uniform range of the range.

1: security platform system 2: target of protection
3: security platform server 201: user terminal
202: server 203: network device

Claims (19)

In the security platform device for controlling a security platform that provides a security solution suitable for each of a plurality of protection targets,
A security solution registration unit for registering a policy program on the server side and an agent program on the client side of the security solution from each of a plurality of vendors;
A permission information management unit that generates and manages permission information of an Internet Protocol (IP) address and a certificate permitting use of the security solution for each subscribed user;
A service portal for downloading and providing an installation program of the agent program selected by the user to a device to be protected by a user, and providing policy information of a security solution to an agent program executed on the device to be protected; And
A virtual machine unit that creates a virtual machine of a policy program on the server side in response to a service request of the agent program, and provides a security solution service to the agent program through the generated virtual machine
Security platform device comprising a. The method of claim 1,
The security solution registration unit,
A security platform device, characterized in that the security solution corresponding to at least one of a user terminal, a server, and a network device corresponding to the device to be protected is registered. The method of claim 1,
The installation program is generated by inserting the permission information into a copy of the agent program. The method of claim 1,
The service portal unit,
A download providing unit that provides a file download service for installation and version processing of the agent program at the request of the device to be protected; And
Policy information providing unit that provides information including monitoring, reporting, and policy application to the agent program executed in the device to be protected
Security platform device comprising a. The method of claim 1,
The permission information management unit,
An account management unit that manages accounts of members who have subscribed to the service of the security solution;
A certificate management unit for managing certificates for authentication of execution of the agent program; And
IP management unit that manages IP addresses for authentication of execution of the agent program
Security platform device comprising a. The method of claim 1,
The virtual machine unit,
And receiving the permission information from the agent program, performing authentication to the permission information management unit, and responding to an authentication result. The method of claim 2,
The device to be protected,
Security characterized by downloading and installing the agent program, transmitting an authentication request by executing the agent program, receiving policy information when authentication is successful, and executing security solution processing by reflecting the policy information Platform device. The method of claim 2,
The user terminal is provided with a security solution service including the prevention and treatment of viruses and unauthorized actions by the resident of the corresponding agent program,
The server is provided with a security solution service including the defense of unauthorized access and malicious behavior by the resident of the corresponding agent program,
The network device is characterized in that it receives a service of a security solution in which traffic monitoring and control processing is performed by the residence of a corresponding agent program, and communication of packets is controlled so that packets pass through the virtual router based on the virtual machine. Security platform device. In a security platform system that provides a security solution suitable for each of a plurality of protection targets using a security platform,
By providing a security platform, a policy program on the server side of the security solution and an agent program on the client side of the security solution are registered from each of the plurality of vendors, and the permission information of the IP (Internet Protocol) address and certificate that allows the use of the security solution is provided. It creates and manages each subscribed user, provides the installation program of the agent program selected by the user to a device to be protected by a user, and provides policy information of a security solution as an agent program executed on the device to be protected A security platform device that generates a virtual machine of the policy program in response to a service request of the executed agent program, and provides a security solution service to the agent program through the generated virtual machine; And
Protection target device that downloads the installation program and installs the agent program, and the executed agent program receives a service from the virtual machine and executes a security solution
A security platform system comprising a. The method of claim 9,
The device to be protected,
Security platform system, characterized in that corresponding to the user terminal, server or network device. In the security platform method for controlling a security platform in which a security platform device provides each security solution suitable for a protection target,
(a) a security solution registration step of registering a server-side policy program and a client-side agent program of the security solution from each of a plurality of vendors;
(b) a permission information management step of generating and managing permission information of an Internet Protocol (IP) address and a certificate permitting use of the security solution for each subscribed user;
(c) a portal service providing step of downloading and providing an installation program of the agent program selected by the user to a device to be protected by a user, and providing policy information of a security solution to an agent program executed on the device to be protected; And
(d) generating a virtual machine of a policy program on the server side in response to the service request of the agent program, and providing a virtual machine providing a security solution service to the agent program through the generated virtual machine. How to secure platform The method of claim 11,
The step (a),
The security platform method, characterized in that the step of registering the security solution corresponding to at least one or more protection targets from among a user terminal, a server and a network device corresponding to the device to be protected. delete The method of claim 11,
The portal service providing step,
A download providing step of providing a file download service for installation and version processing of the agent program at the request of the device to be protected; And
Policy information providing step of providing information including monitoring, reporting, and policy application to the agent program executed in the protection target device
Security platform method comprising a. The method of claim 11,
The step (b),
An account management step of managing accounts of members who have subscribed to the service of the security solution;
A certificate management step of managing a certificate for authentication of execution of the agent program; And
IP management step of managing IP addresses for authentication of execution of the agent program
Security platform method comprising a. The method of claim 11,
The step (d),
And receiving the authorization information from the agent program, performing authentication, and responding to an authentication result. The method of claim 11,
The device to be protected,
Security characterized by downloading and installing the agent program, transmitting an authentication request by executing the agent program, receiving policy information when authentication is successful, and executing security solution processing by reflecting the policy information Platform way. The method of claim 12,
Receiving, at the user terminal, a security solution service including prevention and treatment of viruses and unauthorized behaviors by resident of a corresponding agent program;
Receiving, by the server, a service of a security solution including protection of unauthorized access and malicious behavior by the resident of a corresponding agent program; And
The network device is provided with a service of a security solution in which traffic monitoring and control processing is carried out by the residence of a corresponding agent program, and communication of packets is controlled so that the packets pass through the virtual router based on the virtual machine.
Security platform method comprising a. delete

Images