KR102333028B1 - Apparatus and method for controling firewall policy - Google Patents

Abstract

A firewall policy control apparatus and method are disclosed. A firewall policy control apparatus according to an embodiment of the present invention includes a user information receiving unit that receives user information including user identification information and an Internet Protocol (IP) address of a user terminal from an authentication system that performs user authentication for network access. , a security policy management unit for storing security policy information for each user identification information including an allowed destination IP address for each of the one or more user identification information registered in advance, and the received user identification information among the security policy information for each user identification information A firewall policy control unit that identifies security policy information for a firewall, creates a firewall policy for one or more firewalls based on the identified security policy information and the user information, and applies the generated firewall policy to each of the one or more firewalls; include

Description

FIREWALL POLICY CONTROL APPARATUS AND METHOD FOR CONTROLING FIREWALL POLICY

Embodiments of the present invention relate to a technique for controlling a policy of a firewall.

Recently, ID-based firewalls that can set security policies in units of users and user groups are emerging by controlling network access based on user IDs authenticated through directory services such as Active Directory and Lightweight Directory Access Protocol (LDAP). .

However, existing IP-based firewalls do not support this function, so it is impossible to set security policies for each user and user group. There is a difficulty in checking and setting policies for all firewalls.

Korean Patent Registration No. 10-1415850 (2014.06.30. Announcement)

Embodiments of the present invention are to provide an apparatus and method for controlling a firewall policy.

A firewall policy control apparatus according to an embodiment of the present invention includes a user information receiving unit that receives user information including user identification information and an Internet Protocol (IP) address of a user terminal from an authentication system that performs user authentication for network access. , a security policy management unit for storing security policy information for each user identification information including an allowed destination IP address for each of the one or more user identification information registered in advance, and the received user identification information among the security policy information for each user identification information A firewall policy control unit that identifies security policy information for a firewall, creates a firewall policy for one or more firewalls based on the identified security policy information and the user information, and applies the generated firewall policy to each of the one or more firewalls; include

The one or more firewalls may include an IP-based firewall.

The user identification information may include at least one of a user ID and a user group ID.

The firewall policy control unit is configured to release the firewall policy so that the block on the network path is released for one or more firewalls existing on a network path between the IP address of the user terminal and the destination IP address included in the identified security policy information. can create

The firewall policy controller may identify one or more firewalls existing on the network path by using network topology information.

The user information may further include access location information, and the security policy information for each user identification information may further include access permitted location information.

The firewall policy controller may generate the firewall policy so that the block on the network path is released when the access location information and the access allowed location information included in the identified security policy information match.

The user information further includes a Service Set Identifier (SSID), and the firewall policy control unit releases the block on the network path when there is a wireless network service that can be provided based on the access location information and the SSID. The firewall policy can be created as much as possible.

The authentication system may include a RADIUS server that performs user authentication based on a Remote Authentication Dial-In User Service (RADIUS) protocol.

A firewall policy control method according to an embodiment of the present invention comprises the steps of: receiving user information including user identification information and an Internet Protocol (IP) address of a user terminal from an authentication system that performs user authentication for network access; Identifying security policy information for the received user identification information from among security policy information for each user identification information including an allowed destination IP address for each of one or more registered user identification information, the identified security policy information and the and generating a firewall policy for one or more firewalls based on user information, and applying the generated firewall policy to each of the one or more firewalls.

The one or more firewalls may include an IP-based firewall.

The user identification information may include at least one of a user ID and a user group ID.

In the generating, the firewall policy such that the block on the network path is released for one or more firewalls existing on the network path between the IP address of the user terminal and the destination IP address included in the identified security policy information. can create

In the generating, one or more firewalls existing on the network path may be identified using network topology information.

The user information may further include access location information, and the security policy information for each user identification information may further include access permitted location information.

The generating may include determining whether the access location information and the access permitted location information included in the identified security policy information match, and the access location information and the access permitted location included in the identified security policy information If the information matches, the method may include creating the firewall policy so that the block on the network path is released.

The user information further includes a Service Set Identifier (SSID), and the generating may include: determining whether a service that can be provided exists based on the access location information and the SSID; and the wireless network service that can be provided. and creating the firewall policy so that the block on the network path is released when .

The authentication system may include a RADIUS server that performs user authentication based on a Remote Authentication Dial-In User Service (RADIUS) protocol.

According to embodiments of the present invention, in conjunction with an authentication system that performs user authentication for network access, a firewall policy based on user identification information is automatically applied to the firewall, thereby improving the convenience of firewall operation.

Furthermore, according to embodiments of the present invention, by enabling the firewall policy setting for the IP-based firewall as well as the ID-based firewall using the user identification information obtained from the authentication system, ID-based control of the IP-based firewall is possible will do

Furthermore, according to embodiments of the present invention, by interworking with a RADIUS server, it is easy to set a firewall policy for a user accessing a wireless network.

1 is an exemplary diagram of a system environment 1 to which embodiments of the present invention are applied.
2 is a block diagram of a firewall policy control device according to an embodiment of the present invention;
3 is a flowchart of a firewall policy control method according to an embodiment of the present invention;
4 is a flowchart of a firewall policy control method according to another embodiment of the present invention;
5 is a flowchart of a firewall policy control method according to another embodiment of the present invention;
6 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in exemplary embodiments of the present invention;

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and/or systems described herein. However, this is only an example, and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification. The terminology used in the detailed description is for the purpose of describing embodiments of the present invention only, and should in no way be limiting. Unless explicitly used otherwise, expressions in the singular include the meaning of the plural. In this description, expressions such as “comprising” or “comprising” are intended to indicate certain features, numbers, steps, acts, elements, some or a combination thereof, and one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, acts, elements, or any part or combination thereof.

1 is an exemplary diagram of a system environment 1 to which embodiments of the present invention are applied.

Referring to FIG. 1 , a system environment 1 according to an embodiment of the present invention includes an authentication system 100 , a firewall policy control device 200 , a policy registration system 300 , and one or more firewalls 300 . .

The authentication system 100 authenticates a user who wants to access a wired/wireless network through a user terminal. Specifically, according to an embodiment of the present invention, the authentication system 100 may include a RADIUS server that performs user authentication based on, for example, a Remote Authentication Dial-In User Service (RADIUS) protocol. However, the present invention is not necessarily limited thereto, and according to an embodiment, the authentication system 100 includes one or more servers that perform identity-based user authentication, such as an Active Directory server, a Lightweight Directory Access Protocol (LDAP) server, and the like. can do.

Specifically, the authentication system 100, for example, from the network equipment (eg, AP (Access Point), switch, etc.) of the wired / wireless network to which the user wants to access user authentication information, such as a user ID and password. By receiving it, user authentication can be performed. In this case, user authentication may be performed, for example, through an Extensible Authentication Protocol (EAP) authentication method, but is not limited thereto, and may be performed in various ways depending on the authentication method employed in the authentication system 100 . have.

Meanwhile, when user authentication is successful, the authentication system 100 transmits user information about the corresponding user to the firewall policy control device 200 .

According to an embodiment of the present invention, the user information may include user identification information and an IP address of the user terminal. Also, the user identification information may include, for example, at least one of a user ID and a user group ID. In this case, the user ID may mean an ID for identifying a specific user, and the user group ID may mean an ID for identifying users belonging to a specific user group. In addition, a user group means, for example, a user group belonging to a specific department within the company, a user group corresponding to a specific position, a user group performing a specific job, etc. can

Meanwhile, according to an additional embodiment of the present invention, the user information may further include access location information, a service set identifier (SSID), and the like.

The firewall policy control device 200 receives the user information from the authentication system 100 to identify security policy information corresponding to the user identification information, and according to the user information and the identified security policy information, one or more firewalls 300 . Create a firewall policy. In this case, the firewall 300 may include an IP-based firewall that blocks network traffic based on the source IP and the destination IP included in the packet. However, the present invention is not limited thereto, and the firewall 300 may further include an ID-based firewall that blocks network traffic based on user identification information in addition to the IP-based firewall.

Meanwhile, the security policy corresponding to the user identification information may be registered in advance by the user through the policy registration system 400 , for example. Specifically, the policy registration system 400 may mean a system for each user to apply for security policy registration for himself/herself by inputting user identification information, destination IP address, access location, SSID, and the like. When a security policy registration is requested by a specific user, the policy registration system 400 transmits the information input by the user to the firewall policy control device 200 and provides security policy information for the user identification information input by the user. may be registered in the firewall policy control device 200 .

2 is a block diagram of an apparatus for controlling a firewall policy according to an embodiment of the present invention.

Referring to FIG. 2 , the firewall policy control apparatus 200 according to an embodiment of the present invention includes a user information acquisition unit 210 , a security policy management unit 220 , and a firewall policy control unit 230 .

The user information acquisition unit 210 receives user information including user identification information and an IP address of the user terminal from the authentication system 100 .

Specifically, the authentication system 100 performs user authentication for a user who wants to access the network, and when authentication is successful, transmits user information about the corresponding user to the user information acquisition unit 210, and the authentication is performed. In case of failure, network access for the user may be blocked.

Meanwhile, according to an embodiment of the present invention, the user information received from the authentication system 100 may include, for example, at least one of a user ID and a user group ID.

Meanwhile, according to an additional embodiment of the present invention, the user information may include various information usable for firewall policy control, such as an SSID and an access location, in addition to the above-described user identification information and the IP address of the user terminal.

The security policy management unit 220 stores security policy information for each user identification information for each of one or more previously registered user identification information.

Specifically, according to an embodiment of the present invention, the security policy management unit 220 may store security policy information for each of a user ID and a user group ID registered in advance through the policy registration system 400 .

Also, according to an embodiment of the present invention, the security policy information for each user identification information stored in the security policy management unit 220 may include one or more destination IP addresses allowed for each user identification information.

On the other hand, the information included in the security policy information is not limited to the destination IP address, and according to the embodiment, in addition to the destination IP address, for example, a connection allowed location, a destination port, a protocol (eg, TCP/IP, UDP, etc.) ), etc., may include various information that can be considered for firewall policy control.

Firewall policy control unit 230 based on the user information received through the user information acquisition unit 210 and the security policy information for each user identification information stored in the security policy management unit 220, the firewall policy for each of one or more firewalls (300) and apply the generated firewall policy to each firewall 300 .

Specifically, according to one embodiment of the present invention, the firewall policy control unit 230 is a security policy corresponding to the user identification information received from the authentication system 100 among the security policy information for each user identification information stored in the security policy management unit 220 . Policy information can be identified. For example, when a user ID is received from the authentication system 100 , the firewall policy control unit 230 may include security policy information corresponding to the received user ID among the security policy information for each user identification information stored in the security policy management unit 220 . can be identified.

As another example, when the user ID and user group ID are received from the authentication system 100 , the firewall policy control unit 230 may include the received user ID and user group among the security policy information for each user identification information stored in the security policy management unit 220 . Security policy information corresponding to each ID may be identified.

Meanwhile, according to an embodiment of the present invention, when the security policy information corresponding to the user identification information is identified, the firewall policy control unit 230 includes the IP address of the user terminal included in the user information and the identified security policy information. It is possible to identify one or more firewalls 300 existing on a network path between the destination IP addresses. In this case, the firewall 300 existing on the network path may be identified based on, for example, network topology information stored in advance.

Thereafter, the firewall policy control unit 230 may generate a firewall policy for each identified firewall 300 such that a block on a network path between the IP address of the user terminal and the destination IP address is released. Specifically, the firewall policy control unit 230 may create a firewall policy for each identified firewall 300 such that the IP address of the user terminal as the source and the blocking of the network traffic destined for the destination IP is released. . At this time, according to an embodiment of the present invention, the security policy control unit 230 provides information on each firewall 300 based on the identified product information (eg, model information, manufacturer information, etc.) for each firewall 300 . You can create an appropriate firewall policy.

Meanwhile, according to an embodiment of the present invention, when the access location information is included in the user information received from the authentication system 100 , the firewall policy control unit 230 includes the access location information in the identified security policy information. A firewall policy for one or more firewalls 300 may be created depending on whether it matches the established access allowed location.

For example, in the user information received from the authentication system 100, business place A is included as an access location along with the user ID and the IP address of the user terminal, but in the security policy information for the user ID, only business site B allows access. is registered, the firewall policy control unit 230 does not create a separate firewall policy. Accordingly, the network path between the IP address of the user terminal included in the user information and the destination IP address included in the security policy information may be blocked by the firewall 300 .

On the other hand, when business A is registered as an access allowed location in the security policy information for the corresponding user ID, the firewall policy control unit 230 controls the IP address of the user terminal included in the user information and the destination IP address included in the security policy information. By creating and applying a firewall policy for the firewalls 300 on the network path between them, it is possible to control the blocking of the corresponding network path to be released.

Meanwhile, according to an embodiment of the present invention, when the access location information and the SSID are included in the user information received from the authentication system 100 , the firewall policy control unit 230 controls the user based on the access location information and the SSID. It may be determined whether there is a wireless network service that can be provided to the terminal. At this time, if there is a wireless network service that can be provided, create and apply a firewall policy for the firewalls 300 on the network path between the IP address of the user terminal included in the user information and the destination IP address included in the security policy information By doing so, it is possible to control the blocking of the corresponding network path to be released.

On the other hand, when there is no wireless network service that can be provided to the user terminal, the firewall policy controller 230 does not create a separate firewall policy. Accordingly, the network path between the IP address of the user terminal included in the user information and the destination IP address included in the security policy information may be blocked by the firewall 300 .

On the other hand, in one embodiment, the user information acquisition unit 210, the security policy management unit 220 and the firewall policy control unit 230 shown in Figure 1 includes one or more processors and a computer-readable recording medium connected to the processor It may be implemented on one or more computing devices. The computer-readable recording medium may be internal or external to the processor, and may be connected to the processor by various well-known means. A processor within the computing device may cause each computing device to operate in accordance with the exemplary embodiments described herein. For example, the processor may execute instructions stored in a computer-readable recording medium, and the instructions stored in the computer-readable recording medium, when executed by the processor, cause the computing device to operate according to the exemplary embodiments described herein. can be configured to perform

3 is a flowchart of a firewall policy control method according to an embodiment of the present invention.

The method illustrated in FIG. 3 may be performed, for example, by the firewall policy control apparatus 200 illustrated in FIG. 2 .

Referring to FIG. 3 , first, the firewall policy control apparatus 200 receives user information including user identification information and an IP address of a user terminal from the authentication system 100 ( 310 ). In this case, the user identification information may include, for example, at least one of a user ID and a user group ID.

Thereafter, the firewall policy control apparatus 200 identifies security policy information for the received user identification information from among the security policy information for each user identification information ( 320 ). In this case, the security policy information for each user identification information may include, for example, a destination IP address allowed for each pre-registered user identification information.

On the other hand, when the security policy information for the received user identification information does not exist, the firewall policy control apparatus 200 ends the creation of the firewall policy ( 330 ).

On the other hand, when the security policy information for the received user identification information exists, the firewall policy control device 200 creates a firewall policy for one or more firewalls based on the received user information and the identified security policy information (340) ). Specifically, the firewall policy control device 200 identifies one or more firewalls existing in a network path between the user terminal IP address received as user information and the destination IP address included in the identified security policy information, based on the network topology information. and create a firewall policy for each firewall so that the identified firewalls unblock the corresponding network path. In this case, the firewall policy control apparatus 200 may generate a firewall policy suitable for each firewall based on the identified product information (eg, model information, manufacturer information, etc.) of each firewall.

Thereafter, the firewall policy control apparatus 200 applies the generated firewall policy to each identified firewall ( 350 ).

4 is a flowchart of a firewall policy control method according to another embodiment of the present invention.

The method illustrated in FIG. 4 may be performed, for example, by the firewall policy control apparatus 200 illustrated in FIG. 2 .

Referring to FIG. 4 , first, the firewall policy control apparatus 200 receives user information including user identification information, a user terminal IP address, and an access location from the authentication system 100 ( 410 ). In this case, the user identification information may include, for example, at least one of a user ID and a user group ID.

Thereafter, the firewall policy control apparatus 200 identifies security policy information for the received user identification information from among the security policy information for each user identification information ( 420 ). In this case, the security policy information for each user identification information may include, for example, a destination IP address and an access permission location allowed for each pre-registered user identification information.

On the other hand, when the security policy information for the received user identification information does not exist, the firewall policy control apparatus 200 ends the creation of the firewall policy ( 430 ).

On the other hand, when the security policy information for the received user identification information exists, the firewall policy control device 200 determines whether the access location included in the user information matches the access allowed location registered in the identified security policy information do (440).

At this time, if they match, the firewall policy control device 200 creates a firewall policy for one or more firewalls based on the received user information and the identified security policy information ( 450 ). Specifically, the firewall policy control device 200 identifies one or more firewalls existing in a network path between the user terminal IP address received as user information and the destination IP address included in the identified security policy information, based on the network topology information. and create a firewall policy for each firewall so that the identified firewalls unblock the corresponding network path. Also, the firewall policy control apparatus 200 may generate a firewall policy suitable for each firewall based on the identified product information (eg, model information, manufacturer information, etc.) of each firewall.

Thereafter, the firewall policy control device 200 applies the generated firewall policy to each identified firewall ( 460 ).

Meanwhile, in step 440 , when the access location included in the user information does not match the access permitted location registered in the identified security policy information, the firewall policy control device 200 ends the firewall policy creation.

5 is a flowchart of a firewall policy control method according to another embodiment of the present invention.

The method illustrated in FIG. 5 may be performed, for example, by the firewall policy control apparatus 200 illustrated in FIG. 2 .

Referring to FIG. 5 , first, the firewall policy control apparatus 200 receives user information including user identification information, access location information, a user terminal IP address, and an SSID from the authentication system 100 ( 510 ). In this case, the user identification information may include, for example, at least one of a user ID and a user group ID.

Thereafter, the firewall policy control apparatus 200 identifies security policy information for the received user identification information from among the security policy information for each user identification information ( 520 ). In this case, the security policy information may include, for example, a destination IP address allowed for each pre-registered user identification information.

On the other hand, when the security policy information for the received user identification information does not exist, the firewall policy control apparatus 200 ends the creation of the firewall policy (530).

On the other hand, when the security policy information for the received user identification information exists, the firewall policy control apparatus 200 determines whether a wireless network service that can be provided to the user terminal exists based on the access location information and the SSID included in the user information. is determined (540).

In this case, if there is a wireless network service that can be provided, the firewall policy control apparatus 200 creates a firewall policy for one or more firewalls based on the received user information and the identified security policy information ( S550 ). Specifically, the firewall policy control device 200 identifies one or more firewalls existing in a network path between the user terminal IP address received as user information and the destination IP address included in the identified security policy information, based on the network topology information. and create a firewall policy for each firewall so that the identified firewalls unblock the corresponding network path. Also, the firewall policy control apparatus 200 may generate a firewall policy suitable for each firewall based on the identified product information (eg, model information, manufacturer information, etc.) of each firewall.

Thereafter, the firewall policy control device 200 applies the generated firewall policy to each identified firewall ( 560 ).

Meanwhile, in step 540 , when there is no wireless network service that can be provided to the user terminal, the firewall policy control apparatus 200 ends the creation of the firewall policy.

On the other hand, in the flowcharts shown in FIGS. 3 to 5, the network access control process is described by dividing the process into a plurality of steps, but at least some of the steps are performed in a different order, are performed in combination with other steps, are performed together, are omitted, or detailed steps are performed. It may be performed by being divided into , or one or more steps not shown may be added and performed.

6 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in exemplary embodiments of the present invention. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

The illustrated computing environment 10 includes a computing device 12 . In one embodiment, the computing device 12 includes, for example, the firewall policy control device 100 such as the user information acquisition unit 210, the security policy management unit 220 and the firewall policy control unit 230 shown in FIG. 2 . It may be one or more components included in .

Computing device 12 includes at least one processor 14 , computer readable storage medium 16 , and communication bus 18 . The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiments discussed above. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16 . The one or more programs may include one or more computer-executable instructions that, when executed by the processor 14, configure the computing device 12 to perform operations in accordance with the exemplary embodiment. can be

Computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. The program 20 stored in the computer readable storage medium 16 includes a set of instructions executable by the processor 14 . In one embodiment, computer-readable storage medium 16 includes memory (volatile memory, such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash It may be memory devices, other forms of storage medium accessed by computing device 12 and capable of storing desired information, or a suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12 , including processor 14 and computer readable storage medium 16 .

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24 . The input/output interface 22 and the network communication interface 26 are coupled to the communication bus 18 . Input/output device 24 may be coupled to other components of computing device 12 via input/output interface 22 . Exemplary input/output device 24 may include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices, and/or imaging devices. input devices and/or output devices such as display devices, printers, speakers and/or network cards. The exemplary input/output device 24 may be included in the computing device 12 as a component constituting the computing device 12 , and may be connected to the computing device 12 as a separate device distinct from the computing device 12 . may be

Although representative embodiments of the present invention have been described in detail above, those of ordinary skill in the art to which the present invention pertains will understand that various modifications are possible without departing from the scope of the present invention with respect to the above-described embodiments. . Therefore, the scope of the present invention should not be limited to the described embodiments, and should be defined by the claims described below as well as the claims and equivalents.

10: Computing Environment
12: computing device
14: Processor
16: computer readable storage medium
18: communication bus
20: Program
22: input/output interface
24: input/output device
26: network communication interface
100: authentication system
200: firewall policy control device
210: user information acquisition unit
220: security policy management unit
230: firewall policy control section
300: firewall
400: policy registration system

Claims (18)

a user information receiving unit for receiving user information including user identification information and an Internet Protocol (IP) address of a user terminal from an authentication system that performs user authentication for network access;
a security policy management unit configured to store security policy information for each user identification information including a destination IP address allowed for each of one or more previously registered user identification information; and
Identifies security policy information for the received user identification information from among the security policy information for each user identification information, and based on the identified security policy information and the user information, the IP address of the user terminal and the identified security policy information Identifies one or more firewalls existing on a network path between destination IP addresses included in A firewall policy control device comprising a firewall policy control unit that applies to each of one or more firewalls.
The method according to claim 1,
The one or more firewalls, a firewall policy control device comprising an IP-based firewall.
The method according to claim 1,
The user identification information includes at least one of a user ID and a user group ID.
delete The method according to claim 1,
The firewall policy control unit is configured to identify one or more firewalls existing on the network path by using network topology information.
The method according to claim 1,
The user information further includes access location information,
The security policy information for each user identification information, the firewall policy control device further includes access allowed location information.
7. The method of claim 6,
The firewall policy control unit, when the access location information and the access allowed location information included in the identified security policy information match, the firewall policy control device to generate the firewall policy so that the block on the network path is released.
7. The method of claim 6,
The user information further includes a Service Set Identifier (SSID),
The firewall policy controller is configured to generate the firewall policy so that, when there is a wireless network service that can be provided based on the access location information and the SSID, blocking of the network path is released.
The method according to claim 1,
The authentication system, a firewall policy control device including a RADIUS server for performing a RADIUS (Remote Authentication Dial-In User Service) protocol-based user authentication.
Receiving user information including user identification information and an Internet Protocol (IP) address of a user terminal from an authentication system that performs user authentication for network access;
identifying security policy information for the received user identification information from among security policy information for each user identification information including a destination IP address allowed for each of one or more pieces of previously registered user identification information;
Identifies one or more firewalls existing on a network path between the IP address of the user terminal and the destination IP address included in the identified security policy information based on the identified security policy information and the user information, and the identified one creating a firewall policy so that the block on the network path is released for the above firewall; and
and applying the generated firewall policy to each of the one or more firewalls.
11. The method of claim 10,
The one or more firewalls, a firewall policy control method comprising an IP-based firewall.
11. The method of claim 10,
The user identification information includes at least one of a user ID and a user group ID.
delete 11. The method of claim 10,
In the generating, the firewall policy control method identifies one or more firewalls existing on the network path by using network topology information.
11. The method of claim 10,
The user information further includes access location information,
The security policy information for each user identification information, firewall policy control method further comprising access allowed location information.
16. The method of claim 15,
The generating may include: determining whether the access location information matches the access location information included in the identified security policy information; and
and generating the firewall policy so that the block on the network path is canceled when the access location information and the access allowed location information included in the identified security policy information match.
16. The method of claim 15,
The user information further includes a Service Set Identifier (SSID),
The generating may include: determining whether a wireless network service that can be provided exists based on the access location information and the SSID; and
and generating the firewall policy so that the block on the network path is released when the available wireless network service exists.
11. The method of claim 10,
The authentication system includes a RADIUS server for performing remote authentication dial-in user service (RADIUS) protocol-based user authentication.

Images