KR102379720B1 - System for controlling data flow in virtualization terminal and method of the same - Google Patents

Abstract

Disclosed are a system for controlling data flow in a virtualization terminal to allow a virtualization terminal to perform communication with permitted networks only through permitted applications and a method thereof. According to one embodiment of the present invention, a network system comprises: a remote terminal; a virtualization terminal communicatively connected to the remote terminal, enabling a user to be connected through the remote terminal, and including an access control application; an external server communicatively connected to the remote terminal, a virtualization server, the virtualization terminal; and a business network communicatively connected to the virtualization terminal through the access control application. The virtualization terminal detects a network access event of the virtualization terminal to the business network through the access control application, checks whether there is a data flow corresponding to the business network and authorized from an external server through the access control application, transmit a data packet to the business network when the authorized data flow exists, and drops a data packet when the authorized data flow does not exist or is invalid. The external server generates the data flow on the basis of whether identification information requested for network access in an access policy matched with information identified on a control flow is accessible to the business network and transmits the generated data flow to the virtualization terminal.

Description

A system for controlling data flow in a virtualization terminal and a method therefor

Embodiments disclosed in this document relate to a system for controlling a data flow in a virtualization terminal and a method therefor.

Cloud or specialized server is used to reduce various security risks that can be introduced from the outside in network separation or network connection, and to provide a work environment for each user with devices with minimum specifications anytime, anywhere. A virtualized work environment (Virtual Desktop Infrastructure or Cloud Desktop) is being used.

The demand for such an indirect work environment is increasing as non-face-to-face work increases in recent years. By providing an indirect business network access structure that accesses and accesses the business network in a virtualized business environment accessed by authorized users, it is possible to minimize the problem of direct propagation of various security problems inherent in terminals connected to the Internet to the business network. There are advantages that can be

However, various security problems (e.g., malware, ransomware, etc.) inherent in terminals connected to the Internet, even if various file transfer control functions are blocked in the virtualized work environment, the vulnerability of the client to access the virtualized work environment Users connected to the virtualized work environment can view files that contain malware that has not been detected by vaccines, such as attacks or attempts to access the virtualized work environment directly through leakage of authentication information, e-mail, or spear phishing existing in-house file servers. In a virtualized business environment, there is still a problem that an attack on the business network is possible through the execution of applications with inherent security problems.

In a virtualized work environment, data flow-based access control technology is required to minimize security risks that are not detected by vaccines such as various malware and ransomware.

In general, in the case of a data flow access control technology based on tunneling or a secure session, a gateway for controlling connectivity between a terminal and a server should exist. Referring to FIG. 1 as an example of a tunneling technique, a source node 101 between different first and second networks 10 and 20 attempts to access the second network 20 and the second network ( When transmitting data to the destination node 102 included in 20 ), the source node 101 may transmit the data to the destination node 102 through the switch 103 and the tunnel 105 .

However, in the case of a virtualized business environment, there is a high probability that the virtualized business environment and the business network are located on the same network. Since it is not easy to install a security solution based on a physical network boundary in an existing environment, there is a problem in that it is difficult to establish an additional network boundary.

Therefore, it is necessary to perform data flow access control of a virtualized terminal only by an access control application existing in the terminal in an environment where it is difficult to control access through tunneling or a secure session at the network boundary.

In such an environment, when the access control application that performs the actual network access control of the terminal is terminated due to a hijacker, a user with a malicious purpose, a vulnerability in the access control application, etc., the virtualized terminal is transferred to the business network without data flow control. It is in a state where it can be always accessed, and as there is no method to identify it at the network boundary as above, the data flow access control technology is incapacitated.

In addition, the hijacker installs a backdoor after acquiring control of the virtualized terminal environment to create a means to control the virtualized terminal environment at all times through a client other than the virtualized business environment access client, and creates a risk to the business network at all times A state can be created to propagate

Various embodiments disclosed in this document provide a data flow-based access control technology in a virtualized work environment to block unauthorized network access, to forcibly terminate an access control application to prevent a state of being able to always access the network, and to It is intended to provide a method to solve the above problems by allowing access only to clients accessing the business environment.

In addition, various embodiments disclosed in this document are allowed by controlling all data packets transmitted or received to the virtualization terminal through the access control application for data flow-based access control to the virtual terminal that does not create tunneling or secure sessions We want to provide a way to communicate with only allowed networks.

A network system according to an embodiment disclosed in this document includes a remote terminal; A virtualization server communicatively connected to the remote terminal, comprising a virtualization terminal that a user accesses through the remote terminal and includes an access control application; an external server communicatively connected to the remote terminal, the virtualization server, and the virtualization terminal; and a business network that is communicatively connected through the virtualization terminal and the access control application, wherein the virtualization terminal detects a network access event for the business network of the virtualization terminal, through the access control application, Through the access control application, it is checked whether there is an authorized data flow corresponding to the work network and from an external server, and if the authorized data flow exists, a data packet is transmitted to the work network, and the authorized data If the flow does not exist or is invalid, the data packet is dropped, and the external server determines whether the identification information that requested network access in the access policy matched with the information identified on the control flow is accessible to the business network. It is possible to generate the data flow based on the data flow, and transmit the generated data flow to the virtualization terminal.

According to one embodiment, the virtualization terminal, the application execution or execution end of the operating system of the virtualization server for provisioning the virtualization terminal, a network listening request event or periodically inspects the network listening list, and the network listening port and Checks application information to check whether a receivable network whitelist exists, and if the network whitelist does not exist, performs a validation procedure according to a validation policy, and identifies the external server and the generated control flow to request a network whitelist from the external server based on a list of control flow identification information, reception application identification information, and service port information for, the external server, in response to the request of the network whitelist, the reception application In the case of an abnormal application or reception state in the access policy, make a request to limit the use of the virtualization terminal to the virtualization server, and the virtualization server, in response to the request to limit the use, terminate the virtualization terminal there is.

According to one embodiment, when it is impossible to access the business network, the virtualization server provisioning the virtualization terminal may limit the use of the virtualization terminal.

According to one embodiment, the virtualization terminal, the control flow identified based on the control flow identification information when detecting a controller connection termination event that the virtualization terminal or the access control application is terminated or does not update the data flow, Removes, removes all dependent data flows when the control flow is removed, makes the remote terminal using the data flow no longer able to access the virtualization terminal, and restricts the use of the virtualization terminal In this case, it is possible to make a request to limit the use of a virtualization terminal to the virtualization server.

According to an embodiment, the external server is based on the virtualization terminal access client's connection state, the access control application connection state in the remote terminal, the access control application access state and risk detection information in the virtualization terminal, virtualization server policy Accordingly, it is possible to block all network connections of the virtualization terminal immediately or to block the idle virtualization terminal from accessing the network by removing the virtualization terminal through the virtualization server.

According to an embodiment, the remote terminal detects a virtual terminal connection client network connection termination event, and requests the virtual terminal connection client network connection termination processing to the external server, and the external server is an invalid remote terminal In order to block access to the virtualization terminal, it may be possible to remove the data flow of the remote terminal that the virtualization terminal receives.

According to one embodiment, the virtualization terminal, when the user information logged into the remote terminal and the virtualization terminal is not the same, it can be to release the network connection.

According to one embodiment, when the system of the virtualization terminal is started, the access control application is automatically executed, it can be automatically connected to the external server.

According to an embodiment, the external server periodically checks the list of virtualization terminals to be updated in the virtualization terminal table in order to update the provisioned virtualization terminal or the removed virtualization terminal information in the virtualization server, and a list of virtualization terminals in each virtualization server By requesting an inquiry, the virtualization terminal table is updated based on the virtualization terminal list returned from the virtualization server, and when the virtualization terminal is removed from the virtualization terminal table, the control flow information generated by the virtualization terminal is can be removed.

The virtualization server existing in the same network as the business network that the remote terminal wants to access according to an embodiment disclosed in this document includes a non-transitory computer-readable storage medium in which instructions are stored, and the instructions are transmitted to the virtualization terminal by the processor. Executed, the virtualization terminal, through the access control application, detects a network access event to the business network, and through the access control application, corresponds to the business network and confirms whether there is a data flow authorized from an external server When the authorized data flow exists, the data packet is transmitted to the business network, and when the authorized data flow does not exist or is invalid, the data packet is dropped (DROP), and the data flow is By the external server, the information identified on the control flow may be generated based on whether the identification information that requested network access in the matching access policy is accessible to the business network.

According to the embodiments disclosed in this document, the application allowed by controlling all data packets transmitted or received to the virtualization terminal through the access control application for data flow-based access control to the virtualization terminal that does not create tunneling or secure sessions It can only provide a way to communicate with allowed networks.

Through this, it is possible to block dangerous applications that are not identified by vaccines or malware detection tools existing in the virtualization terminal from accessing unauthorized networks.

In particular, detailed access control is possible for each virtual terminal and each user by controlling the virtualized terminal provisioned for each user and the applications and networks that the user can use. Security can be improved because virtualization terminals with data flow-based access control can be extended according to flexible scalability, which is a feature of the virtualization environment and architecture defined as .

In addition, in the virtualization terminal, the access control application is executed from the start of the system to generate the controller access and control flow, and the network connection status of the terminal is detected in real time, and the controller periodically receives the virtualization terminal list provisioned from the virtualization server and If the control flow has not been updated or there is a virtual terminal that does not have a control flow by inspection, the virtual terminal is removed through the virtualization server, so network access using the virtual terminal is blocked without running the access control application. can

Furthermore, the virtualization terminal includes a server for remotely controlling the terminal, and the server application has a problem that there is no method to control reception from a non-allowed target, but the allowed remote terminal, user, and application It is possible to prevent an unacceptable target from attempting to access a virtualized terminal by identifying it in advance and providing a structure that allows mutual access. Therefore, secure access can be ensured even in an environment of credential stuffed users.

In particular, the virtual terminal and the remote terminal constantly monitor whether the virtual terminal access client is connected and, when the connection is terminated, immediately release the data flow of the virtual terminal, which is in an idle state, so that latent malware enters the network. It blocks access attempts and can isolate the access of the virtual terminal by removing the virtual terminal according to the policy.

Furthermore, by constantly monitoring the network reception of the virtualization terminal and blocking the network reception other than the service port of the allowed application, it provides a method of blocking access to the virtualization terminal through a latent backdoor.

In addition, the virtualization terminal periodically updates the control flow, and the controller determines whether to maintain the connection of the virtualization terminal based on various risk detection information transmitted by the virtualization terminal, and when a risk is detected, network connection between the virtualization terminal and the remote terminal At the same time, the virtualization terminal is immediately removed from the virtualization server to block the risk from propagating to the network.

As a result, in an environment where data flow-based access control is performed on virtualized terminals that do not create tunneling or secure sessions, a network isolation system is provided through virtualization server-based virtualization terminal control as a network isolation means when various risks are detected, and each virtualization terminal and remote It is possible to provide a safe virtualized work environment at all times by performing data flow-based access control utilizing the characteristics between terminals.

In addition, various effects directly or indirectly identified through this document may be provided.

1 shows an example of a tunneling technique.
2 illustrates an architecture within a network environment in accordance with various embodiments.
3 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure;
4 illustrates a functional block diagram of a node in accordance with various embodiments.
5 may explain an operation of blocking a network connection according to various embodiments of the present disclosure.
6 illustrates a signal flow diagram for system startup according to various embodiments.
7 illustrates a signal flow diagram for controller connection according to various embodiments.
8 illustrates a signal flow diagram for user authentication according to various embodiments of the present disclosure.
9 shows a signal flow diagram for handling a network connection (data packet transmission).
Fig. 10 shows a signal flow diagram for processing a network connection (data packet reception).
11 is a flowchart for examining a network reception list according to various embodiments.
12 is a flowchart for updating a control flow according to various embodiments.
13 is a flowchart for terminating a controller connection according to various embodiments of the present disclosure;
Figure 14 shows a signal flow diagram for a virtual terminal connection client network connection termination (virtualization terminal side) according to various embodiments.
Figure 15 shows one signal flow diagram for the virtual terminal connection client network connection termination (remote terminal side) according to various embodiments.
16 shows a signal flow diagram for updating a virtualization terminal table according to various embodiments.
17 shows a user interface screen when the virtualization terminal is disconnected.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, it is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

In this document, the singular form of a noun corresponding to an item may include one item or a plurality of items unless the context clearly dictates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A; Each of the phrases such as "at least one of B, or C" may include any one of, or all possible combinations of, items listed together in the corresponding one of the phrases. Terms such as “first”, “second”, or “first” or “second” may simply be used to distinguish a component from another component in question, and refer to the component in another aspect (e.g., importance or order) is not limited. One (eg, first) component is referred to as “coupled” or “connected” to another (eg, second) component, with or without the terms “functionally” or “communicable”. When referenced, it means that one component can be coupled to another component directly (eg, by wire), wirelessly, or through a third component.

Each component (eg, a module or a program) of components described in this document may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to integration. According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repeatedly, or heuristically, or one or more of the operations are executed in a different order, omitted, or , or one or more other operations may be added.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit of a part or a part thereof that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or an application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one of the one or more instructions stored from the storage medium and execute it. This enables the device to be operated to perform at least one function according to at least one command called. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not include a signal (eg, electromagnetic wave), and this term refers to the case where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

Methods according to various embodiments disclosed in this document may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg, compact disc read only memory (CD-ROM)), or via an application store or between two user devices (eg, smartphones). It may be distributed directly, online (eg, downloaded or uploaded). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

2 illustrates an architecture within a network environment in accordance with various embodiments.

Referring to FIG. 2 , the number of the remote terminal 201 , the gateway 203 , the virtualization server 204 , and the business network 206 is not limited to the number shown in FIG. 2 . For example, the remote terminal 201 may transmit data to a plurality of business networks through a plurality of gateways, and the controller 202 manages the plurality of terminals 201 , the gateway 203 , and the destination node 204 . can do

According to an embodiment, the remote terminal 201 includes a connection control application 211 and a network driver 212 for all network access control for applications in the terminal. When a network connection occurs, the terminal checks whether access is possible from the controller, and only when access is possible, the terminal can transmit the data packet to the gateway existing at the boundary of the access target network through the data flow information generated by the controller. Data flow-based connectivity control technology provides a structure in which communication is possible only when there is a data flow authorized by the controller 202 in order for the virtualization terminal 205 to access the business network 206, and the data flow exists. If not, the virtualization terminal 205 may provide a structure in which communication cannot be performed. For example, the access control applications 211 and 251 may control the transmission of data packets in the terminals 201 and 205 through a kernel including an operating system and a network driver.

All applications of the terminals 201 and 205 are controlled by the access control applications 211 and 251 when network access is desired. The access control applications 211 and 251 may include a part operating as a kernel and a network driver for network access control of all applications of the terminal. As an example of the application's network access control, it is possible to run an Internet browser and input and call a web address to be accessed.

When a network access request is received, the access control applications 211 and 251 may identify the access requesting application, destination IP, and service port information, and check whether there is valid data flow information that can be used as the corresponding identification information in the data flow table.

The data flow table may provide information for determining whether a data packet can be transmitted for each connection and management unit.

If data flow information is available, data packets can be transmitted.

If the data flow information does not exist, a validation procedure may be performed according to the validation policy. Validation checks the integrity and safety of the access-requested application (application forgery or falsification, code signing check, fingerprint check, etc.), and according to the access policy received from the controller 202, It is possible to perform a procedure to check in advance whether the connection is possible. If the validation check fails, the data packet may be dropped (DROP) and a connection unavailable message and a reason may be displayed on the access control applications 211 and 251 . When the validation check is successful, the terminal performs an access request to the controller 202 and may transmit each identification information (access application, access target IP, service port information, etc.) upon request.

The controller 202 may be a server (or cloud server). The controller 202 is a network connection and virtualization terminal, such as a gateway 203 existing between the remote terminal 201 and the virtualization terminal 205 for accessing the virtualization terminal 205 provisioned in the virtualization server 204 at a remote location. (205) may perform network access control. The controller 202 may be communicatively connected to another interworking security system 207 .

In the access policy matched with the information identified on the control flow (terminal, user, source network information, etc.), the controller 202 determines whether the access request identification information (access application and connection target IP and service port information, etc.) is included, and You can check whether the connection is possible. If access is not possible, the controller 202 may transmit a result of being unable to connect to the terminal, and the access control applications 211 and 251 may drop the corresponding data packet and display the message and reason for not being able to access.

The access control applications 211 and 251 may check the result of the access request received from the controller 202 .

The access control applications 211 and 251 receiving the data flow information may transmit a data packet to the service server.

Through this procedure, the application is basically blocked from the destination network (eg, the business network), and an environment is provided in which only data packets included in the data flow table allowed through the authorization process of the controller 202 can be transmitted. .

Through a procedure similar to data packet transmission control, the access control application identifies the virtual terminal access client requesting access from the remote terminal 201 and allows the allowed target to be accessed through the control server included in the virtualization terminal 205. there is.

Through this process, an environment that can block the access of the non-allowed virtual terminal access client or block the access of the non-allowed server role performing application running in the virtualization terminal 205 can be provided.

The gateway 203 checks 5 tuples information among the data packets received through the authorized tunnel 210 among the received data packets. If data flow information corresponding to the source IP, destination IP, and destination port information exists, the data packet may be forwarded to the virtualization server 204 .

The virtualization server 204 may forward data packets between the gateway 203 and the business network 206 . The virtualization server 204 may include a management service and a virtualization terminal (eg, "virtualization terminal #1", "virtualization terminal #2", etc. in FIG. 2).

The virtualization terminal 205 may include an access control application 251 , a business application 252 , and a network driver (not shown) for all network access control for applications in the terminal 201 . The virtualization terminal 205 checks whether access is possible from the controller 202 when a network connection occurs, and only when it is accessible, through the data flow information generated by the controller 202, to the destination network (eg, the business network 206). Data packets can be transmitted.

In addition, an embodiment according to this document is in connection with the virtualization server 204, and in various elements such as remote terminal 201 and virtualization terminal 205, gateway 203 through the control of the provisioned virtualization terminal 205 It is possible to provide a method for maintaining a secure network state at all times, such as removal of the data flow generated according to the received security event and removal of the virtualization terminal 205 .

3 is a functional block diagram illustrating a database stored in a controller (eg, controller 202 of FIG. 2 ) in accordance with various embodiments. 3 shows only the memory 330 , the controller includes a communication circuit for performing communication with an external electronic device (eg, the communication circuit 430 of FIG. 4 ) and a processor (eg, FIG. 4 ) for controlling the overall operation of the controller. It may further include a processor 410 of 4).

Referring to FIG. 3 , the controller may store databases 311 to 319 for controlling network access and data transmission in the memory 330 .

Since the administrator can access the controller 202 and set an access-oriented policy for controlling access between the source and destination, more detailed network access control than the existing NAC (Network Access Control) and firewall is possible.

The access policy database 311 is an identified network, a terminal, a user, a non-identified user (guest), a network and services to which an application can be accessed, and a network, a terminal, and a user identified based on the corresponding policy when the terminal requests a network access. information can be checked.

The tunnel policy database 312 provides information on the type and encryption method and level of the tunnel 210 to be connected to the gateway 203 that the source node (remote terminal 201) will connect to the gateway 203 on the access path on the access path according to the access policy. In addition, when the remote terminal 201 requests a network access, it is possible to provide an optimal tunnel for accessing a target network or node based on a corresponding policy.

The blacklist policy database 313 is based on information (terminal, IP, MAC address, user, etc.) identified through the risk level and occurrence cycle of security events among security events periodically collected from the terminal or gateway, and behavior analysis. A blacklist registration policy can be set to permanently or temporarily block the access of the terminal.

The blacklist database 314 includes the terminal 201, IP address, MAC address, user, etc. whose access is blocked by the blacklist policy, and the terminal is included in the list when requesting access to the controller. Since the connection request is rejected, it may be in a state of complete isolation in which network access is impossible.

The control flow table 315 is a kind of session table for managing the flow generated between the terminal and the controller. When the terminal successfully accesses the controller, identification information for identifying the control flow and the control flow is generated. It includes information such as IP address, terminal identification information, and user identification information respectively identified during controller access and authentication.

The control flow identification information transmitted when the terminal requests network access and each identification information included in the control flow searched by the identification information are mapped with an access policy to determine whether access is possible and whether a data flow is created. Can be used as information .

The terminal must periodically update the expiration time of the control flow, and if the update is not performed for a certain period of time, the control flow is removed. In addition, when immediate access blocking is required according to the risk level of security events collected from terminals and gateways, control flows are removed according to terminal access termination requests, and when the control flows are removed, all generated data flows are recovered. All connections of the terminal may be blocked.

The tunnel table 316 is a table for managing a gateway and a tunnel connected between the gateways. The tunnel table 316 is a table for managing a tunnel connected between the gateway on the first network side and the gateway on the second network side. When a valid tunnel exists, tunnel identification information for managing and identifying the tunnel, the gateway and the controller It may be composed of control flow identification information for control between the two, and additional information for managing TEP (tunnel end point), TSP (tunnel start point), tunnel algorithm and type, and the like.

The data flow table 317 is a table for managing the flow in which detailed data packets are transmitted between the terminal and the gateway, and controls the flow in a TCP session created in a terminal or IP unit or an application of a source terminal and a more detailed management unit. In the case of data flow identification information that can be managed and that is dependent on the control flow, application identification information for identifying the data flow of the authorized target, source IP, destination IP, It may include detailed management unit information such as a service port. The data flow table structure included in the controller 202 may be equally applied to each of the terminals 201 and 205 and the gateway 203 . The network whitelist stored in the virtualization terminal 205 includes application and port information that the terminal can receive.

Virtualization server policy database 318 is a series of network policy information for identifying API (Application Programming Interface) access, authentication information, virtualization terminal 205 of the virtualization server 204 for provisioning the virtualization terminal 205, Includes identification information grant method, virtualization terminal 205 removal (or recovery) condition policy, etc. according to various risks and exceptions when controlling virtualization terminal access, and based on this information, the virtualization terminal 205 in which the risk is detected immediately can be removed from the network.

Virtualization terminal table 319 is a set of information (eg, MAC address, IP address, virtualization server 204) for identifying the virtualization server 204 identification information and the virtualization terminal 205 in which the virtualization terminal 205 is provisioned. Instance identification information to manage, etc.) and the identified state of the virtualization terminal 205 (eg, during rebooting, termination, etc.) may include information.

In addition, the data flow table structure included in the controller 202 may be applied to the terminals 201 and 205 and the gateway 203 in the same or similar manner.

4 illustrates a functional block diagram of a node in accordance with various embodiments. Referring to FIG. 4 , a node may be a terminal 201 , a gateway 203 , a virtualization server 204 , and a business network 206 , and a processor 410 , a memory 420 , and a communication circuit 430 . may include According to an embodiment, the node may further include a display 440 to interface with the user.

The processor 410 may control the overall operation of the terminal 201 . In various embodiments, the processor 410 may include one processor core or a plurality of processor cores. For example, the processor 410 may include a multi-core such as a dual-core, a quad-core, or a hexa-core. According to embodiments, the processor 410 may further include a cache memory located internally or externally. According to embodiments, the processor 410 may be configured with one or more processors. For example, the processor 410 may include at least one of an application processor, a communication processor, and a graphical processing unit (GPU).

All or part of the processor 410 is electrically or operatively coupled to other components within the node (eg, memory 420 , communication circuitry 430 , or display 440 ). It can be coupled with or connected to. The processor 410 may receive commands from other components of the node, interpret the received commands, and perform calculations or process data according to the interpreted commands. The processor 410 may interpret and process a message, data, command, or signal received from the memory 420 , the communication circuit 430 , or the display 440 . The processor 410 may generate a new message, data, instruction, or signal based on the received message, data, instruction, or signal. Processor 410 may provide processed or generated messages, data, instructions, or signals to memory 420 , communication circuitry 430 , or display 440 .

The processor 410 may process data or signals generated or generated in a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may write (or store) or update instructions, data, or signals in the memory 420 to execute or control a program.

The memory 420 may store a command for controlling a node, a control command code, control data, or user data. For example, the memory 420 may include at least one of an application program, an operating system (OS) (eg, Microsoft Windows, Google Android, Apple iOS, MacOS, etc.), middleware, or a device driver. may contain one.

The memory 420 may include one or more of volatile memory and non-volatile memory. Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). may include The nonvolatile memory may include a read only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, and the like. The memory 420 includes a nonvolatile medium such as a hard disk drive (HDD), a solid state disk (SSD), an embedded multi media card (eMMC), and a universal flash storage (UFS). may include more.

According to an embodiment, the memory 420 may store some of information included in the memory of the controller 202 (eg, the memory 330 of FIG. 3 ). For example, the memory 420 may store the tunnel table 316 and the data flow table 317 described in FIG. 3 .

The communication circuit 430 may support establishment of a wired or wireless communication connection between the terminal and an external electronic device (eg, the controller 202 or the gateway 203 of FIG. 2 ) and performing communication through the established connection. According to one embodiment, communication circuitry 430 may include wireless communication circuitry (eg, cellular communication circuitry, near field communication circuitry, or global navigation satellite system (GNSS) communication circuitry) or wired communication circuitry (eg, local area network (LAN) circuitry). ) communication circuit, or power line communication circuit), and using the corresponding communication circuit among them, a short-distance communication network such as Bluetooth, WiFi direct or IrDA (infrared data association) or a cellular network, Internet, or long-distance communication such as a computer network It can communicate with an external electronic device through a network. The above-described various types of communication circuits 430 may be implemented as a single chip or as separate chips.

The display 440 may visually output content, data, or a signal. In various embodiments, the display 440 may display image data processed by the processor 410 . According to embodiments, the display 440 may be configured as an integrated touch screen by being coupled with a plurality of touch sensors (not shown) capable of receiving a touch input or the like. When the display 440 is configured as a touch screen, a plurality of touch sensors may be disposed above the display 440 or below the display 440 .

Meanwhile, the server (eg, the controller 202 ) according to an embodiment may include a processor 410 , a memory 420 , and a communication circuit 430 . The processor 410 , the memory 420 , and the communication circuit 430 included in the server may be substantially the same as the above-described processor 410 , the memory 420 , and the communication circuit 430 .

5 illustrates an operation of blocking a network connection according to various embodiments of the present disclosure.

According to one embodiment, the virtualization terminal 205 may be forcibly removed from the virtualization server 204 according to the virtualization server policy, if not in a state connected to the controller 202 through the access control application 251 .

In addition, among the data packets transmitted or received to the network after access to the controller, unacceptable data packets that do not exist in the data flow are blocked at the kernel level of the network driver and operating system, so that any data packet except for the access control application is transmitted to the network or not received

Furthermore, when the connection of the remote terminal 201 is terminated, in the case of the virtualization terminal 205 in an idle state that is no longer subject to external control, it is not identified by the vaccine by immediately removing all data flows for accessing the service server. Blocks unauthorized malware or ransomware from accessing the service server.

An embodiment disclosed in this document provides a method for completely isolating the network connection according to the state of the virtualization terminal (205).

6 shows a signal flow diagram for a system startup phase according to various embodiments.

In operation 610, the virtualization terminal 205 is provisioned and started by the virtualization server 204 or the operating system is started according to an event such as when the system is restarted by the user.

In operation 620 , when the operating system is started, the access control application 251 may be executed.

In operation 630 , an attempt may be made to access the controller 202 based on information on the controller 202 set in advance during provisioning.

7 illustrates a signal flow diagram for controller connection according to various embodiments.

The virtualization terminal 205 provisioned by the virtualization server 204 may execute the access control application 251 upon provisioning and system startup and connect to the controller 202 . The controller 202 identifies whether the access control application 251 access-requested information (the type of the terminal, location information, environment, and the network in which the terminal is included) is accessible by the policy, terminal and network identification information information, IP, MAC address, etc.) are included in the blacklist to check whether the terminal is in an accessible state there is.

A user who accesses the virtual terminal 205 using the virtual terminal access client in the remote terminal 201 through the provisioning and system startup execution and access control application 251 connected to the controller 202 to access the network User authentication can be performed. When the terminal is in an unreachable state, the access control application may display an access unavailable message and reason on the screen.

All network transmission and reception of the virtualization terminal 205 are blocked until the connection to the controller 202 is completed, and when the controller connection fails, the system is rebooted or terminated according to the policy of the controller 202 and the virtualization terminal 205 ) can block access to the network without the controller 202 connection. When the controller 202 is normally connected, all network access requests generated from the virtual terminal 205 thereafter are checked through the controller 202 for authorization.

Specifically, referring to FIG. 7 , in operation 705 , the virtualization terminal 205 connected using the virtualization terminal access client in the remote terminal 201 may detect a controller connection request event.

In operation 710 , the connection control application 211 may request a controller connection to create a control flow (control data packet flow and a series of sessions) with the controller 202 .

In operation 715, the controller 202 determines that the access control application 211 access-requested information (the type of the terminal, location information, environment and network including the terminal, access control application 211 information, etc.) according to the policy It is possible to check whether the terminal is in an accessible state by checking whether the terminal is in an accessible state and whether terminal and network identification information (eg, terminal identification information, IP, MAC address, etc.) is included in the blacklist.

In addition, based on the identified virtual terminal information, it is possible to check whether the virtual terminal 205 is present in the virtual terminal table 319.

When the virtual terminal 205 is present in the virtual terminal table 319, a control flow may be generated (operation 735).

If the virtual terminal 205 does not exist in the virtual terminal table 319, in operation 720, the controller 202 may make a request to the virtualization server 204 for a list of the currently provisioned virtual terminal 205 .

When access is not possible by the access policy or is included in the blacklist, access unavailable information may be transmitted to the virtualization terminal 205 .

In operation 725 , the virtualization server 204 may return a virtualization terminal list to the controller 202 by processing the virtualization terminal list request.

In operation 730, the controller 202 may receive the virtualization terminal list received from the virtualization server 204, and check whether a terminal requesting access exists in the virtualization terminal list.

When the terminal does not exist, access unavailable information may be returned along with the result of checking whether to restrict the use of the terminal according to the access policy.

If the corresponding terminal is an accessible terminal, in operation 735, a control flow is generated and control flow identification information is generated in the form of a random number, terminal and network identification information identification information, IP, MAC address, etc.) are written and added to the control flow table. can

In operation 740, the controller 202 generates accessable application whitelist information from the access policy matched with the identified information (terminal, source network information, etc.) and when continuously updating terminal information, control flow identification information for identifying a control flow and an application whitelist generated through the above process may be returned.

When the corresponding terminal is not accessible, the controller 202 may transmit a result of the connection unavailable to the terminal.

In operation 745 , the terminal may process the access request result value received from the controller 202 .

If access is not possible and use restriction processing is required, the system may be shut down or rebooted according to the usage restriction processing request returned by the controller 202 (operation 765 ).

If the connection is impossible and a retry is required, the controller access procedure may be performed again in operation 705 .

If the control flow is created but application inspection is required, the application whitelist inspection procedure can be performed.

In operation 750, when the terminal receives the application whitelist from the controller 202, the terminal checks whether the corresponding application is installed in the terminal, and in the case of an existing application, whether the application integrity and safety according to the validation policy A result of the inspection (eg, whether application forgery or not, code signing inspection, fingerprint inspection, etc.) may be transmitted to the controller 202 .

In operation 755, the controller 202 may check whether an access policy that can be accessed in advance in the access policy exists based on the application information received from the terminal.

If a policy for allowing access exists in advance, data flow information may be generated based on destination IP and port information accessible by the corresponding application and the corresponding information may be updated in the data flow table. When there is data flow table information that can be transmitted to the virtualization terminal 205, data flow table information may be returned.

In operation 760, when the virtualization terminal 205 receives the data flow table from the controller 202, it may update the data flow table information of the terminal based on the corresponding information.

8 illustrates a signal flow diagram for user authentication according to various embodiments of the present disclosure.

The controller 202 checks whether the corresponding user is an accessible user and whether it is included in the blacklist based on the information requested for authentication by the access control application 251 (user identification information and password, enhanced authentication information, etc.) You can check whether the user is blocked, and if the user is accessible, complete the authentication process and add user identification information to the control flow. When the user authentication fails, the access control application 251 may display a connection unavailable message and a reason on the screen. When the user is normally authenticated, the access policy corresponding to the authenticated user is applied to check whether network access is authorized.

Referring to FIG. 8 , in operation 805 , the virtualization terminal 205 may detect a user authentication request event.

In operation 810, the access control application 251 of the virtualization terminal 205 may perform user authentication to be given detailed access rights of the network, and transmit user identification information and authentication information by a password or enhanced authentication method can

In operation 815, the controller 202 checks whether the access control application 251 is an accessible user based on the authentication-requested information (user identification information and password, enhanced authentication information, etc.) and whether it is included in the blacklist You can check whether the user is blocked or not.

If access is not possible or is included in the blacklist, access unavailable information may be transmitted.

In operation 820, in the case of an accessible user, the controller 202 searches for a control flow in the control flow table using the transmitted control flow identification information, and adds user identification information (user identification information) to the searched identification information for the control flow. can do.

The controller 202 may return an authentication completion status and access policy information of the authenticated user as a result of user authentication.

In operation 825, the controller 202 generates accessable application whitelist information from the access policy matched with the identified information (terminal, source network information, user identification information, etc.), and as a result of the access, the access completion state and the terminal Upon user authentication request and continuous terminal information update of , control flow identification information for identifying a control flow and an application whitelist generated through the above process may be returned. If the connection is impossible, the controller 202 may transmit a connection failure result to the terminal 215 .

In operation 830 , the terminal 215 may process the access request result value received from the controller 202 . If access is not possible, a related error message may be displayed. If application inspection is required, the application whitelist inspection procedure can be performed.

In operation 835 , when the terminal 215 receives the application whitelist from the controller 202 , the terminal 215 checks whether the corresponding application is installed in the terminal, and in the case of an existing application, the integrity of the application according to the validation policy and safety (application forgery or falsification, code signing inspection, fingerprint inspection, etc.) may be transmitted to the controller 202 .

In operation 840, the controller 202 determines whether there is an access policy that can be accessed in advance in the access policy based on the application information received from the terminal 215, and if there is a policy for allowing access in advance, the corresponding policy The application may generate data flow information based on the accessible destination IP and port information and update the corresponding information in the data flow table.

In operation 845 , when receiving the data flow table from the controller 202 , the terminal 215 may update data flow table information of the terminal 215 based on the corresponding information.

9 shows a signal flow diagram for handling a network connection (data packet transmission).

In operation 905, the virtualization terminal 205 may detect a network access event.

In operation 910, when the access control application 211 needs to communicate with the service server, it may check whether data flow information exists based on application identification information, destination IP and port information to communicate with the corresponding service server. If the data flow exists but is not valid (eg, data packet transmission disabled state), the data packet is dropped (DROP). A data packet may be transmitted if a data flow exists.

In operation 915 , when the data flow does not exist or the authentication time expires and thus the update is required, or when the data flow needs to be updated due to other matters, a validation procedure may be performed according to the validation policy. The validation check may include checking the integrity and safety of the access application (application forgery or tampering, code signing check, fingerprint check, etc.).

In operation 920, the access control application 211 is based on the control flow identification information and application identification information for identifying the control flow generated with the controller 202 before the network access event, and the destination IP and port information of the server to be accessed. to perform a network access request to the controller 202 .

In operation 925, the controller 202 includes the identification information (application, destination IP, service port information, etc.) requested to access in the access policy matched with the information (terminal, user, source network information, etc.) identified on the control flow It is possible to check whether or not it is possible to connect to the destination server mapped with the corresponding identification information.

When the connection is impossible, the controller 202 may transmit a result of the connection impossible to the terminal. If the access attempt is a dangerous application on the access policy or if the access of the terminal 205 needs to be immediately blocked due to an abnormal access attempt, in operation 930 , a virtual terminal use restriction request may be made to the virtualization server 204 .

In operation 935, the virtualization server 204 responds to the virtual terminal use restriction request, the virtualization server 204 processes the virtual terminal according to the type of the restriction request forcibly shutting down the corresponding virtual terminal or transitioning to an unusable state, such as a pause state can do.

If access is possible, it can be checked whether data flow information that can be accessed through the corresponding destination IP and port exists in the data flow table. When there is no valid data flow information in the data flow table, data flow information may be generated based on source IP, destination IP, and port information to allow access of a corresponding application, and the corresponding information may be transmitted to the terminal.

If there is data flow information that can be accessed from the data flow table, the corresponding information may be transmitted to the terminal 205 .

In operation 940 , the access control application 211 may process a result of the access request received from the controller 202 .

If the network connection fails, the data packet is dropped (DROP).

If a connection is possible based on the received data flow, a data packet may be transmitted.

Fig. 10 shows a signal flow diagram for processing a network connection (receiving a data packet).

In operation 1005, the virtualization terminal 205 may detect a network access event.

In operation 1010, the access control application 211 is based on the destination port included in the received data packet to control the connection of a terminal server application for the remote terminal to access the virtualization terminal 205 and perform a series of actions. You can check whether there is an allowed network receiving application in the network whitelist.

If the receiving application does not exist, the data packet is dropped (DROP).

When a receiving application exists in the network whitelist, it may be checked whether data flow information exists based on source IP and destination port information included in the received data packet.

If the data flow exists but is not valid (eg, data packet reception unavailable state), the data packet is dropped (DROP).

A data packet may be received if there is a data flow.

In operation 1015 , when the data flow does not exist, the authentication time expires, and the data flow needs to be updated, or when the data flow needs to be updated due to other matters, a validation procedure may be performed according to the validation policy. The validation check may include checking the integrity and safety of the receiving application (application forgery or tampering, code signing check, fingerprint check, etc.).

In operation 1020, the access control application 211 is the control flow identification information and application identification information for identifying the control flow generated with the controller 202 before the network reception event, the source IP of the access requesting terminal, and the virtualization terminal (205) It is possible to perform a network reception request to the controller 202 based on the service port information of the.

In operation 1025, the controller 202 includes the identification information (application, source IP and service port information, etc.) requested to be received in the access policy matched with information identified on the control flow (terminal, user, source network information, etc.) It can be checked whether access is possible to the virtualization terminal 205 mapped to whether and the corresponding identification information.

If reception is impossible, the controller 202 may transmit a reception failure result to the terminal.

When the corresponding reception attempt is an abnormal access attempt on the access policy and it is necessary to immediately block the access of the corresponding terminal, the virtualization server 204 makes a request to limit the use of the virtualization terminal 205, and the virtualization server 204 depends on the type of restriction request. Accordingly, the virtual terminal may be forcibly terminated or converted to an unusable state, such as a pause state.

If reception is possible, it can be checked whether data flow information that can be received by the corresponding source IP and port exists in the data flow table.

When there is no valid data flow information in the data flow table, data flow information may be generated based on source IP, destination IP, and port information to allow reception of a corresponding network, and the corresponding information may be transmitted to the terminal.

When receivable data flow information exists in the data flow table, the corresponding information may be transmitted to the terminal.

If reception is possible, when it is necessary to check the control flow and data flow table of the remote terminal side, the control flow and data flow table checking procedure may be performed.

In operation 1030, when only the remote terminal using the access control application 211 allows access according to the access policy, the controller 202 checks whether a control flow of the remote terminal using the received source IP exists. can

When the control flow of the remote terminal does not exist, the controller 202 may transmit a result of non-receiptability to the terminal.

If there is a control flow of the remote terminal, whether there is a data flow to the destination IP and port and the allowed application on the data flow table of the remote terminal to check whether the application is connected to the destination port requested for reception. can be checked.

If the data flow of the remote terminal does not exist, the controller 202 may transmit a non-receipt result to the terminal.

When the corresponding reception attempt is an abnormal access attempt in the access policy, and it is necessary to immediately block the access of the terminal, in operation 1035, a virtual terminal use restriction request is made to the virtualization server 204, and in operation 1040, the virtualization server 204 Depending on the type of restriction request, the virtual terminal may be forcibly terminated or converted to an unusable state, such as a pause state.

In operation 1040 , the access control application 211 may process the connection request result value received from the controller 202 .

When network reception fails, the data packet is dropped (DROP).

If reception is possible based on the received data flow, the data packet may be received.

11 is a flowchart for checking a network reception list according to various embodiments.

In operation 1105, the virtualization terminal 205 may detect a network reception list check event.

In operation 1110, the virtualization terminal 205 may examine the application execution or execution termination of the operating system, a network reception request event, or a periodic network reception waiting list.

By checking the network listening port and application information, it is possible to check whether a network whitelist that can be received exists.

In operation 1115, if the network whitelist does not exist, a validation procedure may be performed according to a validation policy. The validation check may include checking the integrity and safety of the receiving application (application forgery or tampering, code signing check, fingerprint check, etc.).

In operation 1120, the access control application 251 requests a network whitelist to the controller 202 based on the control flow identification information for identifying the controller 202 and the generated control flow, the reception application identification information, and the service port information list can be performed.

In operation 1125, the controller 202 returns the corresponding application to the list of identification information (received application, service port information, etc.) requested to be received in the access policy matched with the information (terminal, user, source network information, etc.) identified on the control flow You can check whether to allow network reception of

In the case of checking the network list being received, if the receiving application is an abnormal application or receiving state on the access policy, if it is necessary to immediately block the access of the corresponding terminal In operation 1130, the virtualization terminal 205 to the virtualization server 204 The use restriction request is made, and in operation 1135, the virtualization server 204 may process the corresponding virtualization terminal 205 forcibly shutting down or processing it into a non-usable state, such as a pause state, depending on the type of the restriction request.

When the corresponding receiving application is in an abnormal application or receiving state on the access policy, when the corresponding application needs to be terminated, application termination processing information may be transmitted.

If the receiving application is an abnormal application or reception state on the access policy, if the usage restriction of the virtual terminal 205 is required, the usage restriction and system termination processing information may be transmitted.

If reception is impossible, information disallowing reception of the corresponding application and service port may be added to the network whitelist.

If reception is possible, information allowing reception of the corresponding application and service port can be added to the network whitelist.

When the inspection is completed, the generated network whitelist information may be transmitted.

In operation 1115 , the terminal may process the network whitelist request result value received from the controller 202 .

If access is not possible and the use restriction processing is required, the system may be shut down or an action such as rebooting may be performed according to the usage restriction processing request returned by the controller 202 .

In a normal case, the network whitelist may be updated.

If an application that is not allowed on the updated network whitelist is receiving a service port that is not allowed, the application may be terminated.

12 is a flowchart for updating a control flow according to various embodiments.

In operation 1205, the virtualization terminal 205 may detect a control flow update event.

In operation 1210, the access control application 211 of the virtualization terminal 205 maintains the control flow and the currently connected data flow information, and receives the updated data flow from the controller 202 or whether the control flow is valid. In order to confirm, the control flow may be requested to be updated from the controller 202 based on the periodically assigned control flow identification information.

In operation 1215, the controller 202 may check whether a control flow exists in the control flow table based on the control flow identification information requested by the terminal.

If the control flow does not exist (for example, disconnection by other security systems, over the update time, disconnection due to self-risk detection, etc.) .

When it is necessary to block the access of the corresponding terminal, a request for limiting the use of the virtualization terminal 205 is made to the virtualization server 204, and the virtualization server 204 either forcibly terminates the virtual terminal according to the type of the restriction request or is in a suspended state, etc. , it can be converted to an unusable state.

If the control flow exists, the update time can be updated.

In operation 1220, the data flow may be updated. Data flow information dependent on the corresponding control flow can be searched.

If re-authentication needs to be performed among data flows or there is a data flow that can no longer be accessed, the corresponding data flow information can be returned.

If the connection of the remote terminal or the connection of the virtual terminal access client is terminated and there is no data flow for accessing the virtual terminal 205, in operation 1225, a virtualization terminal use restriction can be requested from the virtualization server 204 there is. In order to block the invalid remote terminal from accessing the virtualization terminal 205, it is possible to remove the data flow of the remote terminal that is received by the previously created virtualization terminal 205.

In addition, in order to prevent remote access does not exist, that is, uncontrolled virtualization terminal 205 and the application of the terminal are connected to the service server, it is possible to remove the data flow of the service server to which the virtualization terminal 205 can connect. .

If the update result of the control flow is not updateable, block all network connections of the application, or

If access is not possible and the use restriction processing is required, the system may be shut down or an action such as rebooting may be performed according to the usage restriction processing request returned by the controller 202 .

When the control flow update result is normal and there is updated data flow information, the data flow table information in the access control application 211 can be updated.

13 is a flowchart for terminating a controller connection according to various embodiments of the present disclosure;

In operation 1305, the virtualization terminal 205 may perform a control flow termination request to the controller 202 when the virtualization terminal 205 is terminated or the access control application 211 detects a controller connection termination event that is terminated.

In operation 1310 , the controller 202 may remove the identified and found control flow based on the control flow identification information requested by the virtualization terminal 205 .

In operation 1315 , when the control flow is removed, all data flows dependent on it may be removed, and a remote terminal using the corresponding data flow may be processed so that it can no longer access the virtualization terminal 205 .

In operation 1320 , when it is necessary to limit the use of the virtualization terminal 205 , it may make a request for limiting the use of the virtualization terminal to the virtualization server 204 .

In operation 1325, the virtualization server 204 may process the virtual terminal forcibly shutting down or switch to an unusable state, such as a pause state, according to the type of restriction request.

Figure 14 shows a signal flow diagram for a virtual terminal connection client network connection termination (virtualization terminal side) according to various embodiments.

When the user no longer requires the connection of the virtualization terminal 205, or performs a release procedure such as terminating the virtual terminal connection client or terminating the virtualization terminal 205, the virtualization terminal 205 is connected to the virtualization terminal A client network connection termination event can be detected.

The controller 202 receives the virtualization terminal access client's connection state, the access control application connection state in the remote terminal 201, the access control application connection state in the virtualization terminal 205 and various risk detection information, and the virtualization server policy 318 Accordingly, by immediately blocking all network connections of the virtualization terminal 205, or by removing the virtualization terminal 205 through the virtualization server 204, it is possible to block the idle virtualization terminal from accessing the network.

In operation 1405, the virtualization terminal 205 may detect a virtual terminal connection client network connection termination event.

The access control application 211 always checks whether the network connection of the existing virtual terminal access client connected to the server for the control of the virtualization terminal 205 is terminated, and when the connection termination occurs, the virtualization terminal connection to the controller 202 You can request a client network connection termination process.

In operation 1410, the controller 202 may remove the data flow of the remote terminal that is received by the virtual terminal 205 previously created in order to block the invalid remote terminal from accessing the virtualization terminal 205.

In addition, in order to prevent remote access does not exist, that is, uncontrolled virtualization terminal 205 and the application of the terminal are connected to the service server, it is possible to remove the data flow of the service server to which the virtualization terminal 205 can connect. .

When it is necessary to limit the use of the virtualization terminal 205, in operation 1415, the virtualization server 204 may make a request to limit the use of the virtualization terminal 205.

In operation 1430, the virtualization server 204 may process the virtual terminal forcibly shutting down or switch to an unusable state, such as a pause state, depending on the type of restriction request.

In operation 1420 , the virtualization terminal 205 may receive a result value for the access request processing received from the controller 202 , and update the received data flow information.

In operation 1425, when the use limit processing of the virtualization terminal 205 is required, the system may be terminated or an action such as rebooting may be performed according to the use limit processing request returned by the controller 202.

Figure 15 shows a signal flow diagram for the virtual terminal connection client network connection termination (remote terminal side) according to various embodiments.

In operation 1505, the remote terminal 201 may detect a virtual terminal connection client network connection termination event.

The access control application 211 of the remote terminal 201 always checks whether the network connection of the existing virtual terminal access client connected to the server for the control of the virtualization terminal 205 is terminated, and when the connection termination occurs, the controller ( 202) may request virtual terminal access client network connection termination processing.

In operation 1510, it is possible to remove the data flow of the remote terminal that is received by the virtualization terminal 205 created previously in order to block the invalid remote terminal from accessing the virtualization terminal 205.

In addition, in order to prevent remote access does not exist, that is, uncontrolled virtualization terminal 205 and the application of the terminal are connected to the service server, it is possible to remove the data flow of the service server to which the virtualization terminal 205 can connect. .

In operation 1515 , when it is necessary to limit the use of the virtualization terminal 205 , it may make a request to limit the use of the virtualization terminal 205 to the virtualization server 204 .

In operation 1520 , the virtualization server 204 may process the corresponding virtual terminal forcibly shutting down or switch to an unusable state, such as a pause state, depending on the type of restriction request.

In operation 1525 , the terminal may receive a result value of the access request processing received from the controller 202 and update the received data flow information.

16 shows a signal flow diagram for updating a virtualization terminal table according to various embodiments.

In operation 1605 , the controller 202 may detect an update event of the virtualization terminal table 319 .

In operation 1610, the controller 202 periodically selects a list of virtualization terminals to be updated in the virtualization terminal table 319 in order to update the provisioned virtualization terminal 205 or the removed virtualization terminal 205 information to the virtualization server 204. You can check and request a virtualization terminal list inquiry to each virtualization server 204 .

In operation 1615 , the virtualization server 204 may return the virtualization terminal list to the controller 202 by processing the virtualization terminal list inquiry request.

In operation 1620 , the controller 202 may update the virtualization terminal table based on the virtualization terminal list returned by the virtualization server 204 .

In operation 1620 , when the virtualization terminal 205 is removed from the virtualization terminal table, control flow information generated by the virtualization terminal 205 may be removed.

In operation 1625, if the virtual terminal 205 is present in the virtual terminal table, but the control flow information generated by the virtual terminal 205 identification information does not exist, check the virtualization server policy 318 and the virtual terminal ( 205) exceeds the set control flow generation time, when it is necessary to limit the use of the virtualization terminal 205, the virtualization server 204 makes a request to limit the use of the virtualization terminal 205, and in operation 1630, the virtualization server ( 204) according to the type of restriction request, the virtual terminal 205 may be processed forcibly terminated or switched to an unavailable state, such as a pause state.

17 shows a user interface screen when the virtualization terminal 205 is disconnected.

When the virtualization terminal 205 is released, a notification message is displayed on the user interface screen, such as that the virtualization terminal is terminated to block network access ( 1705 ), or that a threat is detected in the virtualization terminal and network access is blocked ( 1710 ) can be

The above description is merely illustrative of the technical idea disclosed in this document, and those of ordinary skill in the art to which the embodiments disclosed in this document belong are not departing from the essential characteristics of the embodiments disclosed in this document. Various modifications and variations will be possible.

Therefore, the embodiments disclosed in this document are for explanation rather than limiting the technical ideas disclosed in this document, and the scope of the technical ideas disclosed in this document is not limited by these embodiments. The protection scope of the technical idea disclosed in this document should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present document.

Claims (10)

A network system comprising:
remote terminal;
A virtualization server communicatively connected to the remote terminal, comprising a virtualization terminal that a user accesses through the remote terminal and includes an access control application;
an external server communicatively connected to the remote terminal, the virtualization server, and the virtualization terminal; and
Including; and a business network that is communicatively connected through the virtualization terminal and the access control application,
The virtualization terminal,
Through the access control application, detect a network access event for the business network of the virtualization terminal,
Through the access control application, it is confirmed whether there is a data flow corresponding to the business network and authorized from an external server,
When the authorized data flow exists, sending a data packet to the business network;
drop a data packet if the authorized data flow does not exist or is invalid;
The external server,
Checking the list of virtualization terminals provisioned from the virtualization server, and requesting the virtualization server to terminate the virtualization terminal when the virtualization terminal does not generate a control flow, a network system. According to claim 1,
The virtualization terminal,
Inspecting the application execution or execution termination of the operating system of the virtualization server, a network listening request event, or a periodic network listening list,
Checks the network listening port and application information to check whether there is a network whitelist that can be listened to,
If the network whitelist does not exist, a validation procedure is performed according to the validation policy;
to request a network whitelist from the external server based on a list of control flow identification information, reception application identification information, and service port information for identifying the control flow generated with the external server;
The external server, in response to the request of the network whitelist,
When the receiving application is an abnormal application or reception state in the access policy, to make a request to limit the use of the virtualization terminal to the virtualization server,
The virtualization server,
In response to the use restriction request, the network system to terminate the virtualization terminal. According to claim 1, wherein the virtualization server,
When it is impossible to access the business network, the network system to limit the use of the virtualization terminal. According to claim 2, wherein the virtualization terminal,
When the virtual terminal or the access control application detects a controller connection termination event that terminates or does not update the data flow, removing the identified control flow based on the control flow identification information,
When the control flow is removed, all dependent data flows are removed, and a remote terminal using the data flow is no longer able to access the virtualization terminal,
When it is necessary to restrict the use of the virtualization terminal, the network system to make a request to limit the use of the virtualization terminal to the virtualization server. The method of claim 4, wherein the external server,
Based on the connection state of the virtual terminal access client, the access control application connection state in the remote terminal, the access control application connection state in the virtualization terminal, and risk detection information, all network connections of the virtualization terminal according to the virtualization server policy are immediately By blocking or removing the virtualization terminal through the virtualization server to block the source of the idle virtualization terminal from accessing the network, a network system. 6. The method of claim 5,
The remote terminal detects a virtual terminal connection client network connection termination event, and requests the virtual terminal connection client network connection termination processing to the external server,
The external server, so as to remove the data flow of the remote terminal that is received by the virtualization terminal in order to block the invalid remote terminal from accessing the virtualization terminal, the network system. According to claim 1,
The virtualization terminal, when the user information logged into the remote terminal and the virtualization terminal is not the same, so as to release the network connection, a network system. According to claim 1,
When the system of the virtualization terminal is started, the access control application is automatically executed, so that the automatic connection to the external server, the network system. According to claim 1,
The external server to update the virtualization terminal table based on the virtualization terminal list returned from the virtualization server,
When the virtual terminal is removed from the virtual terminal table, the control flow information generated by the virtual terminal is removed, the network system. In the virtualization server existing in the same network as the business network that the remote terminal wants to access,
A non-transitory computer-readable storage medium having instructions stored thereon, wherein the instructions are executed by a processor to a virtualization terminal, the virtualization terminal comprising:
Through the access control application, detect a network access event to the business network,
Through the access control application, it is confirmed whether there is a data flow corresponding to the business network and authorized from an external server,
When the authorized data flow exists, sending a data packet to the business network;
If the authorized data flow does not exist or is invalid, the data packet is dropped (DROP),
The data flow is generated by the external server based on whether the access control application that has requested network access in the access policy matched with the information identified on the control flow can access the business network,
The virtualization server transmits the provisioned virtualization terminal list to the external server, and when the virtualization terminal does not generate a control flow, receiving a request to terminate the virtualization terminal that does not generate the control flow from the external server , virtualization server.

Images