KR102396528B1 - System for controlling network access based on controller and method of the same - Google Patents

Abstract

The present invention relates to a system for controlling network access based on a controller to effectively solve various network security problems and a method thereof. According to one embodiment of the present invention, a node comprises: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor to store a connection control application and a target application. The method stores instructions to allow the node, when executed by the processor, detect a network access event through an access control application; check whether a data packet transmitted by the target application is an authentication data packet; transmit identification information of the target application, identification information of a destination network of the target application, and authentication data packet information to an external server to perform a network access authentication request; receive a data flow or network connection failure result including authentication information from the external server; and transmit the authentication data packet on the basis of the data flow or the network connection failure result, wherein the authentication information can be generated on the basis of an authentication policy included in the external server.

Description

SYSTEM FOR CONTROLLING NETWORK ACCESS BASED ON CONTROLLER AND METHOD OF THE SAME

Embodiments disclosed herein relate to a system for controlling a controller-based network connection and a method therefor.

Multiple devices may communicate data over a network. For example, a smartphone may transmit or receive data with a server via the Internet. The network may include a public network such as the Internet as well as a private network such as an intranet.

In general, communication between nodes and servers uses IP (Internet Protocol)-based TCP (Transmission Control Protocol), and access control is performed by identifying the source IP, destination IP and port information with 5 tuple information included in the data packet. Common use of firewall technology to perform

The firewall technology identifies a node or an IP assigned to a network node and performs access control of inbound or outbound data packets between network boundaries to block unauthorized IP access to an unauthorized destination network.

In the case of a node in an Internet band where IP allocation and control is difficult, or when creating a private IP band by configuring subnetworks by routers and gateways, IP-based technologies such as firewalls may cause difficulties in controlling IP units. Thus, in practice, the firewall is used as a minimum safeguard.

In order to solve the above problems, the data packet transmitted between the node and the server or gateway is encrypted, not forged or tampered with, and access control such as tunneling technology or secure session that allows only authorized objects to access uniquely technology is being used.

However, a VPN (Virtual Private Network) based on tunneling technology created at the terminal level has a vulnerability in that, when used, an unallowed or insecure application accesses an unauthorized destination network through tunneling that is always connected after initial authentication. That is, in the above vulnerabilities, security incidents due to infiltration of various types of malware and ransomware are increasing in VPN technology.

In addition, with the recent complexity of business, communication between servers on a network that is always connected has increased, and the target application operating within the server does not operate all service logic in one application, but micro service architecture that operates separately as a module or functional unit. As the form develops, the actual communication changes the identification unit to communication of a module or function unit at a lower level than the application, so a network access control technology at a lower level than the application is required.

Various embodiments disclosed in this document are intended to provide a system for solving the above-described problems in a network environment and a method therefor.

A node according to an embodiment disclosed herein comprises a communication circuit, a processor operatively connected to the communication circuit, and a memory operatively connected to the processor and storing a connection control application and a target application, the The memory, when executed by the processor, allows the node to detect a network connection event through the access control application, check whether the data packet sent by the target application is an authentication data packet, and identify information of the target application; Transmitting the identification information of the destination network of the target application and the authentication data packet information to an external server, performing a network access authentication request, receiving a data flow including authentication information or a network connection impossible result from the external server; store instructions for transmitting the authentication data packet based on a data flow or a result of the network connection unavailable; and the authentication information may be generated based on an authentication policy included in the external server.

A server according to an embodiment disclosed in this document includes a communication circuit, a memory for storing a database, and a processor operatively connected to the communication circuit and the memory, wherein the processor is configured to: Receive an access authentication request, wherein the network access authentication request includes authentication data packet information, confirms whether the node is accessible based on the database, and determines whether the node can access the authentication data based on an authentication policy included in the database Check whether packet information is valid, and if the node is accessible and the authentication data packet information is valid, check whether a data flow corresponding to identification information of the node and identification information of a destination network of the node exists; When the data flow does not exist, a data flow including identification information of the node, identification information of the destination network, and authentication information generated based on the authentication policy is generated, and the generated data flow or the existing data flow may be configured to transmit to the node.

A gateway according to an embodiment disclosed herein comprises communication circuitry, a memory and a processor operatively coupled to the communication circuitry and the memory, the processor configured to receive a data packet from a connection control application of a node; Check whether a data flow exists based on source IP, destination IP, and destination port information of the data packet included in the data packet, and if the data flow exists, check authentication information included in the data flow, , determine whether to inspect the data packet based on whether authentication is required included in the authentication information, determine whether to inspect the data packet based on whether or not authentication needs to be updated included in the authentication information, and It may be configured to forward the data packet upon completion of packet inspection.

A method of operating an access control application installed in a node according to an embodiment disclosed in this document includes detecting a network access event through the access control application, whether the data packet transmitted by the target application stored in the node is an authentication data packet transmitting the identification information of the target application, identification information of the destination network of the target application, and the authentication data packet information to an external server and performing a network access authentication request; Receiving a data flow or a network connection unavailable result comprising the steps of, and transmitting or dropping the authentication data packet based on the data flow or the network connection unavailable result, wherein the authentication information is included in the external server. It is generated based on an authentication policy, and the authentication information includes information on whether it is possible to transmit a data packet without additional authentication and an authentication status of the data flow when the update condition of the data flow is satisfied based on the authentication policy It may contain changing information.

The method of operating a server according to an embodiment disclosed in this document includes the steps of receiving a network access authentication request from an access control application of a node, the network access authentication request includes authentication data packet information, and data included in the server Checking whether the node is accessible based on a base, checking whether the authentication data packet information is valid based on an authentication policy included in the database, the node is accessible and the authentication data packet information Checking whether a data flow corresponding to the identification information of the node and the identification information of the destination network of the node exists if is valid, if the data flow does not exist, identification information of the node, identification information of the destination network, and The method may include generating a data flow including the generated authentication information based on the authentication policy, and transmitting the generated data flow to the node.

The method of operating a gateway according to an embodiment disclosed in this document includes receiving a data packet from an access control application of a node, based on source IP, destination IP, and destination port information of the data packet included in the data packet. Checking whether a data flow exists, if the data flow exists, checking authentication information included in the data flow, whether to check the data packet based on whether authentication is required included in the authentication information The method may include determining whether to check the data packet based on whether or not an authentication update included in the authentication information is required, and forwarding the data packet when the data packet inspection is completed.

According to the embodiments disclosed in this document, the application accessibility control technology that allows only allowed secure applications to access the allowed network is applied to identify the application that is the underlying communication subject, and to block the access of unauthorized applications in advance By doing so, it is possible to prevent various types of malware and ransomware from accessing unauthorized destination networks, and at the same time effectively solve various network security problems currently occurring.

According to the embodiments disclosed in this document, due to the increase in data dam, my data, and AI services, communication in modules or functional units can be controlled in a more granular unit than applications, and data or data owned by the data provider In order to deliver the data entrusted by the owner to the data consumer, the permitted module can control the network connection so that only the data allowed by the data owner or allowed by the policy in advance is transmitted.

According to the embodiments disclosed in this document, the data centric networking-oriented AI overlaid on the conventional IP-based network transmits the calculation result and the countless processed valuable data stored in the server to the consumer and provides the actual value. It can be used as a base technology for granting.

In addition, according to the embodiments disclosed in this document, in order to control network access in module units and data units that cannot be controlled by the conventional application connectivity control technology, lower than applications that cannot be identified in the operating system (Kernel Level) For unit identification, a method for controlling network access at the module or data level may be provided by inserting an additional identification layer upon network access in the target application (User Level).

In addition, according to the embodiments disclosed in this document, when a module or function in the target application (User Level) that cannot be identified in the operating system (Kernel Level) connects to the network and transmits data, the target application is transmitted when the network is connected By checking each identification information included in one authentication data packet to the controller, it is possible to provide a structure for allowing or disallowing network access according to whether to allow network access including the corresponding identification information.

In addition, according to the embodiments disclosed in this document, whitelist-based network access is allowed for each identification unit according to the authentication policy of the controller set in advance, or a third party (eg, a data owner) receives the network of the corresponding identification unit. By additionally checking whether to allow access or not, a structure that allows network access only with the approval of a third party can be provided. You can provide a way to

In addition, according to the embodiments disclosed in this document, when the credit information of the data owner entrusted to the credit institution is transmitted to another institution by configuring Data Centric Networking, the data owner's credit information data is transferred to the trust institution approved by the entrusted credit institution. In order to control transmission to other organizations, only the data allowed by the user is created at the time of data provision in accordance with the permitted data supply organization to other organizations permitted, and the network connection is disconnected when data provision is finished. Because it can provide technology that can do it, it can provide a way to reach the practical purpose of MyData.

In addition, according to the embodiments disclosed in this document, various authentication information (eg, public key-based encryption/decryption key and certificate), data information signed based on authentication information (eg, approved data propagation on a blockchain network) ) transmission, personal information stored in the cloud, etc., which are always connected to the network, but connect to the Internet only when a remote storage containing information that needs to be isolated from the Internet is needed, while blocking external risks from the Internet , by transmitting only permitted data, it is possible to block an unauthorized target from transmitting unacceptable data (eg, when personal information is arbitrarily leaked by a hijacker).

In addition, various effects directly or indirectly identified through this document may be provided.

1 shows an environment including a plurality of networks.
2 illustrates an architecture in a network environment according to various embodiments.
3 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure;
4 illustrates a functional block diagram of a node in accordance with various embodiments.
5 is a diagram illustrating a structure of an authentication data packet according to various embodiments of the present disclosure;
6 is a diagram illustrating an operation of controlling transmission of a data packet according to various embodiments of the present disclosure;
7 illustrates a signal flow diagram for a controller connection of a node according to various embodiments.
8 illustrates a signal flow diagram for network connection authentication of a node according to various embodiments of the present disclosure;
9 illustrates a signal flow diagram for controlling a network connection of a node according to various embodiments.
10 illustrates a signal flow diagram for transmitting a data packet of a node according to various embodiments.
11 is a signal flow diagram for controlling data packet reception of a gateway according to various embodiments of the present disclosure;
12 is a signal flow diagram for updating a control flow of a node according to various embodiments.
13 illustrates a signal flow diagram for disconnection of a node according to various embodiments.
14 illustrates a signal flow diagram for termination of application execution of a node according to various embodiments.
15 is a flowchart illustrating a method of operating a connection control application installed in a node according to various embodiments of the present disclosure.
16 is a flowchart illustrating a method of operating a server according to various embodiments of the present disclosure.
17 is a flowchart illustrating a method of operating a gateway according to various embodiments of the present disclosure.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

In this document, the singular form of a noun corresponding to an item may include one or a plurality of items, unless the context clearly indicates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A; Each of the phrases such as "at least one of B, or C" may include any one of, or all possible combinations of, items listed together in the corresponding one of the phrases. Terms such as "first", "second", or "first" or "second" may be used simply to distinguish the element from other elements in question, and may refer to elements in other aspects (e.g., importance or order) is not limited. It is said that one (eg, first) component is "coupled" or "connected" to another (eg, second) component, with or without the terms "functionally" or "communicatively". When referenced, it means that one component can be connected to the other component directly (eg by wire), wirelessly, or through a third component.

Each component (eg, a module or a program) of components described in this document may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. . According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repetitively, or heuristically, or one or more of the operations are executed in a different order, omitted, or , or one or more other operations may be added.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit or a part of the part that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or an application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one of the one or more instructions stored from the storage medium and execute it. This makes it possible for the device to be operated to perform at least one function according to the called at least one command. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not include a signal (eg, electromagnetic wave), and this term is used in cases where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

Methods according to various embodiments disclosed in this document may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or via an application store or between two user devices (eg smartphones). It can be distributed directly or online (eg, downloaded or uploaded). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

1 shows an environment including a plurality of networks.

Referring to FIG. 1 , the first network 10 and the second network 20 may be different networks. For example, the first network 10 may be a public network such as the Internet, and the second network 20 may be a private network such as an intranet or VPN. According to an embodiment, the first network 10 may include the data provider network 210 of FIG. 2 , and the second network 20 may include the data consumer network 220 of FIG. 2 .

The first network 10 may include a source node 101 . In FIG. 1 and the embodiments described below, the 'source node' may be various types of devices capable of performing data communication. For example, the source node 101 may be a portable device such as a smartphone or tablet, a computer device such as a desktop or laptop, a multimedia device, a medical device, a camera, a wearable device, a virtual reality (VR) device. , or a home appliance, and is not limited to the above-described devices. For example, the source node 101 may include a server or gateway capable of sending data packets through an application. The source node 101 may also be referred to as an 'electronic device' or a 'terminal'. On the other hand, the destination node 102 may include the same and similar device as the above-described origin node 101 . For another example, the destination node 102 may be substantially identical to the destination network.

The source node 101 may attempt to access the second network 20 and transmit data to the destination node 102 included in the second network 20 . The source node 101 may transmit data to the destination node 102 through the gateway 103 and the tunnel 105 . However, the present invention is not limited thereto, and the source node 101 may transmit data to the destination node 102 through various paths such as a tunnel, a secure session, and a channel.

When the access of the source node 101 to the first network 10 is approved, the source node 101 can communicate with all servers included in the first network 10, so that the source node 101 is malicious. ) can be exposed from program attack. For example, the source node 101 is a trusted and/or secure application, such as an Internet web browser 110a, business application 110b, as well as malicious code 110c, infected (infected) ) may receive data from an untrusted or unsecured application, such as business application 110d.

The source node 101 infected with the malicious program may attempt to access and/or transmit data to the second network 20 . When the second network 20 is formed based on IP such as VPN, it may be difficult for the second network 20 to individually monitor a plurality of devices included in the second network 20, and the application in the OSI layer It may be vulnerable to security layer or transport layer. In addition, if the source node 101 includes a malicious application after the channel has already been created, the data of the malicious application will be transmitted to another electronic device (eg, the destination node 102 ) in the second network 20 . can

2 illustrates an architecture in a network environment according to various embodiments.

Referring to FIG. 2 , the number of the node 201 , the gateway 203 , the destination network 204 , the data provider network 210 , and the data consumer network 220 is not limited to the number shown in FIG. 2 . For example, a plurality of nodes may control network access from the controller 202 , and the controller 202 may communicate with a plurality of gateways and control data transmission to a plurality of destination networks.

The node 201 may include a connection control application 211 and a target application 221 . For example, the access control application 211 checks whether access is possible from the controller 202 when a network connection occurs, and only when access is possible, based on the data flow generated by the controller 202, the destination through the gateway 203 The data packet may be sent to the network 204 . For example, the gateway 203 may include a first gateway 213 existing at a network boundary on the node 201 side and a second gateway 223 existing on a network boundary on the destination network 204 side.

The data flow-based connectivity control technology provides a structure in which communication is possible only when there is a data flow authorized by the controller 202 for the node 201 to access the destination network 204, and the data flow does not exist. Otherwise, the node 201 may provide a structure in which communication cannot be performed. For example, the access control application 211 may restrict the transmission of data packets of the target application 212 when a data flow does not exist.

The controller 202 may be a server (or cloud server). The controller 202 may perform network access control of the node 201 to the destination network 204 .

According to an embodiment, the controller 202 transmits/receives control data packets to and from the node 201 to perform various operations (eg, registration, approval, authentication, update, termination) related to the network connection of the node 201 . can A flow in which a control data packet is transmitted may be referred to as a control flow.

Through the above-described operations, the controller 202 may provide an environment in which the non-allowed node can block access to the destination network 204 .

The gateway 203 may include a first gateway 213 and a second gateway 223 . For example, the gateway 203 may provide a technology for safely transmitting data packets in a network section through a secure channel. In addition, the gateway 203 checks whether the data packet received from the access control application 211 is actually transmitted by the allowed node 201 , and bypasses the access control application 211 and transmits the data packet. It can play a blocking role. That is, the gateway 203 may enable an always-on secure network configuration throughout the data provider network 210 and the data consumer network 220 .

The switch 203 may include an SDN switch. Hereinafter, the switch 203 is referred to as an SDN switch. The SDN switch 203 may control the virtual router 213 based on the routing table. For example, the SDN switch 203 may determine whether to route or drop a data packet received from the node 201 through the virtual router 213 .

The data owner 206 may communicate with the controller 202 . The controller 202 may allow whitelist-based network access for each identification unit according to the authentication policy, and the data owner 206 additionally checks whether to allow the network access of the corresponding identification unit. 206) can provide a structure that allows network access only by approval. In addition, since the network connection can be recorded for each identification unit, the data owner 206 can inquire which module transmitted which data when, where, and where.

3 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure; 3 shows only the memory 330, the controller includes a communication circuit for performing communication with an external electronic device (eg, the communication circuit 430 of FIG. 4 ) and a processor (eg, FIG. 4 ) for controlling the overall operation of the controller. It may further include a processor 410 of 4).

Since the administrator can access the controller 202 and set an access-oriented policy to control the connection between the application and the server, the existing NAC (Network Access Control) and firewall-like security that simply performs access control based on IP It is possible to control network access that is more fine-grained than technology and more secure in terms of network access.

The access policy database 311 may include information on an identified network, a node (eg, the node 201 of FIG. 2 ), a user, an unidentified user, or a network and/or service to which an application can access. For example, when a connection to a destination network is requested from a node, the controller determines a network (eg, a network to which the node belongs) identified based on the access policy database 311, a node, a user (eg, a user of the node); and/or an application (an application included in the node) may determine whether access to the destination network is possible.

The authentication policy database 312 identifies the access target at a more granular level than the application, which is the minimum unit of access control in the access policy (eg, information included in the access policy database 311), and the identified target is accessible Service information may be included. For example, the authentication policy database 312 determines whether or not to always allow access to a service accessible by the policy, when a network access request exists with the corresponding identification information, or another system or a third party (eg, : It can include whether or not to allow access only when approved by the data owner). For another example, the authentication policy database 312 determines whether or not to continuously allow network access after allowing network access, or whether specific conditions (eg, TCP SYM Packet, TCP FIN Packet, and the amount of transmitted data packets depend on the data flow). Whether to release the network connection and re-perform data packet authentication when the amount of included data packets is exceeded, if rules such as including update processing characters for data packets included in the data flow) are satisfied. there is. In addition, the authentication policy database 312 may include whether data packet authentication is performed only at the time of initial network connection or whether data packet authentication is checked at every data packet transmission time. According to an embodiment, the authentication policy database 312 may include a method of extracting identification information included in the authentication data packet and a method of checking (eg, an authentication information generation and checking algorithm such as one time password and HMAC). According to an embodiment, the authentication policy database 312 includes information on whether it is possible to transmit a data packet without additional authentication and information for changing the authentication status of the data flow when the update condition of the data flow is satisfied. It may include information for generating information. That is, the controller 202 may generate authentication information based on the authentication policy database 312 .

The blacklist policy database 313 may include a policy for permanently or temporarily blocking a node's access. The blacklist policy database 313 contains information (eg, node, IP address, MAC (media access) control) address, or at least one of a user ID).

The blacklist database 314 may include a list of at least one of a node, an IP address, a MAC address, or a user blocked by the blacklist policy database 313 . For example, if the node requesting access to the destination network is included in the blacklist database 314, the controller may isolate the node from the destination network by rejecting the access request of the node.

The control flow table 315 is an example of a session table for managing a flow (eg, a control flow) of a control data packet generated between a node and a controller. Upon successful access to the controller, control flow information may be generated by the controller. The control flow information may include at least one of identification information of the control flow, an IP address identified when accessing and authenticating a controller, a node ID, and a user ID. For example, when access to a destination network is requested from a node, the controller may retrieve control flow information through control flow identification information received from the node, and an IP address, node ID, or user included in the retrieved control flow information. By mapping at least one of the IDs to the access policy database 311, it is possible to determine (determine) whether a node is able to access and whether a data flow can be created for creating a TCP session with a destination network.

According to one embodiment, the control flow may have an expiration time. The node should update the expiration time of the control flow, and if the expiration time is not updated for a certain period of time, the control flow (or control flow information) may be removed. In addition, when it is determined that immediate access blocking is necessary according to the security event collected from the node, the controller may remove the control flow according to the node's request to terminate the connection. When the control flow is removed, the previously created data flow is also removed, so the connection of the node may be blocked.

The data flow table 316 is a table for managing a flow (eg, a data flow) through which detailed data packets are transmitted between a node, a gateway, and a destination network. A data flow may be created in a TCP session created in a node or IP unit, an application of a node, or in a more granular unit. The data flow table 316 includes data flow identification information, control flow identification information when a data flow is dependent on a control flow, an application ID for identifying whether a data packet transmitted from a node is an authorized data packet, and source network identification information , destination network identification information and/or service port. The data flow table 316 determines whether or not to continuously allow network access after allowing network access, or whether specific conditions (eg, TCP SYM Packet, TCP FIN Packet, the amount of transmitted data packets, and the amount of data packets included in the data flow). If exceeds, if a rule such as including the update processing character of the data packet included in the data flow) is satisfied, authentication information including whether to release the network connection and re-perform data packet authentication may be included. . According to an embodiment, the authentication information may include whether data packet authentication is performed only upon initial network connection or whether data packet authentication is checked at every data packet transmission time. In addition, the data flow table 316 includes data flow state information ( or authentication status information of the data flow).

According to an embodiment, the data flow table 316 may be equally included in a node (eg, node 201 of FIG. 2 ) and a gateway (eg, gateway 203 of FIG. 2 ).

4 illustrates a functional block diagram of a node in accordance with various embodiments.

Referring to FIG. 4 , a node may include a processor 410 , a memory 420 , and a communication circuit 430 . According to an embodiment, the node may further include a display 440 to interface with a user.

The processor 410 may control the overall operation of the node. In various embodiments, the processor 410 may include one processor core or a plurality of processor cores. For example, the processor 410 may include a multi-core such as a dual-core, a quad-core, or a hexa-core. According to embodiments, the processor 410 may further include a cache memory located inside or outside. According to embodiments, the processor 410 may be configured with one or more processors. For example, the processor 410 may include at least one of an application processor, a communication processor, and a graphical processing unit (GPU).

All or part of the processor 410 is electrically or operatively coupled to other components within the node (eg, memory 420 , communication circuitry 430 , or display 440 ). It can be coupled with or connected to. The processor 410 may receive commands from other components of the node, interpret the received commands, and perform calculations or process data according to the interpreted commands. The processor 410 may interpret and process a message, data, command, or signal received from the memory 420 , the communication circuit 430 , or the display 440 . The processor 410 may generate a new message, data, instruction, or signal based on the received message, data, instruction, or signal. The processor 410 may provide the processed or generated message, data, instruction, or signal to the memory 420 , the communication circuitry 430 , or the display 440 .

The processor 410 may process data or signals generated or generated in a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may write (or store) or update instructions, data, or signals to the memory 420 to execute or control a program.

The memory 420 may store a command for controlling a node, a control command code, control data, or user data. For example, the memory 420 may include at least one of an application program, an operating system (OS), middleware, and a device driver.

The memory 420 may include one or more of volatile memory and non-volatile memory. Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). may include The nonvolatile memory may include a read only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, and the like.

The memory 420 includes a nonvolatile medium such as a hard disk drive (HDD), a solid state disk (SSD), an embedded multi media card (eMMC), and a universal flash storage (UFS). may include more.

According to an embodiment, the memory 420 may store some of information included in the memory of the controller (eg, the memory 330 of FIG. 3 ). For example, the memory 420 may store the data flow table 316 described in FIG. 3 .

The communication circuit 430 may support establishment of a wired or wireless communication connection between a node and an external electronic device (eg, the controller 202 of FIG. 2 ) and performing communication through the established connection. According to an embodiment, the communication circuit 430 is a wireless communication circuit (eg, a cellular communication circuit, a short-range wireless communication circuit, or a global navigation satellite system (GNSS) communication circuit) or a wired communication circuit (eg, a local area network (LAN) ) communication circuit, or power line communication circuit), and using the corresponding communication circuit among them, a short-distance communication network such as Bluetooth, WiFi direct or IrDA (infrared data association) or a cellular network, Internet, or long-distance communication such as a computer network It can communicate with an external electronic device through a network. The above-described various types of communication circuits 430 may be implemented as a single chip or as separate chips.

The display 440 may output content, data, or a signal. In various embodiments, the display 440 may display image data processed by the processor 410 . According to embodiments, the display 440 may be configured as an integrated touch screen by being coupled with a plurality of touch sensors (not shown) capable of receiving a touch input or the like. When the display 440 is configured as a touch screen, a plurality of touch sensors may be disposed above the display 440 or below the display 440 .

A server (eg, the controller 202 of FIG. 2 ) according to an embodiment may include a processor 410 , a memory 420 , and a communication circuit 430 . The processor 410 , the memory 420 , and the communication circuit 430 included in the server may be substantially the same as the above-described processor 410 , the memory 420 , and the communication circuit 430 .

A gateway (eg, the gateway 203 of FIG. 2 ) according to an embodiment may include a processor 410 , a memory 420 , and a communication circuit 430 . The processor 410 , the memory 420 , and the communication circuit 430 included in the gateway may be substantially the same as the above-described processor 410 , the memory 420 , and the communication circuit 430 .

5 is a diagram illustrating a structure of an authentication data packet according to various embodiments of the present disclosure;

The existing data packet may be composed of a data packet structure including an IP header and payload including 5 tuples (source, destination information, etc.) information, which is a unit that can be identified by OSI (Open System Interconnection) during IP communication .

In order to implement Micro Service Architecture and Data Centric Networking, 5 tuples and applications that are actual communication subjects that can be identified in the operating system (kernel level) of nodes. : It may be necessary to know whether the minimum identification unit (unit defined by the user level) within the target application 212 of FIG. 2 is connected to the network.

The target application (eg, the target application 212 in FIG. 2 ) includes an authentication data packet (eg, a single authentication data packet) including information that can identify the included module or function, and when data accesses the network, the corresponding element. 510 and a data packet 520 using the authentication data packet as a header may be transmitted. In this case, the network access control application (eg, the access control application 211 of FIG. 2 ) that controls the network access in the operating system (kernel level) of the node can check the received authentication data packets 510 and 520, The authentication information is extracted from the authentication data packets 510 and 520 and transmitted to a controller (eg, the controller 202 in FIG. 2 ) to determine whether to allow network access based on the authentication information, and the A structure allowing network access may be provided based on whether or not network access is permitted.

The authentication information in the authentication data packets 510 and 520 can identify a level that cannot be identified by the operating system (Kernel), and in order to control network access, the minimum identification unit that the target application requests to allow network access when accessing the network. may include For example, the identification unit may include information such as a module or function, data, and the like, and the identification unit may be assigned according to the intention of a target who develops and operates a target application. As another example, the authentication information may include an authentication information generation algorithm designated by the controller to double-check the network connection of the target application.

A single authentication data packet 510 may include an IP header and a payload. For example, the payload of a single authentication data packet 510 may include an authentication data packet. According to an embodiment, the single authentication data packet 510 may have a structure for initial network access authentication.

The data packet 520 using the authentication data packet as a header may include an IP header, a payload including an authentication data packet, and a payload including an actual transmission data packet. According to an embodiment, the data packet 520 using the authentication data packet as a header may be a data packet for checking successive data packets.

In one embodiment, authentication data packets 510 and 520 may include one or more authentication information.

6 is a diagram illustrating an operation of controlling transmission of a data packet according to various embodiments of the present disclosure;

Referring to FIG. 6 , in the case of an unacceptable data packet in which a data flow does not exist among the data packets transmitted to the destination network 204 after the controller 202 is connected, the node 201 is to be blocked at the kernel stage of the network driver and the operating system. can Accordingly, the node 201 may not send any data packets that do not go through the access control application 211 to the destination network 204 .

The access control application 211 must access the controller 202 to identify and authenticate a node or one or more identification information and applications, modules and functions included in the application, data, and the like. After authentication is performed, the access control application 211 checks whether access is possible by querying the controller 202 for access network information when the target application 212 connects to the destination network 204, and the module and function of the authorized application; It can be controlled so that only objects such as data can connect to the network.

Unauthorized nodes or applications, modules and functions, data, etc. included in the application are basically in a state in which they cannot connect to the destination network 204 , and the target application 212 and the modules included in the target application 212 are sent from the controller 202 . and when data flow information including access information such as function and data is not transmitted to the first gateway 213 or the second gateway 223 , the first gateway 213 or the second gateway 223 transmits the data packet Because the forwarding of the node 201 is blocked, the destination network 204 is unreachable, that is, the node 201 is in an isolated state.

7 illustrates a signal flow diagram for a controller connection of a node according to various embodiments.

Since the node 201 needs to be authorized by the controller 202 to access or receive the network, the access control application 211 of the node 201 requests the controller 202 to generate a control flow to the node ( 201) can try to connect to the controller.

Referring to FIG. 7 , the access control application 211 of the node 201 may request a controller access from the controller 202 in operation 705 . For example, the access control application 211 may perform a controller connection request to create a control flow with the controller 202 . For example, the controller connection request may include information about the node 201 or the connection control application 211 .

In operation 710 , the controller 202 may determine whether the access control application 211 is in an accessible state according to the access policy based on the access request information. For example, the information requested by the access control application 211 to access the node 201 may include information about the type, location information, environment, the network including the node 201 and the access control application 211 . there is.

In one embodiment, the controller 202 controls the access control application ( 211), the connection unavailable information may be transmitted (operation 725).

In the case of the connectable node 201 , in operation 715 , the controller 202 may generate the access control application 211 or a control flow between the node 201 and the controller 202 . In this case, the controller 202 may generate control flow identification information in the form of a random number, and convert identification information of the node 201 and/or the network to which the node 201 belongs to a control flow table (eg, the control flow of FIG. 3 ). It can be stored in table 315). Information stored in the control flow table (eg, control flow identification information and/or control flow information) is used for user authentication of the node 201 , updating information of the node 201 , checking policy for network access of the node 201 and / Or it can be used for validation. In an embodiment, the controller 120 may generate the accessable application whitelist information in the access policy matching the node 201 .

In operation 720, the controller 202 may generate a whitelist of accessible applications based on an access policy matched with identification information of a node, a user, and a source network. When the white list is created, the controller 202 controls flow identification information (eg, ID) for identifying the control flow when the connection completion status and subsequent node user authentication request and continuous node information update are required as a result of the connection; The application whitelist may be transmitted to the access control application 211 of the node 201 (operation 725).

Also, the controller 202 may determine whether to allow the data packet for which authentication is not performed based on an authentication policy (eg, the authentication policy database 312 of FIG. 3 ). In this case, the controller 202 may check information on whether or not unauthenticated network access is possible for determining whether the node 201 will allow network access without data packet authentication based on the authentication policy, and unauthenticated network access is possible Whether or not information may be transmitted to the node 201 (operation 725).

When the control flow is generated, in operation 725 , the controller 202 may transmit a response to the controller connection request to the access control application 211 of the node 201 . In this case, the controller 202 may transmit the generated control flow identification information to the access control application 211 . In one embodiment, the controller 202 may send the accessible application whitelist information to the access control application 211 .

In operation 730, the access control application 211 may perform an application check. For example, the access control application 211 may perform a check on the application based on the accessible application whitelist received from the controller 202 . The access control application 211 can check whether the application exists (installed) in the node 201 based on the accessable application information, and in the case of the existing application, check whether the integrity and stability according to the validation policy ( On application, it can check for tampering, code signing check, fingerprint check).

In operation 735 , the access control application 211 may transmit an application check result to the controller 202 . For example, the access control application 211 may transmit information of an application existing in the node 201 and a result of the validation check to the controller 202 .

In operation 740 , the controller 202 may check whether the application is valid based on the received application information. When the application included in the received application information is a valid application, the controller 202 selects the gateway 203 where the node 201 is located in the access policy to allow the access of the node 201 connected to the network including the application. data flow can be created so that the application can proactively allow data packet transmission without data packet authentication in the authentication policy. For example, the data flow may be generated based on source IP, destination IP, and port information.

In operation 745 , the controller 202 may transmit the generated data flow to the gateway 203 . For another example, when the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203 .

In operation 750 , the controller 202 may transmit the generated data flow to the node 201 . For another example, when the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203 .

In operation 755 , the access control application 211 of the node 201 may process a result value for the response received from the controller 202 . For example, the access control application 211 may store the received control flow identification information and display a user interface screen indicating that the controller connection is complete to the user. When the controller connection is completed, the network connection request of the node 201 to the destination network may be controlled by the controller 202 .

According to another embodiment, the controller 202 may determine that the node 201 is unreachable. For example, when identification information of the node 201 and/or the network to which the node 201 belongs is included in the blacklist database, the controller 202 may determine that the node 201 is not accessible. In this case, the controller 202 may transmit a response indicating that the controller connection is impossible in operation 725 without generating a control flow in operation 715 . Also, in this case, operations 730 to 750 may not be performed. According to an embodiment, when a retry of the controller connection is required, the access control application 211 may perform operation 705 again.

In addition, when the data flow received from the controller 202 exists, the access control application 211 updates the data flow of the node 201 and transmits the data packet based on the data flow allowed in advance when connecting to the network. data flow can be managed.

According to an embodiment, operations 730 to 750 may not be performed when the access control application 211 determines that the application inspection is not necessary.

8 illustrates a signal flow diagram for network connection authentication of a node according to various embodiments of the present disclosure;

When the node 201 needs to communicate with the destination network, it is necessary to check whether authentication is completed in order to communicate with the corresponding destination network.

Referring to FIG. 8 , in operation 805 , the access control application 211 of the node 201 may detect a network access event of a target application installed in the node 201 (eg, the target application 212 of FIG. 2 ). there is.

In operation 810 , the access control application 211 may check whether a data flow corresponding to identification information of a target application and identification information of a destination network exists. According to an embodiment, the access control application 211 may drop the data packet of the target application when a data flow exists but the authentication status is not valid (eg, in case of authentication failure or transmission impossible). According to an embodiment, the access control application 211 may transmit the data packet of the target application to the destination network when the data flow is authenticated or transmission is permitted. According to an embodiment, operation 810 may not be performed and operation 815 may be performed after operation 805 is performed.

In operation 815 , the access control application 211 may check the data packet transmitted by the target application and check whether the data packet is an authentication data packet. When the data packet is an authentication data packet, the access control application 211 may perform a network access authentication request to the controller 202 (operation 820 ). In this case, the access control application 211 may perform a network access authentication request including control flow identification information, target application identification information, identification information of a destination network to be accessed, and authentication data packet information to the controller 202 .

According to an embodiment, when the data packet is not an authentication data packet, the access control application 211 may perform a network access request (operations illustrated in FIG. 9 ) to the controller 202 .

In operation 825, the controller 202 may check an access policy matching the identified node 201, user, and source network information based on the control flow identification information. For example, the controller 202 determines whether the access-requested identification information (eg, identification information of the target application, identification information of the destination network) is included in the access policy and whether the destination network corresponding to the identification information is accessible. can be checked According to an embodiment, when the network connection is impossible, the controller 202 may transmit a result of not being able to connect to the network to the access control application 211 in operation 845 .

If access is possible, in operation 830, the controller 202 checks whether the authentication data packet transmitted by the node 201 is valid based on the authentication policy (eg, the authentication policy database 312 of FIG. 3 ). can For example, in order to validate the authentication data packet, the controller 202 checks whether transmittable identification information included in the authentication policy is the same as identification information transmitted by the node, and whether network access is possible with the identification information. Whether or not the authentication information is valid may be determined through the authentication information generated through the authentication information generating algorithm for network access authentication and the authentication information checking algorithm included in the authentication policy.

According to an embodiment, if the controller 202 can allow network access by approval of a matched third party (eg, the data owner 206 in FIG. 2 ) based on the identification information of the node 201 , Authentication data packet validation may be performed through third-party authentication verification. Through the above verification, a third party can safely manage the data it owns, and can check the record of using the data.

When the verification of the access and authentication policy is completed, in operation 835 , the controller 202 based on the data flow table (eg, the data flow table 316 of FIG. 3 ) to allow the node 201 to access the network. With the identification information of the destination network, it can be checked whether accessable data flow information exists.

When valid data flow information does not exist in the data flow table, the controller 202 controls the source IP, destination network identification information, and data including authentication information generated according to the authentication policy so that the target application can network access to the destination network. You can create flows.

According to an embodiment, the authentication information may be information including whether it is possible to always transmit a data packet without additional authentication renewal thereafter and an authentication renewal time. For example, authentication information determines whether to continue to allow network access after allowing network access, or whether certain conditions (e.g., TCP SYM Packet, TCP FIN Packet, the amount of transmitted data packets, the amount of data packets included in the data flow) exceeds, when a rule (such as including an update processing character of a data packet included in a data flow) is satisfied, whether to release the network connection and re-perform data packet authentication may be included. In addition, the authentication information may include information for setting the authentication state of the data flow to the authentication required state when the data flow update condition is satisfied.

In operation 840 , the controller 202 may transmit the generated data flow to the gateway 203 . For another example, when the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203 .

In operation 845 , the controller 202 may transmit a response to the network access authentication request (operation 820 ) of the access control application 211 . For example, when the generated data flow exists, the controller 202 may transmit the generated data flow to the access control application 211 . As another example, when there is a data flow accessible in the data flow table, the corresponding data flow may be transmitted to the node 201 . As another example, when the network connection of the target application of the node 201 is impossible or authentication fails, the controller 202 may transmit a connection failure result.

In operation 850 , the access control application 211 may process a result value for the response transmitted from the controller 202 . For example, when the access control application 202 receives a data flow from the controller 202, it updates the data flow of the node 201 with the received data flow, and drops or transmits an authentication data packet according to the authentication information. can be processed As another example, the access control application 211 may drop the data packet when receiving an authentication failure result or a connection impossible result from the controller 202 .

According to an embodiment, after performing operation 805, the access control application 211 may perform a validity check on the access application according to the validity check policy. For example, the access control application 211 may further perform integrity and stability check (application forgery, tampering check, code signing check, fingerprint check, etc.) of the access application. The access control application 211 may perform operation 815 when the result of the validation check is successful.

9 illustrates a signal flow diagram for controlling a network connection of a node according to various embodiments.

After the node 201 is authorized from the controller 202, the node 201 controls the network connection of other applications stored in the node 201 through the connection control application 211 of the node 201, thereby providing trusted data. transmission can be guaranteed.

In operation 905 , the access control application 211 may detect a network access event of another application stored in the node 201 (eg, the target application 212 of FIG. 2 ). Operation 905 may be substantially the same as operation 805 of FIG. 8 .

In operation 910 , the access control application 211 determines whether the data packet of the target application can be transmitted without authentication based on the unauthorized network access availability information received from the controller 202 (eg, operation 725 of FIG. 7 ). can According to an embodiment, when it is not possible to access the unauthorized network, the access control application 211 may drop the data packet. According to an embodiment, when it is possible to access the unauthenticated network, the access control application 211 may perform operation 915 .

In operation 915 , the access control application 211 may perform a network access request to the controller 202 . For example, the access control application 211 may perform a network access request including the controller 202 and the generated control flow identification information, target application identification information, and destination network identification information.

In operation 920, the controller 202 performs access-requested identification information (eg, identification information of a destination network) in an access policy corresponding to information identified based on the control flow identification information (eg, node, user, and source network identification information). and port information) and whether the destination network can be accessed. According to an embodiment, when the network connection is impossible, the controller 202 may transmit a connection failure result to the access control application 211 of the node 201 (operation 940). According to an embodiment, the controller 202 may perform operation 925 when a network connection is possible.

In operation 925 , the controller 202 may check the authentication policy. For example, the controller 202 may check whether the network connection of the access control application 211 is a possible network connection without authentication in the authentication policy. According to an embodiment, when the network connection of the access control application 211 is not a network connection that is possible without authentication, the controller 202 may transmit a connection unavailable result to the access control application 211 (operation 940 ).

When the verification of the access and authentication policy is completed, in operation 930 , the controller 202 based on the data flow table (eg, the data flow table 316 of FIG. 3 ) to allow the node 201 to access the network. With the identification information of the destination network, it can be checked whether accessable data flow information exists.

When valid data flow information does not exist in the data flow table, the controller 202 controls the source IP, destination network identification information, and data including authentication information generated according to the authentication policy so that the target application can network access to the destination network. You can create flows.

According to an embodiment, the authentication information may be information including whether it is possible to always transmit a data packet without additional authentication renewal thereafter and an authentication renewal time. For example, authentication information determines whether to continue to allow network access after allowing network access, or whether certain conditions (e.g., TCP SYM Packet, TCP FIN Packet, the amount of transmitted data packets, the amount of data packets included in the data flow) exceeds, when a rule (such as including an update processing character of a data packet included in a data flow) is satisfied, whether to release the network connection and re-perform data packet authentication may be included. In addition, the authentication information may include information for setting the authentication state of the data flow to the authentication required state when the data flow update condition is satisfied.

In operation 935 , the controller 202 may transmit the generated data flow to the gateway 203 . For another example, when the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203 .

In operation 940 , the controller 202 may transmit a response to the network access authentication request (operation 915 ) of the access control application 211 . For example, when the generated data flow exists, the controller 202 may transmit the generated data flow to the access control application 211 . As another example, when there is a data flow accessible in the data flow table, the corresponding data flow may be transmitted to the node 201 . As another example, when the network connection of the target application of the node 201 is impossible, the controller 202 may transmit a connection failure result.

In operation 945 , the access control application 211 may process a result value for the response transmitted from the controller 202 . For example, when the access control application 202 receives a data flow from the controller 202, it updates the data flow of the node 201 with the received data flow, and transmits a data packet based on the data flow. can As another example, the access control application 211 may drop the data packet when receiving a connection unavailable result from the controller 202 .

In an embodiment, after performing operation 910 , the access control application 211 may perform a validity check on the access application according to the validity check policy. For example, the access control application 211 may further perform integrity and stability check (application forgery, tampering check, code signing check, fingerprint check, etc.) of the access application. The access control application 211 may perform operation 915 when the validation result is successful.

10 illustrates a signal flow diagram for transmitting a data packet of a node according to various embodiments.

The access control application 211 of the node 201 checks whether the corresponding data packet is authenticated and needs to be updated before transmitting the data packet, and can control not to transmit the data packet if it is not authenticated or needs to be updated. there is.

In operation 1005 , the access control application 211 may detect a data packet transmission event. For example, the access control application 211 may detect an operation in which another application included in the node 201 (eg, the target application 212 of FIG. 2 ) transmits a data packet.

In operation 1010 , the access control application 211 may perform a data packet authentication check. For example, the access control application 211 may check authentication information included in the data flow corresponding to the destination network identification information of the data packet requested to be transmitted. The access control application 211 may check whether or not to check whether the authentication data packet is included in each data packet based on the authentication information, and when it is necessary to check whether the authentication data packet is included, the access control application 211 may perform the data packet check. In this case, the access control application 211 may drop the data packet when the authentication data packet included in the data packet does not exist or the authentication information included in the data packet is different from the authentication information included in the data flow. For another example, when it is not necessary to check whether the authentication data packet is included, the access control application 211 may perform operation 1015 .

In operation 1015 , the access control application 211 may perform a data packet update check. For example, the access control application 211 may determine whether data packet inspection for authentication renewal is required based on authentication information included in the data flow. For example, when data packet inspection for authentication update is required, the access control application 211 may inspect the data packet requested to be transmitted according to an authentication update method included in authentication information. According to an embodiment, when the data packet requested to be transmitted is a TCP SYN Packet or a TCP FIN Packet, the connection control application 211 determines that the amount of the transmitted data packet exceeds the amount of the data packet included in the data flow. When a data flow update condition is satisfied according to a series of rules included in the authentication information, such as including the update processing character (Suffix) of the data packet included in the flow, the data flow update procedure may be performed. For example, the access control application 211 may change the update status of the data flow to require update, transmit information about the data flow to the controller 202 and request the update of the data flow (operation 1020 ).

In operation 1025 , the controller 202 may update the data flow based on the data flow information received from the access control application 211 .

In operation 1030 , the controller 202 may transmit the updated data flow to the gateway 203 .

According to an embodiment, operations 1020 to 1030 may not be performed when the data flow does not need to be updated.

If the data packet inspection for authentication renewal is not required, in operation 1035 , the access control application 211 may transmit the data packet. In addition, when the authentication update is completed, the access control application 211 may transmit the data packet. In addition, the access control application 211 may transmit the data packet when the data packet inspection is completed in operation 1010 or operation 1015 . According to an embodiment, the access control application 211 may drop the data packet when the data packet inspection fails in operation 1010 or operation 1015 .

11 is a signal flow diagram for controlling data packet reception of a gateway according to various embodiments of the present disclosure;

When the gateway 203 receives a data packet, before forwarding the data packet, the gateway 203 checks whether the corresponding data packet is authenticated and needs to be updated, and if authentication is not performed or needs to be updated, the gateway 203 can control not to forward the data packet. there is.

In operation 1105 , the gateway 203 may detect a data packet reception event. For example, the gateway 203 may detect a data packet sent from the access control application 211 of the node 201 .

In operation 1110 , the gateway 203 may check the source IP of the received data packet and identification information of the destination network, and may determine whether a data flow corresponding to the source IP and identification information of the destination network exists. According to an embodiment, when a data flow corresponding to the identification information of the source IP and the destination network does not exist, the gateway 203 may drop the data packet.

If there is a data flow, in operation 1115 , the gateway 203 may perform a data packet authentication check. For example, the gateway 203 may check the authentication information included in the data flow corresponding to the destination network identification information of the received data packet. The gateway 203 may check whether to check whether the authentication data packet is included in each data packet based on the authentication information, and when it is necessary to check whether the authentication data packet is included, the gateway 203 may check the data packet. In this case, when the authentication data packet included in the data packet does not exist or the authentication information included in the data packet is different from the authentication information included in the data flow, the gateway 203 may drop the data packet. For another example, when it is not necessary to check whether the authentication data packet is included, the gateway 203 may perform operation 1120 .

In operation 1120 , the gateway 203 may perform a data packet update check. For example, the gateway 203 may determine whether data packet inspection for authentication renewal is required based on authentication information included in the data flow. For example, when data packet inspection for authentication update is required, the gateway 203 may inspect the received data packet according to an authentication update method included in authentication information. According to an embodiment, the gateway 203 includes in the data flow when the received data packet is a TCP SYN Packet or a TCP FIN Packet, when the amount of the received data packet exceeds the amount of the data packet included in the data flow. When the data flow update condition is satisfied according to a set of rules included in the authentication information, such as including the update processing character (Suffix) of the data packet, the data flow update procedure may be performed. For example, the gateway 230 may change the update status of the data flow to need update, transmit information about the data flow to the controller 202 and request the update of the data flow (operation 1125 ).

In operation 1130 , the controller 202 may update the data flow based on the data flow information received from the gateway 203 .

According to an embodiment, operations 1125 and 1130 may not be performed when the data flow does not need to be updated.

If the data packet inspection for authentication renewal is not required, in operation 1135 , the gateway 203 may forward the data packet. Also, when the authentication update is completed, the gateway 203 may forward the data packet. Also, when the data packet inspection is completed in operation 1115 or operation 1120 , the gateway 203 may forward the data packet. According to an embodiment, the gateway 203 may drop the data packet when the data packet inspection fails in operation 1115 or operation 1120 .

12 is a signal flow diagram for updating a control flow of a node according to various embodiments.

The access control application 211 maintains information about the control flow and data flow of the node 201, and receives an updated data flow from the controller 202 or periodically to check whether the control flow is valid. can be requested to be renewed.

Referring to FIG. 12 , in operation 1205 , the access control application 211 may detect a control flow update event.

In operation 1210 , the access control application 211 may request a control flow update from the controller 202 based on the control flow identification information.

In operation 1215 , the controller 202 may check whether a control flow exists in a control flow table (eg, the control flow table 315 of FIG. 3 ) based on the received control flow identification information. According to the embodiment, when the control flow does not exist (eg, when the connection is disconnected by another security system, when the connection is disconnected due to self-risk detection, etc.), the controller 202 determines that the connection of the node 201 is valid. Therefore, the connection unavailable result may be transmitted to the access control application 211 (operation 1220).

The controller 202 may update the update time when a control flow exists in the control flow table (eg, the control flow table 315 of FIG. 3 ). In this case, the controller 202 may transmit the updated identification information of the control flow to the access control application 211 (operation 1220 ).

In one embodiment, the controller 202 transmits information about the data flow to the access control application ( 211) (operation 1220).

In operation 1225 , the access control application 211 of the node 201 may process a result value for the response received from the controller 202 . For example, when the control flow update result is impossible, the access control application 211 may block all network connections of the application. As another example, the access control application 211 may update the data flow when the control flow update result is normal and the updated data flow information exists.

13 illustrates a signal flow diagram for disconnection of a node according to various embodiments.

13, in operation 1305, the node 201 terminates the node 201, terminates the access control application 211, terminates the target application, no longer uses the network connection, and information identified from the interworking system. At least one of the connection termination requests may be detected based on the . In this case, in operation 1310 , the node 201 or the access control application 211 may request the controller 202 to remove the control flow.

In operation 1315 , the controller 202 may remove the identified control flow based on the received control flow identification information.

In operation 1320 , the controller 202 may remove all data flows dependent on the removed control flow. Accordingly, node 201 is no longer able to connect to the destination network based on the removed data flow.

In operation 1325 , the controller 202 may perform a removal request for all data flows dependent on the removed control flow to the gateway 203 .

14 illustrates a signal flow diagram for termination of application execution of a node according to various embodiments.

Referring to FIG. 14 , in operation 1405 , the access control application 211 of the node 201 may check in real time whether the running application is terminated, and may detect an application execution termination event.

In operation 1410 , the access control application 211 may check whether a data flow corresponding to the terminated application identification information and PID (Process ID and Child Process ID Tree) information exists. If the data flow exists, the access control application can delete the data flow. According to an embodiment, the access control application 211 may check whether the terminated application exists in the running process list in order to track the termination of the multi-executable application, and if it does not exist, identification information of the terminated application You can delete all data flows corresponding to .

In operation 1415 , the access control application 211 may request the controller 202 to delete the deleted data flow.

In operation 1420 , the controller 202 may delete the data flow requested to be deleted. Also, the controller 202 may perform a removal request for the deleted data flow to the gateway 203 . Accordingly, data packets corresponding to the source network, destination network, and port information included in the deleted data flow cannot be transmitted any more.

15 is a flowchart illustrating a method of operating a connection control application installed in a node according to various embodiments of the present disclosure. In one embodiment, the operation shown in FIG. 15 may be performed through the access control application 211 included in the node 201 of FIG. 2 .

Referring to FIG. 15 , in operation 1505 , the access control application 211 may detect a network access event through the access control application.

In operation 1510, the access control application 211 may check whether the data packet transmitted by the target application stored in the node is an authentication data packet.

In operation 1515 , the access control application 211 may transmit identification information of the target application, identification information of a destination network of the target application, and authentication data packet information to an external server, and may perform a network access authentication request.

In operation 1520 , the access control application 211 may receive a data flow or network connection unavailable result including identification information of a node, identification information of a destination network, and authentication information from an external server. In an embodiment, the authentication information may be generated based on an authentication policy included in an external server (eg, the controller 202 of FIG. 2 ). In an embodiment, the authentication information may include information on whether it is possible to transmit a data packet without additional authentication and information for changing the authentication status of the data flow when the update condition of the data flow is satisfied based on the authentication policy. there is. According to an embodiment, the access control application 211 may receive a network connection impossible result when it is determined that the network connection is impossible from the external server.

In operation 1525 , the access control application 211 may transmit or drop the authentication data packet based on the authentication information included in the data flow or the result of not being able to access the network. For example, the access control application 211 may drop the data packet when a network connection unavailable result is received. As another example, when a data flow is received, the access control application 211 may transmit an authentication data packet based on authentication information included in the data flow.

16 is a flowchart illustrating a method of operating a server according to various embodiments of the present disclosure. In one embodiment, the operations shown in FIG. 16 may be performed via the controller 202 shown in FIG. 2 .

Referring to FIG. 16 , in operation 1605 , the server (eg, the controller 202 of FIG. 2 ) performs a connection control application (eg, the access control application 211 of FIG. 2 ) of the node (eg, the node 201 of FIG. 2 ). ) to receive a network access authentication request. For example, the network access authentication request may include authentication data packet information.

In operation 1610, the server may check whether a node is accessible based on a database (eg, the database of FIG. 3 ) included in the server.

In operation 1615, the server may check whether the authentication data packet information is valid based on the authentication policy included in the database.

In operation 1620, when the node is accessible and the authentication data packet information is valid, the server may check whether a data flow corresponding to identification information of the node and identification information of a destination network of the node exists.

In operation 1625, when the data flow does not exist, the server may generate a data flow including identification information of a node, identification information of a destination network, and authentication information generated based on an authentication policy.

In operation 1630, the server may transmit the generated data flow to the node.

17 is a flowchart illustrating a method of operating a gateway according to various embodiments of the present disclosure. In one embodiment, the operations shown in FIG. 17 may be performed through the gateway 203 of FIG. 2 .

Referring to FIG. 17 , in operation 1705 , the gateway 203 may receive a data packet from a node's access control application.

In operation 1710, the gateway 203 may determine whether a data flow exists based on source IP, destination IP, and destination port information of the data packet included in the data packet.

In operation 1715 , when a data flow exists, the gateway 203 may check authentication information included in the data flow.

In operation 1720, the gateway 203 may determine whether to inspect the data packet based on whether authentication is required included in the authentication information.

In operation 1725, the gateway 203 may determine whether to inspect the data packet based on whether or not authentication renewal is required included in the authentication information.

In operation 1730, the gateway 203 may forward the data packet when the data packet inspection is completed.

The above description is merely illustrative of the technical idea disclosed in this document, and those of ordinary skill in the art to which the embodiments disclosed in this document belong are not departing from the essential characteristics of the embodiments disclosed in this document. Various modifications and variations will be possible.

Therefore, the embodiments disclosed in this document are for explanation rather than limiting the technical ideas disclosed in this document, and the scope of the technical ideas disclosed in this document is not limited by these embodiments. The protection scope of the technical idea disclosed in this document should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present document.

Claims (17)

In the node,
communication circuit;
a processor operatively coupled to the communication circuitry; and
a memory operatively coupled to the processor and storing a connection control application and a target application, wherein the memory, when executed by the processor, causes the node to:
detecting a network access event through the access control application;
Check whether the data packet transmitted by the target application is an authentication data packet,
transmits the identification information of the target application, identification information of the destination network of the target application, and the authentication data packet information to an external server, and performs a network access authentication request;
Receiving data flow or network connection impossible information including authentication information from the external server,
store instructions to transmit or drop the authentication data packet based on the data flow or the network connection unavailable information; and
The authentication information is generated based on an authentication policy included in the external server, node. The method of claim 1,
The authentication information includes information on whether it is possible to transmit a data packet without additional authentication and information for changing an authentication state of the data flow when an update condition of the data flow is satisfied based on the authentication policy. . The method of claim 1, wherein the instructions cause the node to:
Determining whether to transmit the data packet of the target application without authentication based on the information on whether or not unauthenticated network connection is possible received from the external server through the access control application,
When transmitting the data packet without authentication, a network access request is made to the external server,
Receiving a data flow including the authentication information from the external server,
and transmit the data packet based on the received data flow. The method of claim 1, wherein the instructions cause the node to:
check authentication information included in a data flow corresponding to information included in a data packet requested to be transmitted from the target application through the access control application;
determining whether to inspect the data packet based on whether or not authentication included in the authentication information is required;
determining whether to inspect the data packet based on whether or not authentication renewal included in the authentication information is required;
and transmit the data packet when the data packet inspection is complete. 5. The method of claim 4, wherein the instructions cause the node to:
Through the access control application, it is checked whether or not to include an authentication data packet in each transmitted data packet based on the authentication information;
When it is necessary to check whether an authentication data packet is included in each transmitted data packet, the data packet is checked,
and drop the data packet when there is no authentication data packet in the data packet or when authentication information included in the data packet is different from authentication information included in the data flow. 5. The method of claim 4, wherein the instructions cause the node to:
Through the access control application, check whether data packet inspection for authentication renewal is required based on the authentication information;
When data packet inspection for authentication renewal is required, the data packet is inspected based on the authentication update method included in the authentication information;
and to set the update status of the data flow to need update when a data flow update condition included in the authentication information is satisfied. 7. The method of claim 6, wherein the instructions cause the node to:
When the update status of the data flow requires update, the data flow update request is made to the external server;
and the data flow update request includes the data flow information. The method of claim 1, wherein the instructions cause the node to:
When the data packet requested by the target application to be transmitted is an authentication data packet, the network access authentication request is made to the external server,
When the data packet requested to be transmitted is not an authentication data packet, the node performs a network access request to the external server. in the server,
communication circuit;
a memory for storing the database; and
a processor operatively coupled with the communication circuitry and the memory, the processor comprising:
Receive a network access authentication request from a node's access control application, wherein the network access authentication request includes authentication data packet information;
Checking whether the node is accessible based on the database,
Checking whether the authentication data packet information is valid based on the authentication policy included in the database,
If the node is accessible and the authentication data packet information is valid, check whether a data flow corresponding to identification information of the node and identification information of a destination network of the node exists;
When the data flow does not exist, generating a data flow including identification information of the node, identification information of the destination network, and authentication information generated based on the authentication policy,
and send the generated data flow or the existing data flow to the node. 10. The method of claim 9,
The authentication information is
A server, comprising: information on whether it is possible to transmit a data packet without additional authentication; and information for changing an authentication state of the data flow when an update condition of the data flow is satisfied based on the authentication policy. 10. The method of claim 9,
The authentication information includes information indicating whether to check whether an authentication data packet is included in each data packet transmitted from the node and information indicating whether data packet inspection for authentication update is required. 10. The method of claim 9, wherein the processor,
receive a network access request from the access control application, wherein the network access request includes identification information of a target application included in the node and identification information of a destination network of the target application;
Check whether the target application is accessible based on the access policy included in the database,
Checking whether the network access is possible without authentication based on the authentication policy included in the database,
sending an unreachable result to the access control application if the target application is not accessible or if the network connection is not possible without authentication; and
to generate a data flow including identification information of the target application and identification information of the destination network when the target application is accessible and the network connection is possible without authentication, and transmit the generated data flow to the access control application; configured, server. 10. The method of claim 9, wherein the processor,
receive a data flow update request from the access control application, wherein the data flow update request includes data flow identification information;
update the data flow, and set the update status of the data flow included in the data flow to update completion;
and send the updated data flow to the access control application. In the gateway,
communication circuit;
Memory; and
a processor operatively coupled with the communication circuitry and the memory, the processor comprising:
receive a data packet from the node's access control application;
Checking whether a data flow exists based on source IP, destination IP, and destination port information of the data packet included in the data packet;
If the data flow exists, check the authentication information included in the data flow,
determining whether to inspect the data packet based on whether or not authentication included in the authentication information is required;
determining whether to inspect the data packet based on whether or not authentication renewal included in the authentication information is required;
and forward the data packet when the data packet inspection is complete. A method of operating a connection control application installed on a node, the method comprising:
detecting a network access event through the access control application;
checking whether the data packet transmitted by the target application stored in the node is an authentication data packet;
transmitting the identification information of the target application, identification information of the destination network of the target application, and the authentication data packet information to an external server, and performing a network access authentication request;
receiving data flow or network connection impossible information including authentication information from the external server; and
transmitting or dropping the authentication data packet based on the data flow or the network access unavailable information; including,
The authentication information is generated based on an authentication policy included in the external server,
The authentication information includes information on whether it is possible to transmit a data packet without additional authentication and information for changing an authentication state of the data flow when an update condition of the data flow is satisfied based on the authentication policy . In the method of operating a server,
receiving a network connection authentication request from a connection control application of the node, the network connection authentication request including authentication data packet information;
checking whether the node is accessible based on a database included in the server;
checking whether the authentication data packet information is valid based on an authentication policy included in the database;
checking whether a data flow corresponding to identification information of the node and identification information of a destination network of the node exists when the node is accessible and the authentication data packet information is valid;
generating a data flow including identification information of the node, identification information of the destination network, and authentication information generated based on the authentication policy when the data flow does not exist; and
transmitting the generated data flow to the node; A method comprising A gateway operation method comprising:
receiving a data packet from a connection control application of the node;
checking whether a data flow exists based on source IP, destination IP, and destination port information of the data packet included in the data packet;
checking authentication information included in the data flow when the data flow exists;
determining whether to inspect the data packet based on whether authentication is required included in the authentication information;
determining whether to inspect the data packet based on whether or not an authentication update included in the authentication information is required; and
forwarding the data packet when the data packet inspection is completed; A method comprising

Images