KR102415567B1 - System for controlling network access of virtualization terminal and method of the same - Google Patents

Abstract

A server according to an embodiment of the present document comprises: a communication circuit; a memory for storing a database; and a processor connected operationally to the communication circuit and the memory. The processor may be configured to receive a network access request from a connection control application of a virtualization instance, wherein the network access request includes the identification information of a target application of the virtualization instance and the identification information of a destination network, to check whether the target application can be accessed based on the identification information of the target application and the identification information of the destination network, to generate an accessible data flow if the target application can be accessed, to check whether the data packets of the target application can be transmitted to the destination network through a virtual router, to update the data flow if the data packets can be transmitted through the virtual router, and to transmit the updated data flow to a virtualization server and the virtualization instance. Therefore, a virtualization instance can block the transmission of data packets of an unapproved application.

Description

SYSTEM FOR CONTROLLING NETWORK ACCESS OF VIRTUALIZATION TERMINAL AND METHOD OF THE SAME

Embodiments disclosed in this document relate to a system for controlling network access of a virtualization instance and a method therefor.

Multiple devices may communicate data over a network. For example, a smartphone may transmit or receive data with a server via the Internet. The network may include a public network such as the Internet as well as a private network such as an intranet.

Cloud or specialized server is used to reduce various security risks that can be introduced from the outside in network separation or network connection, and to provide a work environment for each user with devices with minimum specifications anytime, anywhere. A virtualized work environment (Virtual Desktop Infrastructure or Cloud Desktop) is being used.

The demand for such an indirect work environment is increasing as non-face-to-face work increases in recent years. By providing an indirect business network access structure that accesses and accesses the business network in a virtualized business environment accessed by authorized users, it is possible to minimize the problem of direct propagation of various security problems inherent in terminals connected to the Internet to the business network. There are advantages that can be

In the case of a virtualized business environment, there is a high probability that the virtualized business environment and the business network are located on the same network. Since it is not easy to install a physical network boundary-based security solution in an environment, there is a problem in that it is difficult to establish an additional network boundary.

If the access control application that performs the actual network access control is terminated due to a hijacker, a user with a malicious purpose, or a vulnerability in the access control application, the virtualization instance is in a state where it can always access the business network without data flow control. And since there is no way to identify it at the network boundary, the data flow access control technology is ineffective.

In addition, the hijacker installs a backdoor after acquiring control of the virtualized terminal environment to create a means to control the virtualized instance environment at all times through a client other than the virtualized business environment access client, and risks to the business network at all times. You can create a state for propagation.

In addition, if the virtualization instance and the access control application that needs to be run and connected to the controller at all times is not identified, the method of shutting down or rebooting the virtualization instance through the virtualization server provides a reliable network blocking method. In the case of a situation in which the access control application is not executed due to this, it may be difficult to identify and solve risk factors and problems.

In addition, in the case of a virtualized instance running a server application, a serious failure may occur if it is continuously shut down or rebooted.

Various embodiments disclosed in this document are intended to provide a system for solving the above-described problems in a network environment and a method therefor.

A server according to an embodiment disclosed in this document includes a communication circuit, a memory for storing a database, and a processor operatively connected to the communication circuit and the memory, wherein the processor is Receive a network connection request, wherein the network connection request includes identification information of a target application of the virtualization instance and destination network identification information, and access of the target application based on identification information of the target application and the destination network identification information Check whether it is possible, create a data flow if it is reachable, check whether the data packet of the target application can be transmitted to the destination network through the virtual router, and when the data packet is transmitted through the virtual router If possible, update the data flow, and send the updated data flow to the virtualization server and the virtualization instance.

A virtualization server according to an embodiment disclosed in this document is a communication circuit, a processor operatively connected to the communication circuit, and instructions operatively connected to the processor, and executed by the processor as a virtualization instance and a virtual router A memory to store, wherein the instructions, when executed by the processor, the virtualization instance requests a network connection to an external server through a connection control application, the network connection request includes identification information of a destination network, receive a data flow from the external server through the access control application, wherein the data flow corresponds to identification information of the virtualization instance and identification information of the destination network, wherein the data flow is transmitted through the virtual router and transmit, through the access control application, a data packet of a target application based on the received data flow.

The method of operating an access control application installed in a virtualization instance according to an embodiment disclosed in this document includes the operation of requesting a network access to an external server, the network access request includes identification information of a destination network, and data from the external server receiving a flow, wherein the data flow corresponds to identification information of the virtualization instance and identification information of the destination network, and the data flow includes information on whether a data packet can be transmitted through the virtual router, and and transmitting a data packet of a target application based on the received data flow.

The method of operating a server according to an embodiment disclosed in this document includes the operation of receiving a network access request from an access control application of a virtualization instance, wherein the network access request includes identification information of a target application and destination network identification information of the virtualization instance. Including, the operation of checking whether the target application is accessible based on the identification information of the target application and the destination network identification information, the operation of generating a data flow if the connection is possible, the data packet of the target application is a virtual router Checking whether the data packet can be transmitted to the destination network through the virtual router; updating the data flow if the data packet can be transmitted through the virtual router It may include an action to

According to the embodiments disclosed in this document, the virtualization instance may block data packet transmission of unauthorized applications through the tunneling or access control application for data flow-based access control to the virtualization instance that does not create a secure session.

In addition, according to the embodiments disclosed in this document, in addition to network separation and provision of a virtual business environment in a network-connected environment, a server application that performs a server role installed in a virtualization instance (eg, Enterprise Resources Planning, Groupware, etc.), etc. In order to control the virtualization server, you can control the network access of the virtualization instance through the virtual router existing on the virtualization server.

In addition, according to the embodiments disclosed in this document, the controller controls the routing table of the virtual router existing in the virtualization server to block unauthorized access transmitted or received to the virtualization instance, and only the authorized target can access the authorized destination. In addition, even when the network access control application is bypassed, the network access is blocked by the virtual router, so a more secure network access control environment can be rescued than when only relying on the access control application.

In addition, according to the embodiments disclosed in this document, based on the virtual router of the virtualization server, network access can be controlled by setting the source and destination routing bands together with identification information such as MAC and IP addresses at the Layer 2 or 3 level. In addition, fine-grained network access control may be possible with identification information such as MAC and IP address, which are the minimum identification units of virtualization instances.

In addition, according to the embodiments disclosed in this document, in a situation where the network access control application is not executed in the virtualization instance, the server application by blocking a band other than the controller access path or allowing communication only in the allowable basic routing band set by the controller Even in this running environment, while ensuring minimal continuity, the administrator can console the virtualization server to identify and repair the problem of the virtualized instance that has had a problem, or to review a dangerous situation.

In addition, various effects directly or indirectly identified through this document may be provided.

1 illustrates an architecture in a network environment according to various embodiments.
2 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure;
3 illustrates a functional block diagram of a virtualization server or virtualization instance according to various embodiments.
4 is a diagram illustrating an operation of controlling transmission of a data packet according to various embodiments of the present disclosure;
5 is a diagram illustrating system startup of a virtualization instance according to various embodiments.
6 illustrates a signal flow diagram for a controller connection of a virtualization instance according to various embodiments.
7 illustrates a signal flow diagram for user authentication of a virtualization instance according to various embodiments.
8 illustrates a signal flow diagram for controlling a network connection of a virtualization instance according to various embodiments.
9 illustrates a signal flow diagram for requesting a network whitelist of a virtualization instance according to various embodiments.
10 illustrates a signal flow diagram for updating a control flow of a virtualization instance according to various embodiments.
11 illustrates a signal flow diagram for terminating a controller connection of a virtualization instance according to various embodiments.
12 illustrates a signal flow diagram for updating a virtualization instance table according to various embodiments.
13 illustrates a signal flow diagram for termination of application execution of a virtualization instance according to various embodiments.
14 is a flowchart illustrating an operation for a network connection request of a virtualization instance according to various embodiments.
15 is a flowchart illustrating an operation for controlling a data packet in a virtual router according to various embodiments of the present disclosure;
16 is a flowchart illustrating a method of operating a server according to various embodiments of the present disclosure;

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

In this document, the singular form of a noun corresponding to an item may include one or a plurality of items, unless the context clearly indicates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A; Each of the phrases such as "at least one of B, or C" may include any one of, or all possible combinations of, items listed together in the corresponding one of the phrases. Terms such as "first", "second", or "first" or "second" may be used simply to distinguish the element from other elements in question, and may refer to elements in other aspects (e.g., importance or order) is not limited. It is said that one (eg, first) component is "coupled" or "connected" to another (eg, second) component, with or without the terms "functionally" or "communicatively". When referenced, it means that one component can be connected to the other component directly (eg by wire), wirelessly, or through a third component.

Each component (eg, a module or a program) of components described in this document may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. . According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repetitively, or heuristically, or one or more of the operations are executed in a different order, omitted, or , or one or more other operations may be added.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit or a part of the part that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or an application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one of the one or more instructions stored from the storage medium and execute it. This makes it possible for the device to be operated to perform at least one function according to the called at least one command. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not include a signal (eg, electromagnetic wave), and this term is used in cases where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

Methods according to various embodiments disclosed in this document may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or via an application store or between two user devices (eg smartphones). It can be distributed directly or online (eg, downloaded or uploaded). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

1 illustrates an architecture in a network environment according to various embodiments.

Referring to FIG. 1 , the number of the virtualization server 100 , the virtual router 110 , and the virtualization instance 120 is not limited to the number shown in FIG. 1 . For example, a plurality of virtualization servers may have network access controlled by the controller 200 , and the virtualization server 100 may include a plurality of virtual routers and a plurality of virtualization instances.

The virtualization instance 120 may include a connection control application 121 and a target application 122 . For example, the access control application 121 checks whether access is possible from the controller 200 when a network connection occurs, and only when access is possible through the virtual router 110 based on the data flow generated by the controller 200 The data packet may be transmitted to the destination network 300 . The data flow-based connectivity control technology provides a structure in which communication is possible only when there is a data flow authorized by the controller 200 in order for the virtualization instance 120 to access the destination network 300, and the data flow exists. If not, the virtualization instance 120 may provide a structure in which communication cannot be performed. For example, the access control application 121 may restrict transmission of the data packet of the target application 122 when the data flow does not exist.

In one embodiment, the virtualization server 100 may be included in the same network as the destination network (300). Therefore, it may be impossible to create a tunnel or secure session between the virtualization server 100 and the destination network 300 . In order to transmit a data packet from the virtualization instance 120 to the destination network 300 , it may be required through the virtual router 110 and a virtual NIC (not shown).

The controller 200 may be a server (or cloud server). The controller 200 may perform network access control for the destination network 300 of the virtualization instance 120 provisioned in the virtualization server 100 . According to an embodiment, the controller 200 may communicate with another interworking security system 400 .

According to one embodiment, the controller 200 transmits the virtualization instance 120 and the control data packet to perform various operations (eg, registration, approval, authentication, update, termination) related to the network connection of the virtualization instance 120 . can transmit and receive. A flow in which a control data packet is transmitted may be referred to as a control flow.

An environment in which the controller 200 can block the connection to the destination network 300 of the non-allowed virtualization instance through the above-described operations may be provided.

2 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure; 2 shows only the memory 220, the controller includes a communication circuit for performing communication with an external electronic device (eg, the communication circuit 430 of FIG. 3 ) and a processor (eg, FIG. 3 ) for controlling the overall operation of the controller. It may further include a processor 410 of 3).

Since the administrator can access the controller 200 and set an access-oriented policy for controlling access between the source and destination, more detailed network access control than the existing NAC (Network Access Control) and firewall is possible.

The access policy database 211 may include information about an identified network, a virtualization instance (eg, the virtualization instance 120 of FIG. 1 ), a user, an unidentified user, or a network and/or service to which an application can access. have. For example, when a connection to a destination network is requested from a virtualization instance, the controller determines a network (eg, a network to which the virtualization instance belongs), a virtualization instance, and a user (eg, a virtualization instance) identified based on the access policy database 211 . of users), and/or applications (applications included in the virtualization instance) may determine whether access to the destination network is possible.

The virtual routing policy database 212 includes a virtual NIC or a virtual router (eg, a virtual NIC or a virtual router (eg, FIG. 1 ) in which a virtualization instance exists at a target network boundary on an access path according to an access policy (eg, information included in the access policy database 211)). It may include information such as a routing band to be allowed by default in the virtual router 110 of the , and a routing band to be allowed according to an access policy. For example, when a network access request of a virtualization instance exists, the controller may provide an optimal network path for accessing a target network or a destination network based on the virtual routing policy database 212 .

The blacklist policy database 213 may include a policy for permanently or temporarily blocking access to a virtualization instance or a virtualization server. The blacklist policy database 213 includes information (eg, virtualization instance, IP address, MAC (media access control) address or at least one of a user ID).

The blacklist database 214 may include a list for at least one of a virtualization instance blocked by the blacklist policy database 213 , an IP address, a MAC address, or a user. For example, if the virtualization instance requesting access to the destination network is included in the blacklist database 314, the controller may isolate the virtualization instance from the destination network by rejecting the access request of the virtualization instance.

The virtualization server policy database 215 is a virtualization server API access for provisioning a virtualization instance, authentication information, a series of network policy information for identifying a virtualization instance, an identification information grant method, various risks and exceptions when controlling virtualization instance access Depending on the situation, a virtualization instance isolation policy may be included. For example, the controller provides a method for immediately removing a virtualization instance with a detected risk from the network based on the virtualization server policy database 215 .

The control flow table 216 is an example of a session table for managing the flow (eg, control flow) of control data packets generated between the virtualization instance and the controller. Upon successful access to the controller, control flow information may be generated by the controller. The control flow information may include at least one of identification information of the control flow, an IP address identified when accessing and authenticating a controller, a virtualization instance ID, and a user ID. For example, when access to a destination network is requested from a virtualization instance, the controller may retrieve control flow information through control flow identification information received from the virtualization instance, and an IP address and virtualization instance ID included in the retrieved control flow information. By mapping at least one of , or user ID to the access policy database 211, it is determined (determined) whether a virtualization instance can be accessed, whether to create a data flow, and whether to update a routing table (eg, virtual routing table 217). )can do.

According to an embodiment, the control flow may have an expiration time. The virtualization instance needs to update the expiration time of the control flow, and if the expiration time is not updated for a certain period of time, the control flow (or control flow information) and the routing table (eg, the virtual routing table 217 ) may be removed. In addition, when it is determined that immediate access blocking is required according to a security event collected from the virtualization instance, the controller may remove the control flow according to the connection termination request of the virtualization instance. When the control flow is removed, the previously created data flow and routing table are also removed, so access to the virtualization instance may be blocked.

The virtual routing table 217 is an example of a table for managing a communication path (routing) between a virtualization instance and a destination network. The virtual routing table 217 may include virtual NIC information of a virtualization instance, a band of a source network, a band of a destination network, router address information, and the like in order to set routing information of a virtual router existing in the virtualization server. For example, routing information may be set for each virtualization instance or for a virtualization server unit, and may provide a method for network access control in units of NICs, MAC addresses, and IP addresses. In an embodiment, the routing information included in the virtual routing table 217 may include information on whether a data packet of a virtual instance can transmit a data packet through a corresponding virtual router.

The data flow table 218 is a table for managing a flow (eg, data flow) through which detailed data packets are transmitted between a virtualization instance and a virtual router and a destination network. A data flow may be created in units of virtualization instances or IPs, TCP sessions created in units of virtualization instances, applications of virtualization instances, or more granular units. The data flow table 218 includes data flow identification information, control flow identification information when the data flow is dependent on a control flow, an application ID for identifying whether a data packet sent from a virtualization instance is an authorized data packet, a source network identification information, destination network identification information, and/or service ports. In addition, the data flow table 218 may include a routing ID on the virtual routing table 217 for providing an accessible route (routing) to the virtual router based on the data flow.

The virtualization instance table 219 includes the virtualization server identification information (eg ID) to which the virtualization instance is provisioned and a set of information for identifying the virtualization instance (eg MAC address, IP address, instance ID managed by the virtualization server, etc.) and It may include information about the status of the identified virtualization instance (eg, rebooting, shutting down, running, etc.).

In one embodiment, the virtual routing table 217 and the data flow table 218 may be stored in the same virtualization instance or virtualization server.

3 illustrates a functional block diagram of a virtualization server or virtualization instance according to various embodiments.

Referring to FIG. 3 , a virtualization server or virtualization instance may include a processor 410 , a memory 420 , and a communication circuit 430 . According to an embodiment, the node may further include a display 440 to interface with a user.

The processor 410 may control the overall operation of the virtualization server or virtualization instance. In various embodiments, the processor 410 may include one processor core or a plurality of processor cores. For example, the processor 410 may include a multi-core such as a dual-core, a quad-core, or a hexa-core. According to embodiments, the processor 410 may further include a cache memory located inside or outside. According to embodiments, the processor 410 may be configured with one or more processors. For example, the processor 410 may include at least one of an application processor, a communication processor, and a graphical processing unit (GPU).

All or part of processor 410 may be electrically or operatively connected to a virtualization server or other component within a virtualization instance (eg, memory 420 , communication circuitry 430 , or display 440 ). It may be coupled with or connected to (operatively). The processor 410 may receive commands from the virtualization server or other components of the virtualization instance, interpret the received commands, and perform calculations or process data according to the interpreted commands. The processor 410 may interpret and process a message, data, command, or signal received from the memory 420 , the communication circuit 430 , or the display 440 . The processor 410 may generate a new message, data, instruction, or signal based on the received message, data, instruction, or signal. The processor 410 may provide the processed or generated message, data, instruction, or signal to the memory 420 , the communication circuitry 430 , or the display 440 .

The processor 410 may process data or signals generated or generated in a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may write (or store) or update instructions, data, or signals to the memory 420 to execute or control a program.

The memory 420 may store instructions for controlling the virtualization server or virtualization instance, control instruction codes, control data, or user data. For example, the memory 420 may include at least one of an application program, an operating system (OS), middleware, and a device driver.

The memory 420 may include one or more of volatile memory and non-volatile memory. Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). may include The nonvolatile memory may include a read only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, and the like.

The memory 420 includes a nonvolatile medium such as a hard disk drive (HDD), a solid state disk (SSD), an embedded multi media card (eMMC), and a universal flash storage (UFS). may include more.

According to an embodiment, the memory 420 may store some of information included in the memory of the controller (eg, the memory 330 of FIG. 3 ). For example, the memory 420 may store the virtual routing table 217 and the data flow table 218 described in FIG. 2 .

The communication circuit 430 may support establishment of a wired or wireless communication connection between a virtualization server or a virtualization instance and an external electronic device (eg, the controller 200 of FIG. 2 ), and performing communication through the established connection. According to an embodiment, the communication circuit 430 is a wireless communication circuit (eg, a cellular communication circuit, a short-range wireless communication circuit, or a global navigation satellite system (GNSS) communication circuit) or a wired communication circuit (eg, a local area network (LAN) ) communication circuit, or power line communication circuit), and using the corresponding communication circuit among them, a short-distance communication network such as Bluetooth, WiFi direct or IrDA (infrared data association) or a cellular network, Internet, or long-distance communication such as a computer network It can communicate with an external electronic device through a network. The above-described various types of communication circuits 430 may be implemented as a single chip or as separate chips.

The display 440 may output content, data, or a signal. In various embodiments, the display 440 may display image data processed by the processor 410 . According to embodiments, the display 440 may be configured as an integrated touch screen by being coupled with a plurality of touch sensors (not shown) capable of receiving a touch input or the like. When the display 440 is configured as a touch screen, a plurality of touch sensors may be disposed above the display 440 or below the display 440 .

Meanwhile, a server (eg, a controller) according to an embodiment may include a processor 410 , a memory 420 , and a communication circuit 430 . The processor 410 , the memory 420 , and the communication circuit 430 included in the server may be substantially the same as the above-described processor 410 , the memory 420 , and the communication circuit 430 .

4 is a diagram illustrating an operation of controlling transmission of a data packet according to various embodiments of the present disclosure;

Referring to FIG. 4 , the virtualization instance 120 is transmitted to the destination network 300 after connection to the controller 200 or received from the destination network 300 in the case of an unacceptable data packet in which a data flow does not exist. It can be blocked at the kernel level of the network driver and operating system. Accordingly, the virtualization instance 120 does not send any data packets that do not pass through the access control application 121 to or from the destination network 300 .

In addition, even when a data packet is transmitted through a virtual NIC that is not allowed or a data packet of the target application 122 is transmitted by bypassing the access control application 121, the virtual routing table ( For example, since only a target (eg, MAC address, IP address) authorized by the virtual routing table 217 of FIG. 2) can access the authorized destination network 300, an insecure or unauthorized virtualization instance is a destination The virtual router 100 may block access to the network 300 .

In addition, if the access control application 121 of the virtualization instance 120 is not running or the connection is terminated, the virtual routing table on the virtual router 110 (eg, the virtual routing table 217 of FIG. 2 ) is retrieved. The corresponding virtualization instance 120 may provide a state in which access to the destination network 300 is impossible. Accordingly, a method capable of completely isolating a network connection to the destination network 300 according to the state of the virtualization instance 120 may be provided through the controller 200 and the virtual router 110 .

5 is a diagram illustrating system startup of a virtualization instance according to various embodiments. In one embodiment, the operations shown in FIG. 5 may be performed through the virtualization instance 120 of FIG. 1 .

In operation 505 , the virtualization instance 120 may be provisioned and started by the virtualization server 100 , or an operating system may be started according to an event such as when the system is restarted by a user.

In operation 510 , when the operating system is started, the access control application 121 may be executed.

In operation 515 , the access control application 121 may attempt to access the controller 200 based on information about the controller 200 set in advance during provisioning. When a normal controller access is attempted, the access control application 121 may perform the operations illustrated in FIG. 6 .

6 illustrates a signal flow diagram for a controller connection of a virtualization instance according to various embodiments.

Since the virtualization instance 120 needs to be authorized by the controller 200 in order to access or receive the network, the access control application 121 of the virtualization instance 120 requests the controller 200 to generate a control flow. A controller connection of the virtualization instance 120 may be attempted.

Referring to FIG. 6 , the access control application 121 of the virtualization instance 120 may request a controller access from the controller 200 in operation 605 . For example, the access control application 121 may perform a controller connection request to create a control flow with the controller 200 . For example, the controller access request may include information about the virtualization instance 120 .

In operation 610 , the controller 200 may determine whether the access control application 121 is in an accessible state according to the access policy based on the access request information. For example, the access control application 121 access request information includes information about the type, location information, environment, network including the virtualization instance 120 and the access control application 121 of the virtualization instance 120 . can do.

The controller 200 may check whether the identified virtualization instance 120 exists in the virtualization instance table (eg, the virtualization instance table 219 of FIG. 2 ) based on information on the identified virtualization instance 120 . According to an embodiment, when the identified virtualization instance 120 exists in the virtualization instance table, the controller 200 may perform operation 625 without performing operations 615 and 620 . According to another embodiment, when the identified virtualization instance 120 does not exist in the virtualization instance table, the controller 200 may perform operation 615 .

In one embodiment, the controller 200 transmits the access unavailable information to the access control application 121 when the identified virtualization instance 120 is included in the blacklist (eg, the blacklist database 214 of FIG. 2 ). may (operation 630).

In operation 615 , the controller 200 may request a list of virtualization instances from the virtualization server 100 . The virtualization server 100 may transmit a list of currently provisioned virtualization instances to the controller 200 .

In operation 620, the controller 200 may update the existing virtualization instance table based on the received virtualization instance list. Also, the controller 200 may check whether the identified virtualization instance 120 exists in the received virtualization instance list.

In operation 625 , the controller 200 determines whether to restrict the use of the identified virtualization instance 120 based on the access policy when the identified virtualization instance 120 does not exist in the received virtualization instance list. and may transmit a confirmation result and access unavailable information to the access control application 121 (operation 630).

When the identified virtualization instance 120 is included in the existing virtualization instance table or the received virtualization instance list, the controller 200 generates a control flow between the access control application 121 or the virtualization instance 120 and the controller 200 . can do. In this case, the controller 200 may generate control flow identification information in the form of a random number, and display identification information of the virtualization instance 120 and/or the network to which the virtualization instance 120 belongs to a control flow table (eg, in FIG. 2 ). control flow table 216). Information stored in the control flow table (eg, control flow identification information and/or control flow information) is a policy for user authentication of the virtualization instance 120 , information update of the virtualization instance 120 , and network access of the virtualization instance 120 . It may be used for validation and/or validation. In an embodiment, the controller 120 may generate accessable application whitelist information in an access policy matching the virtualization instance 120 .

When the control flow is generated, in operation 630 , the controller 200 may transmit a response to the controller access request to the access control application 121 of the virtualization instance 120 . In this case, the controller 200 may transmit the generated control flow identification information to the access control application 121 . In an embodiment, the controller 200 may transmit the accessible application whitelist information to the access control application 121 .

In operation 635 , the access control application 121 may check the application. For example, the access control application 121 may perform an application check based on a whitelist of accessible applications received from the controller 200 . The access control application 121 can check whether the application exists (installed) in the virtualization instance 120 based on the accessable application information, and in the case of the existing application, check whether the integrity and stability according to the validation policy (on the application, tampering check, code signing check, fingerprint check) can be performed.

In operation 640 , the access control application 121 may transmit an application test result to the controller 200 . For example, the access control application 121 may transmit information of an existing application and a result of the validation check to the controller 200 .

In operation 645 , the controller 200 determines whether an access policy that can be accessed in advance in the access policy exists based on the received application information, and if the policy exists, identification information and port of a destination network to which the application can be accessed A data flow corresponding to the information can be created. In addition, the controller 200 may transmit data packets through the virtual NIC and the virtual router based on the virtualization instance 120 and the generated data flow in the virtual routing policy (eg, the virtual routing policy 212 in FIG. 2 ). You can check whether there is When the data packet can be transmitted through the virtual NIC and the virtual router, the controller 200 updates the virtual routing table and data flow information, and transmits the updated virtual routing table and the updated data flow to the virtualization server 100 . may (operation 650). In this case, the virtualization server 100 may enable the received virtualization instance 120 to transmit a data packet through the virtual NIC.

According to an embodiment, when a policy through which the virtualization instance 120 can transmit a data packet does not exist in the virtual routing policy, the controller 200 may delete the generated data flow.

In operation 655 , the controller 200 may transmit the generated data flow to the access control application 121 . For example, the data flow may include information on whether data packet transmission is possible by the virtual router.

In operation 660, the access control application 121 may process a result value according to the received response. For example, the access control application 121 may store the received control flow identification information and display a user interface screen indicating that the controller connection is complete to the user. When the controller connection is completed, the network connection request to the destination network of the virtualization instance 120 may be controlled by the controller 200 .

According to another embodiment, the controller 200 may determine that the virtualization instance 120 is not accessible. For example, when identification information of the virtualization instance 120 and/or the network to which the virtualization instance 120 belongs is included in the blacklist database, the controller 200 may determine that the virtualization instance 120 is not accessible. In this case, the controller 200 may transmit a response indicating that controller access is impossible in operation 630 without generating a control flow in operation 625 . Also, in this case, operations 635 to 655 may not be performed. According to an embodiment, the access control application 121 may perform operation 605 again when a retry of the controller connection is required.

In addition, the access control application 121 updates the data flow of the virtualization instance 120 when there is a data flow received from the controller 200, and transmits the data packet based on the data flow allowed in advance when connecting to the network. data flow can be managed.

According to an embodiment, operations 635 to 655 may not be performed when the access control application 121 determines that the application inspection is not necessary.

7 illustrates a signal flow diagram for user authentication of a virtualization instance according to various embodiments.

In order for the virtualization instance 120 to be granted detailed access to the destination network, the access control application 121 of the virtualization instance 120 may receive authentication for the user of the virtualization instance 120 from the controller 200 . .

Referring to FIG. 7 , the virtualization instance 120 may receive an input for user authentication. The input for user authentication may be, for example, a user input inputting a user ID and password. As another example, the input for user authentication may be a user input (eg, biometric information) for more enhanced authentication. In this case, in operation 705 , the access control application 121 of the virtualization instance 120 may request user authentication from the controller 200 . If the control flow between the virtualization instance 120 and the controller 200 has already been created, the access control application 121 may transmit input information for user authentication together with the control flow identification information.

In operation 710 , the controller 200 may authenticate the user based on information received from the virtualization instance 120 . For example, the controller 200 includes a user ID, password, and/or enhanced authentication information included in the received information, and a database (eg, the access policy database of FIG. 2 ) included in the memory of the controller 200 . Based on the 211 or the blacklist database 214), it is possible to determine whether the user is accessible according to the access policy and whether the user is included in the blacklist.

If the user is authenticated, in operation 715 , the controller 200 may add user identification information (eg, user ID) to identification information of the control flow. The added user identification information may be used for an authenticated user's controller access or network access. Also, the controller 200 may generate accessable application information based on the access policy. For example, the accessible application information may be an application whitelist generated based on an access policy.

In operation 720 , the controller 200 may transmit information indicating that the user is authenticated to the source node 201 as a response to the user authentication request. Also, the controller 200 may transmit accessible application information to the access control application 211 .

In operation 725 , the access control application 121 may check the application. For example, the access control application 121 may perform an application check based on a whitelist of accessible applications received from the controller 200 . The access control application 121 can check whether the application exists (installed) in the virtualization instance 120 based on the accessable application information, and in the case of the existing application, check whether the integrity and stability according to the validation policy (on the application, tampering check, code signing check, fingerprint check) can be performed.

In operation 730 , the access control application 121 may transmit an application test result to the controller 200 . For example, the access control application 121 may transmit information of an existing application and a result of the validation check to the controller 200 .

In operation 735, the controller 200 checks whether an access policy that can be accessed in advance in the access policy exists based on the received application information, and if the policy exists, identification information and port of a destination network to which the application can be accessed It is possible to create a data flow corresponding to the information. In addition, the controller 200 may transmit data packets through the virtual NIC and the virtual router based on the virtualization instance 120 and the generated data flow in the virtual routing policy (eg, the virtual routing policy 212 in FIG. 2 ). You can check whether there is When the data packet can be transmitted through the virtual NIC and the virtual router, the controller 200 updates the virtual routing table and data flow information, and transmits the updated virtual routing table and the updated data flow to the virtualization server 100 . It can be done (operation 740). In this case, the virtualization server 100 may enable the received virtualization instance 120 to transmit a data packet through the virtual NIC.

According to an embodiment, when a policy through which the virtualization instance 120 can transmit a data packet does not exist in the virtual routing policy, the controller 200 may delete the generated data flow.

In operation 745 , the controller 200 may transmit the generated data flow to the access control application 121 . For example, the data flow may include information on whether data packet transmission is possible by the virtual router.

In operation 750, the access control application 121 may process a result value according to the received response. For example, the access control application 121 may store the received control flow identification information and display a user interface screen indicating that user authentication is completed to the user. When user authentication is completed, the network access request to the destination network of the virtualization instance 120 may be controlled by the controller 200 .

According to another embodiment, the controller 200 may determine that user authentication of the virtualization instance 120 is impossible. For example, if the virtualization instance 120 and/or identification information of the network to which the virtualization instance 120 belongs is included in the blacklist database, the controller 200 determines that the virtualization instance 120 is not accessible and user authentication is impossible. can decide In this case, the controller 200 may transmit a response indicating that access to the controller is impossible in operation 720 without reflecting the user identification information in operation 715 . Also, in this case, operations 725 to 745 may not be performed.

In addition, when the data flow received from the controller 200 exists, the access control application 121 updates the data flow of the virtualization instance 120 and transmits a data packet based on the data flow allowed in advance when connecting to the network. data flow can be managed.

8 illustrates a signal flow diagram for controlling a network connection of a virtualization instance according to various embodiments.

After the virtualization instance 120 is authorized from the controller 200 , the virtualization instance 120 controls network access of other applications stored in the virtualization instance 120 through the access control application 121 of the virtualization instance 120 . This ensures reliable data transmission.

In operation 805 , the access control application 121 may detect a network access event of another application stored in the virtualization instance 120 .

In operation 810, the access control application 121 may check the existence of a data flow corresponding to the identification information of the application requesting network access, the destination network identification information, and the port information. Depending on the embodiment, if a data flow exists but is not valid, the access control application 121 may drop the data packet. According to another embodiment, when a data flow exists, the access control application 121 may transmit a data packet based on the data flow.

When the data flow needs to be updated, such as when the data flow does not exist or the authentication time has expired and needs to be renewed. In operation 815 , the access control application 121 may request a network connection from the controller 200 . For example, the network access request may include control flow identification information, identification information of a destination network, and port information.

In operation 820, the controller 200 performs access request identification information (eg, identification of a destination network) in an access policy corresponding to information identified based on control flow identification information (eg, virtualization instance, user, and source network identification information). information and port information) and whether the destination network is accessible. According to an embodiment, when the network connection is impossible, the controller 200 may transmit a connection failure result to the access control application 121 of the virtualization instance 120 (operation 830).

In operation 835, the controller 200, when the network access request received from the access control application 121 is a connection request from a dangerous application in the access policy, or if it is necessary to immediately block the access of the virtualization instance 120 due to an abnormal access attempt, In addition to the basic routing table allowable by the virtual routing policy, it is possible to request the virtualization server 100 to remove the routing table allocated to the virtualization instance (operation 825). In another embodiment, when it is determined that network access is possible, the controller 200 may not perform operation 825 .

When access is possible, the controller 200 may check whether a data flow corresponding to the identification information and port information of the destination network exists. When the data flow does not exist, the controller 200 may generate a data flow corresponding to identification information and port information of a destination network to which an application requesting access can be accessed. In addition, the controller 200 may transmit data packets through the virtual NIC and the virtual router based on the virtualization instance 120 and the generated data flow in the virtual routing policy (eg, the virtual routing policy 212 in FIG. 2 ). You can check whether there is When the data packet can be transmitted through the virtual NIC and the virtual router, the controller 200 updates the virtual routing table and data flow information, and transmits the updated virtual routing table and the updated data flow to the virtualization server 100 . may (operation 825). In this case, the virtualization server 100 may enable the received virtualization instance 120 to transmit a data packet through the virtual NIC. In another embodiment, when there is a data flow corresponding to the identification information and port information of the destination network, the controller 200 may transmit the data flow to the access control application 121 (operation 830).

The access control application 121 of the virtualization instance 120 may process a result value for a response received from the controller 200 . For example, the access control application 121 may drop a data packet to be transmitted by the application when receiving a result of network connection unavailable from the controller 200 . As another example, when a data flow is received from the controller 200 , the access control application 121 may transmit a data packet based on the received data flow.

In an embodiment, after performing operation 810, the access control application 121 may perform a validity check on the access application according to the validity check policy. For example, the access control application 121 may further perform an integrity and stability check (application forgery, tampering check, code signing check, fingerprint check, etc.) of the access application. The access control application 121 may perform operation 815 when the validation result is successful.

9 illustrates a signal flow diagram for requesting a network whitelist of a virtualization instance according to various embodiments.

The virtualization instance 120 may inspect the application execution or execution termination of the operating system, the network reception standby, or the network reception standby list periodically. The virtualization instance 120 may continuously check the list of applications capable of transmitting or receiving data packets by periodically checking the application whitelist.

Referring to FIG. 9 , in operation 905 , the access control application 121 of the virtualization instance 120 may detect a network reception list check event.

In operation 910 , the access control application 121 may perform a network whitelist check. For example, the access control application 121 may check the network listening port and application information. In this case, the access control application 121 may check whether a network whitelist exists based on the port and application information that is waiting for reception.

In operation 915 , the access control application 121 may request a network whitelist from the controller 200 . For example, the access control application 121 may transmit control flow identification information, identification information of a receiving application, and a list of port information to the controller 200 and request a network whitelist.

In operation 920, the controller 200 receives identification information (eg, reception application, port information) requested to be received in the access policy matched with information (eg, virtualization instance, user, source network, etc.) identified based on the control flow identification information. ) list, you can check whether each application can allow network reception.

If the network reception request received from the access control application 121 is a reception request from a dangerous application in the access policy, or it is necessary to immediately block the access of the virtualization instance 120 due to an abnormal reception attempt, the virtual routing policy In addition to the basic routing table allowable by the user, it is possible to request the virtualization server 100 to remove the routing table allocated to the virtualization instance 120 (operation 925). In another embodiment, when it is determined that network reception is possible, the controller 200 may not perform operation 925 .

When it is determined that network reception is possible, the controller 200 may add information indicating that the reception application allows reception of the data packet through the port to the network whitelist. The controller 200 may transmit the generated network whitelist to the access control application 121 (operation 930).

In operation 935 , the access control application 121 of the virtualization instance 120 may process a result value for a response received from the controller 200 . For example, the access control application 121 may update the network whitelist in normal cases based on the received network whitelist, and an application that is not allowed on the updated network whitelist attempts to receive through a disallowed port or If receiving, the corresponding application can be terminated.

In an embodiment, after performing operation 910, the access control application 121 may perform a validation check on the receiving application according to the validation policy. For example, the access control application 121 may further perform integrity and stability checking of the receiving application (application forgery, tampering check, code signing check, fingerprint check, etc.). If the result of the validation check is successful, the access control application 121 may perform operation 915 .

10 illustrates a signal flow diagram for updating a control flow of a virtualization instance according to various embodiments.

The access control application 121 maintains information about the control flow and data flow of the virtualization instance 120 , and receives an updated data flow from the controller 200 or periodically controls to check whether the control flow is valid. You can request to update the flow.

Referring to FIG. 10 , in operation 1005 , the access control application 121 may detect a control flow update event.

In operation 1010 , the access control application 121 may request the controller 200 to update the control flow based on the control flow identification information.

In operation 1015 , the controller 200 may check whether a control flow exists in the control flow table (eg, the control flow table 216 of FIG. 2 ) based on the received control flow identification information. According to the embodiment, when the control flow does not exist (eg, when the connection is disconnected by another security system, when the connection is disconnected by self-risk detection, etc.), the controller 200 determines that the connection of the virtualization instance 120 is valid. Therefore, the connection unavailable result may be transmitted to the access control application 121 (operation 1025). In another embodiment, when the controller 200 needs to block access to the virtualization instance 120, virtualization other than the basic routing table to be allowed by the virtual routing policy (eg, the virtual routing policy 212 of FIG. 2) A request may be made to the virtualization server 100 to remove the routing table allocated to the instance (operation 1020 ).

The controller 200 may update the update time when a control flow exists in the control flow table (eg, the control flow table 216 of FIG. 2 ). In this case, the controller 200 may transmit the updated identification information of the control flow to the access control application 121 (operation 1025).

In one embodiment, the controller 200 transmits information about the data flow to the access control application ( 121) (operation 1025).

In operation 1030 , the access control application 121 of the virtualization instance 120 may process a result value for a response received from the controller 200 . For example, when the control flow update result is impossible, the access control application 121 may block all network connections of the application. As another example, when the control flow update result is normal and the updated data flow information exists, the access control application 121 may update the data flow.

11 illustrates a signal flow diagram for terminating a controller connection of a virtualization instance according to various embodiments.

Referring to FIG. 11 , in operation 1105 , the virtualization instance 120 may detect that the virtualization instance 120 is terminated or the access control application 121 is terminated. In this case, in operation 1110 , the virtualization instance 120 or the access control application 121 may request the controller 200 to remove the control flow.

In operation 1115 , the controller 200 may remove the identified control flow based on the received control flow identification information. In addition, the controller 200 may request the virtualization server 100 to remove the routing table allocated to the virtualization instance 120 in addition to the basic routing table to be allowed by the virtual routing policy (operation 1120 ).

In operation 1125 , the controller 200 may remove all data flows dependent on the removed control flow. Accordingly, the virtualization instance 120 can no longer connect to the destination network based on the removed data flow.

12 illustrates a signal flow diagram for updating a virtualization instance table according to various embodiments.

The controller 200 may manage the list of provisioned virtualization instances by periodically updating the virtualization instance table (eg, the virtualization instance table 219 of FIG. 2 ).

Referring to FIG. 12 , in operation 1205 , the controller 200 may detect a virtualization instance table update event. In this case, the controller 200 may determine a virtualization server to update the virtualization instance list in the virtualization server table.

In operation 1210 , the controller 200 may request a list of virtualization instances from the determined virtualization server 100 . For example, the virtualization server 100 may transmit a list of currently provisioned virtualization instances to the controller 200 .

In operation 1215 , the controller 200 may process a result value for the received virtualization instance list. For example, the controller 200 may update the virtualization instance table based on the virtualization instance list received from the virtualization server 100 . According to an embodiment, if the virtualization instance is removed when updating the virtualization instance table, the controller 200 may remove a control flow generated in response to the removed virtualization instance, and basic routing to be allowed by the virtual routing policy In addition to the table, a request may be made to remove the routing table allocated to the removed virtualization instance from the virtualization server 100 (operation 1220 ).

According to another embodiment, when a virtualization instance exists in the virtualization instance table but a control flow generated in response to the virtualization instance does not exist, by checking the virtualization server policy (eg, the virtualization server policy 215 in FIG. 2 ) When the virtualization instance exceeds the control flow creation time and when it is necessary to restrict the use of the virtualization instance, the controller 200 removes the routing table assigned to the removed virtualization instance in addition to the basic routing table to be allowed by the virtual routing policy may be requested from the virtualization server 100 (operation 1220).

13 illustrates a signal flow diagram for termination of application execution of a virtualization instance according to various embodiments.

Referring to FIG. 13 , in operation 1305 , the access control application 121 of the virtualization instance 120 may check whether the running application is terminated in real time, and may detect an application execution termination event.

In operation 1310 , the access control application 121 may check whether a data flow corresponding to the terminated application identification information and PID (Process ID and Child Process ID Tree) information exists. If the data flow exists, the access control application can delete the data flow. According to an embodiment, the access control application 121 may check whether the terminated application exists in the running process list in order to track the termination of the multi-executable application, and if it does not exist, identification information of the terminated application You can delete all data flows corresponding to .

In operation 1315 , the access control application 121 may request the controller 200 to delete the deleted data flow.

In operation 1320 , the controller 200 may delete a data flow requested to be deleted. In addition, if there is an access path (routing) that no longer needs to be routed in the routing table according to the deleted data flow, the controller 200 may delete the corresponding routing information, and transfer the deleted routing table to the virtualization server 100 can be transmitted to (operation 1325). Accordingly, data packets corresponding to the source network, destination network, and port information included in the deleted data flow cannot be transmitted any more.

14 is a flowchart illustrating an operation for a network connection request of a virtualization instance according to various embodiments. The operations shown in FIG. 14 may be performed by the access control application 121 of the virtualization instance 120 of FIG. 1 .

Referring to FIG. 14 , in operation 1405 , the access control application 121 may request a network connection from an external server. For example, the external server may be the controller 200, and the network access request may include control flow identification information, destination network identification information, and port information.

In operation 1410 , the access control application 121 may receive a data flow from an external server. For example, the external server may be the controller 200, and the received data flow may correspond to identification information of the virtualization instance 120, identification information of a destination network, and port information. In addition, the received data flow may include information regarding whether a data packet can be transmitted through the virtual router. According to an embodiment, the information regarding whether a data packet can be transmitted through the virtual router may include a routing table.

In operation 1415 , the access control application 121 may transmit a data packet based on the received data flow. For example, the access control application 121 may transmit a data packet through a virtual router included in the received data flow. According to an embodiment, the received data flow may further include information about the virtual NIC, and the access control application 121 may transmit the data packet through the virtual NIC and the virtual router.

15 is a flowchart illustrating an operation for controlling a data packet in a virtual router according to various embodiments of the present disclosure; In one embodiment, the operations shown in FIG. 15 may be performed through the virtual router 110 of FIG. 1 .

Referring to FIG. 15 , in operation 1505 , the virtual router 110 may detect a data packet reception event. For example, the virtual router 110 may receive multicast data packets residing in the same segment as the virtualization instance.

In operation 1510 , the virtual router 110 checks whether a routing path capable of transmitting the data packet exists. For example, the virtual router 110 checks whether a source network band and a destination network band exist in the routing table based on the source network identification information and the destination network identification information included in the 5 tuple information of the IP of the data packet. . According to an embodiment, when a transmittable path (routing) exists in the routing table, the virtual router 110 may route the data packet (operation 1515 ). In another embodiment, when there is no transmittable route (routing) in the routing table, the virtual router 110 may drop the data packet (operation 1520).

16 is a flowchart illustrating a method of operating a server according to various embodiments of the present disclosure; In an embodiment, the operations shown in FIG. 16 may be performed through the controller 200 of FIG. 1 .

Referring to FIG. 16 , in operation 1605 , the controller 200 may receive a network access request from an access control application of a virtualization instance. For example, the network access request may include identification information of a target application of the virtualization instance and identification information of a destination network. As another example, the network access request may further include control flow identification information of the virtualization instance.

In operation 1610 , the controller 200 may determine whether a target application of the virtualization instance is accessible. For example, the controller 200 may check whether the target application is accessible based on a database (eg, a database included in the memory of FIG. 2 ).

In operation 1615 , the controller 200 may generate a data flow when the target application can be accessed.

In operation 1620 , the controller 200 may check whether the data packet of the target application can be transmitted to the destination network through the virtual router. For example, the controller 200 transmits the data packet of the target application to the destination network through the virtual router based on the routing table and the routing policy (eg, the virtual routing policy 212 and the virtual routing table 217 of FIG. 2 ). You can check whether it can be transmitted or not.

In operation 1625 , the controller 200 may update the data flow if the data packet can be transmitted through the virtual router. For example, the controller 200 may update the data flow generated in operation 1615 or may update an existing data flow.

In operation 1630 , the controller 200 may transmit the updated data flow to the virtualization server and the virtualization instance.

The above description is merely illustrative of the technical idea disclosed in this document, and those of ordinary skill in the art to which the embodiments disclosed in this document belong are not departing from the essential characteristics of the embodiments disclosed in this document. Various modifications and variations will be possible.

Therefore, the embodiments disclosed in this document are for explanation rather than limiting the technical ideas disclosed in this document, and the scope of the technical ideas disclosed in this document is not limited by these embodiments. The protection scope of the technical idea disclosed in this document should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present document.

Claims (16)

in the server,
communication circuit;
a memory for storing the database; and
a processor operatively coupled with the communication circuitry and the memory, the processor comprising:
Receive a network access request from a connection control application of a virtualization instance, wherein the network access request includes identification information of a target application of the virtualization instance, and destination network identification information,
Check whether the target application is accessible based on the identification information of the target application and the destination network identification information, and if the connection is possible, generate a data flow;
check whether the data packet of the target application can be transmitted to the destination network through the virtual router, and update the data flow if the data packet can be transmitted through the virtual router;
sending the updated data flow to a virtualization server and the virtualization instance;
A server, configured to receive a list of virtualization instances provisioned to the virtualization server from the virtualization server, and to control a network connection of a virtualization instance included in the list of virtualization instances. The method of claim 1,
The virtualization server comprises the virtualization instance and the virtual router. The method of claim 1, wherein the processor comprises:
receive a controller access request from the access control application of the virtualization instance, the controller access request including identification information of the virtualization instance;
Checking based on the database whether the virtualization instance is in an accessible state,
Checking whether the virtualization instance exists in the database based on the identification information of the virtualization instance,
When the virtualization instance exists in the database, a control flow is created, and a list of accessible applications is created based on the database,
configured to send identification information of the created control flow and the list of accessible applications to the virtualization instance. The method of claim 3, wherein the processor comprises:
If the virtualization instance does not exist in the database, request a list of virtualization instances from the virtualization server,
Receive a list of virtualization instances currently provisioned to the virtualization server from the virtualization server,
A server that checks whether the virtualization instance exists based on the provisioned virtualization instance list. The method of claim 1, wherein the processor comprises:
receive a network whitelist request from the access control application of the virtualization instance, wherein the network whitelist request includes control flow identification information, receivable application information, and receivable port information;
When it is necessary to block the access of the receivable application, transmitting information preventing the virtualization instance from transmitting a data packet through the virtual router to the virtualization server,
If the receivable application is receivable, add it to a network whitelist, and send the network whitelist to the access control application. The method of claim 1, wherein the processor comprises:
When it is necessary to block access to the virtualization instance, request the virtualization server to remove the routing table allocated to the virtualization instance,
The routing table includes information on whether the virtualization instance can connect to the destination network through the virtual router. The method of claim 6, wherein the processor comprises:
When requesting removal of the routing table, the server requests removal of routing tables other than the basic routing allowed by the database. The method of claim 1, wherein the processor comprises:
When the virtualization instance exists in the destination network, adding a routing table capable of transmitting a data packet through the virtual router to the database;
Sending the routing table to the virtualization server, the server. In the virtualization server,
communication circuit;
a processor operatively coupled to the communication circuitry; and
a memory operatively coupled to the processor and storing instructions executed by the processor to a virtualization instance and a virtual router;
The instructions, when executed by the processor, cause the virtualization instance to:
requesting a network connection from an external server through an access control application, wherein the network access request includes identification information of a destination network;
receive a data flow from the external server through the access control application, wherein the data flow corresponds to identification information of the virtualization instance and identification information of the destination network, wherein the data flow is transmitted through the virtual router including information as to whether or not it can be;
and send, through the access control application, a data packet of a target application based on the received data flow;
The instructions, when executed by the processor, cause the virtualization server to
A virtualization server configured to forward a list of provisioned virtualization instances to the external server. 10. The method of claim 9, wherein when the instructions are executed by the processor, the virtualization server:
When the external server determines to block the access to the virtualization instance, receiving a request to remove the routing table of the virtual router for the virtualization instance from the external server,
A virtualization server configured to remove the remaining routing tables except for a basic routing table among the routing tables for the virtualization instance. delete 10. The method of claim 9, wherein the instructions, when executed by the processor, cause the virtualization instance to:
Detecting a network access event of the target application to the destination network through the access control application,
through the access control application, verify that the data flow exists;
and if the data flow does not exist, request the network connection to the external server including control flow identification information through the access control application. 10. The method of claim 9, wherein the instructions, when executed by the processor, cause the virtualization instance to:
Checking the receiving application information and the receiving port information among the applications included in the virtualization instance through the access control application,
request a network whitelist from the external server through the access control application, wherein the network whitelist request includes control flow identification information, the receiving application information, and the receiving port information;
and receive a network whitelist from the external server through the access control application, wherein the network whitelist includes information about whether reception of a data packet is possible through the virtual router. 10. The method of claim 9, wherein the instructions cause the virtual router to:
receive a data packet from the virtualization instance;
Check whether routing can be performed based on the source IP and destination network identification information included in the data packet;
routing the data packet if it can be routed;
A virtualization server configured to drop the data packet if it cannot be routed. delete How the server works.
receiving a network connection request from a connection control application of a virtualization instance, wherein the network connection request includes identification information of a target application of the virtualization instance and destination network identification information;
checking whether the target application is accessible based on the target application identification information and the destination network identification information;
creating a data flow if accessible;
checking whether the data packet of the target application can be transmitted to the destination network through a virtual router;
updating the data flow if the data packet can be transmitted through the virtual router;
transmitting the updated data flow to a virtualization server and the virtualization instance;
receiving a list of virtualization instances provisioned to the virtualization server from the virtualization server; and
controlling a network connection of a virtualization instance included in the received virtualization instance list; A method comprising

Images