KR102427663B1 - System for controlling network access based on controller and method of the same - Google Patents

Abstract

According to an embodiment of the present disclosure, a node comprises: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor, and storing an access control application and a target application. The memory can store instructions to allow the node, on execution by the processor, to detect a data packet transmission event of the target application through the access control application, to check the presence of a data flow corresponding to identification information on the target application and information included in the data packet and authorized by an external server, to check a type of the data packet, to transmit the data packet to a gateway or a service server when the data packet is a secure session generating request data packet so as to generate a secure session between the node and the gateway or the service server, and to transmit identification information on the secure session to the external server when the secure session is generated. Therefore, transmission of a data packet of an unauthorized object can be blocked.

Description

SYSTEM FOR CONTROLLING NETWORK ACCESS BASED ON CONTROLLER AND METHOD OF THE SAME

Embodiments disclosed herein relate to a system for controlling a controller-based network connection and a method therefor.

Multiple devices may communicate data over a network. For example, the terminal may transmit or receive data with the server through the Internet. The network may include a public network such as the Internet as well as a private network such as an intranet.

The terminal communicates with the server using IP (Internet Protocol)-based TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), and controls the connection between the source IP and destination IP authorized in TCP or UDP technology. Firewall technology may be used. In the case of IP communication, since data packets are transmitted in plain text, there is a problem that a third party can easily read important information of data packets using sniffing technology such as tapping equipment or rouge WiFi. In order to solve this problem, a VPN (Virtual Private Network) technology and tunneling technology for encrypting data packets between the terminal and the server are used.

Tunneling technology may be limited in scope to controlling only network access dependent on a specific network or service, since tunneling use and related standards are all different depending on the service server. In addition, since the tunneling technology needs to set up a wide network band, it may be difficult to control each application running in the terminal and communication in the service server unit to which the application wants to access.

In order to compensate for the shortcomings of such tunneling technology, a secure session technology that can guarantee secure communication more easily and conveniently than tunneling may be considered. For example, for protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), Datagram Transport Layer Security (DTLS), Mutual Transport layer Security (MTLS), or Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS). A secure session technique may be applied.

In the secure session technology, the terminal and the service server must perform a session creation and negotiation procedure in advance. Due to the nature of IP communication based on the Open Systems Interconnection (OSI) 7 layer, Since there is no way to check whether an application) is a pre-authorized safe target, it is difficult to block unauthorized targets at the network level (ie, OSI layer 7). Although the service server may block the connection of a target that does not satisfy the authentication conditions, this method is not allowed because it is possible after a TCP session or a secure session has already been created or a service protocol access procedure (eg HTTP) has been performed. It is impossible to fundamentally block or cancel network access of an unauthorized target, and an attacker can perform a Denial of Service (DoS) attack through a well-known protocol such as HTTPS and an open port. Furthermore, when the security function included in the application of the terminal is not executed or a risk factor exists in the application, even if the terminal or the network detects it, there is no method for blocking the detected threat in the network connection state.

In addition, when a secure session between the terminal and the service server is created, filtering-based security technologies (eg, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Next Generation (NGFW), Firewall)) may not be available.

In the case of a mobile terminal, since the source IP continuously changes due to handover, there may be a problem in that the gateway blocks data packet transmission based on the source IP. That is, in the case of a terminal with frequent handovers, there may be a problem of having to authenticate network access every time an IP is changed.

In addition, when the first secure session is created, only an application authorized through the authentication process enables a secure session, but since it is not known which application the secure session is actually matched with and authorized, when the application is terminated, the secure session is immediately terminated. There is no way to do it.

Various embodiments disclosed in this document are intended to provide a system for solving the above-described problems in a network environment and a method therefor.

A node according to an embodiment disclosed herein comprises a communication circuit, a processor operatively coupled to the communication circuit, and a memory operatively coupled to the processor and storing a connection control application and a target application, wherein the When the memory is executed by the processor, the node detects, through the access control application, a data packet transmission event of the target application, and corresponds to the identification information of the target application and information included in the data packet, and an external server check whether there is a data flow authorized from Alternatively, generating a secure session between the service servers, and transmitting identification information of the secure session to the external server when the secure session is created, may store commands.

A server according to an embodiment disclosed in this document includes a communication circuit, a memory for storing a database, and a processor operatively connected to the communication circuit and the memory, wherein the processor is configured to: Receiving a connection request, the network connection request includes identification information of the target application of the node and identification information of the destination network, and determines whether the target application is accessible based on the database, and the target application is If it is accessible, it is checked whether a secure session can be created between the node and the gateway or service server based on the database, and a data flow is generated so that the node can create a secure session with the gateway or the service server, and send the data flow to the access control application.

A method of operating an access control application installed in a node according to an embodiment disclosed in this document includes: detecting a data packet transmission event of a target application; Checking whether there is a data flow authorized from the server, checking the type of the data packet, if the data packet is a secure session creation request data packet, sending the data packet to a gateway or a service server, and generating a secure session between the gateway or the service server, and transmitting identification information of the secure session to the external server when the secure session is created.

The method of operating a server according to an embodiment disclosed in this document includes: receiving a network access request from an access control application of a node, wherein the network access request includes identification information of a target application of the node and identification information of a destination network and determining whether the target application is accessible based on a database; if the target application is accessible, determining whether a secure session can be created between the node and the gateway or service server based on the database , generating a data flow so that the node can create a secure session with the gateway or the service server, and sending the data flow to the access control application.

According to the embodiments disclosed in this document, a system for controlling network access provides a method for allowing only an authorized target to access a network based on a secure session, and can block data packet transmission of an unauthorized target.

According to the embodiments disclosed in this document, a system for controlling network access provides a method for detecting and disconnecting threats to an invalid target, and clarifying an ambiguous network connection disconnection point between an application and a service server. It can facilitate life cycle management.

According to the embodiments disclosed in this document, a system for controlling network access blocks a data packet transmitted by an unauthorized target through a gateway to prevent DoS attacks and brute force attacks through service resource access. can

According to the embodiments disclosed in this document, a system for controlling network access overcomes the problems inherent in existing IP communication by implementing a secure network connection lifecycle ranging from application network access control, threat blocking, and isolation. and can provide a secure network connection.

According to the embodiments disclosed in this document, a system for controlling network access can control data transmission in the transport layer more easily and in detail compared to tunneling technology that protects data packets in a wide network range.

According to the embodiments disclosed in this document, the gateway may block a potentially dangerous element by forwarding a data packet between an application and a service server based on a secure session and blocking other data packets.

According to the embodiments disclosed in this document, a secure session with the gateway or server can be created without individual modification for each application to access the service server.

According to the embodiments disclosed in this document, it is possible to identify which application has created a secure session with the service server, and when the corresponding application is terminated, the corresponding secure session can be immediately terminated.

According to the embodiments disclosed in this document, when a secure session is created in the network access authorization state of the node, there is no way to check whether the secure session is actually connected between the destination networks to which it is connected, so a Man In The Middle (MITM) attack When a network connection occurs through an abnormal proxy server in a state where the destination IP information is forged or altered by

According to the embodiments disclosed in this document, when an allowed application transmits a data packet by receiving a connection through a network connection request, if it does not perform a procedure to check whether a secure session data packet is transmitted, the network connection is Although allowed, it is possible to solve the problem that a DDoS attack can be performed by sending a normal data packet rather than a data packet based on a secure session.

According to the embodiments disclosed in this document, when an application connects to a network, it is checked whether the corresponding network connection is transmitted only by a secure session according to a security session policy mapped in advance, and when a data packet is transmitted, a data packet by the secure session At the same time, it is possible to identify whether or not the corresponding secure session was created by the target application by providing the technology to ensure that only the secure session is transmitted, and at the same time, by examining the data packet during the secure session creation process and transmitting secure session identification information to the controller.

In addition, according to the embodiments disclosed in this document, when an application transmits a data packet in a state in which a secure session is not created, or when the transmitted secure session identification information is different from the secure session identification information collected in the destination network, a rogue secure session The network connection can be terminated immediately by determining whether the proxy server has passed through, and when the application is terminated, the secure session is immediately removed to prevent communication with the destination network using previously authenticated secure session information.

In addition, various effects directly or indirectly identified through this document may be provided.

1 shows an environment including a plurality of networks.
2 illustrates an architecture within a network environment in accordance with various embodiments.
3 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure;
4 illustrates a functional block diagram of a node in accordance with various embodiments.
5 illustrates an operation of controlling transmission of a data packet according to various embodiments.
6 illustrates a signal flow diagram for controller connection according to various embodiments.
7 illustrates a signal flow diagram for user authentication according to various embodiments.
8 illustrates a signal flow diagram for a network connection according to various embodiments.
9 illustrates a signal flow diagram for controlling data packet transmission in accordance with various embodiments.
10 illustrates a signal flow diagram for processing a secure session upon receiving a data packet according to various embodiments of the present disclosure;
11 illustrates a signal flow diagram for control flow update according to various embodiments.
12 illustrates a signal flow diagram for disconnection according to various embodiments.
13 illustrates a signal flow diagram for terminating application execution according to various embodiments.
14 is a flowchart illustrating a method of operating a connection control application installed in a node according to various embodiments of the present disclosure;
15 is a flowchart illustrating a method of operating a server according to various embodiments of the present disclosure;

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

In this document, the singular form of a noun corresponding to an item may include one or more items, unless the context clearly dictates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A; Each of the phrases "at least one of B, or C" may include any one of, or all possible combinations of, items listed together in the corresponding one of the phrases. Terms such as "first", "second", or "first" or "second" may simply be used to distinguish an element from other elements in question, and may refer elements to other aspects (e.g., importance or order) is not limited. It is said that one (eg, first) component is “coupled” or “connected” to another (eg, second) component, with or without the terms “functionally” or “communicatively”. When referenced, it means that one component can be connected to the other component directly (eg by wire), wirelessly, or through a third component.

Each component (eg, a module or a program) of components described in this document may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. . According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repeatedly, or heuristically, or one or more of the operations are executed in a different order, or omitted. , or one or more other operations may be added.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit or a part of the part that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or an application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one of the one or more instructions stored from the storage medium and execute it. This makes it possible for the device to be operated to perform at least one function in accordance with the called at least one command. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not contain a signal (eg, electromagnetic wave), and this term is used in cases where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

Methods according to various embodiments disclosed in this document may be included and provided in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or via an application store or between two user devices (eg smartphones). It can be distributed directly or online (eg, downloaded or uploaded). In the case of online distribution, at least a part of the computer program product may be temporarily stored or temporarily created in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

1 shows an environment including a plurality of networks.

Referring to FIG. 1 , the first network 10 and the second network 20 may be different networks. For example, the first network 10 may be a public network such as the Internet, and the second network 20 may be a private network such as an intranet or VPN.

The first network 10 may include a source node 101 . 1 and the embodiments described below, the 'source node' may be various types of devices capable of performing data communication. For example, the source node 101 is a portable device such as a smartphone or tablet, a computer device such as a desktop or laptop, a multimedia device, a medical device, a camera, a wearable device, a virtual reality (VR) device. , or a home appliance, and is not limited to the above-described devices. For example, the originating node 101 may include a server or gateway capable of sending data packets through an application. The source node 101 may also be referred to as an 'electronic device' or a 'terminal'. On the other hand, the destination node 102 may include a device similar to that of the source node 101 described above. For another example, the destination node 102 may be substantially identical to the destination network.

The source node 101 may attempt to access the second network 20 and transmit data to the destination node 102 included in the second network 20 . The source node 101 may send data to the destination node 102 via the gateway 103 and the secure session 105 .

When the access of the source node 101 to the first network 10 is approved, the source node 101 can communicate with all servers included in the first network 10, so that the source node 101 is malicious. ) can be exposed from program attack. For example, the source node 101 is a trusted and/or secure application, such as an Internet web browser 110a, a business application 110b, as well as a malicious code 110c, infected (infected) ) may receive data from an untrusted or unsecured application, such as business application 110d.

The source node 101 infected with the malicious program may attempt to access and/or transmit data to the second network 20 . When the second network 20 is formed based on IP such as VPN, it may be difficult for the second network 20 to individually monitor a plurality of devices included in the second network 20, and the application in the OSI layer It may be vulnerable to security at the layer or transport layer. In addition, if the source node 101 includes a malicious application after the channel has already been created, the data of the malicious application is transmitted to another electronic device (eg, the destination node 102 ) in the second network 20 . can

2 illustrates an architecture within a network environment in accordance with various embodiments.

Referring to FIG. 2 , the node 201 may be various types of devices capable of performing data communication. For example, the node 201 may be a portable device such as a smartphone or tablet, a computer device such as a desktop or laptop, a multimedia device, a medical device, a camera, a wearable device, a virtual reality (VR) device, or a home appliance, and is not limited to the above-described devices. For example, node 201 may include a server or gateway capable of sending data packets through an application. The node 201 may also be referred to as an 'electronic device' or a 'terminal'.

The node 201 may store a plurality of target applications 212 , 213 and an access control application 211 . The first target application 212 may be controlled by the access control application 211 , and may transmit a data packet to the first service server 205 through the gateway 203 or may receive a data packet conversely. The second target application 213 may be controlled by the access control application 211 , and may transmit a data packet to the second service server 206 or may receive a data packet conversely. As some of the target applications 212 and 213 may be trusted and/or secured applications such as web browsers or business applications, while others may be untrusted or unsecured malicious programs, network access according to embodiments The system establishes an unauthorized program (application) connection to the service servers 205 and 206 through a secure session between the access control application 211 and the gateway 203 or a secure session between the access control application 211 and the service server. You can block and quarantine the program. For example, before the target applications 212 and 213 according to the embodiments communicate with the service servers 205 and 206 , the access control application 211 may check whether access is possible from the controller 202 . When authentication is completed, the access control application 211 may create a secure session with the gateway 203 or the second service server 206 . That is, in order for the target applications 212 and 213 to access the network, the access control application 211 must be used, and the access control application 211 must be authorized from the controller 202, and the access control application 211 and the gateway ( 203) or after the secure session between the second service servers 206 is created, the access control application 211 may transmit data packets of the target applications 212 and 213 based on the secure session.

The controller 202 may be, for example, a server (or cloud server). The controller 202 can ensure reliable data transmission within the network environment by managing data transmission between the node 201 , the gateway 203 , and the service servers 205 and 206 . For example, the controller 202 may allow network access of the authorized node 201 (or the access control application 211 ) through policy information or blacklist information. In addition, the controller 202 mediates the creation of a secure session between the access control application 211 or the target application 212 , 213 and the gateway 203 or the second service server 206 , or the node 201 or the gateway 203 . ), the security session can be removed according to the security event collected from it. In one embodiment, the target application 212 , 213 may communicate with the service server 205 , 206 only through a secure session authorized by the controller 202 , if an authorized secure session does not exist, the target application 212 . , 213 may be blocked from the access control application 211 , the controller 202 , the gateway 203 , or the second service server 206 . According to one embodiment, the controller 202 is a connection control application ( 211) and control data packets can be transmitted and received. A flow (eg, 220 ) through which a control data packet is transmitted may be referred to as a 'control flow'.

The gateway 203 may be located at the boundary of the network to which the node 201 belongs or at the boundary of the network to which the service servers 205 and 206 belong. According to an embodiment, the gateway 203 may be connected to the controller 202 based on a cloud. The gateway 203 may forward only the authorized data packet among the data packets received from the access control application 211 to the first service server 205 . A flow in which a data packet is transmitted between the access control application 211 and the gateway 203 may be referred to as a 'data flow'. Data flows can be created not only on a node or IP basis, but also on a more granular basis (eg, an application). The gateway 203 may block indiscriminate network access in advance by forwarding only the data packet transmitted through the secure session among the data packets transmitted from the access control application 211 to the first service server 205 .

According to various embodiments, the node 201 may include an access control application 211 and a network driver (not shown) for managing network connections of target applications 212 and 213 stored in the node 201 . For example, when a connection event to the service servers 205 and 206 of the target applications 212 and 213 included in the node 201 occurs, the connection control application 211 is connected to the target applications 212 and 213 . You can decide whether it is possible or not. If the target applications 212 and 213 are accessible, the access control application 211 may transmit the data packet to the gateway 203 or the second service server 206 through the secure session. The access control application 211 may control transmission of data packets through a kernel including an operating system and a network driver in the node 201 .

3 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure; 3 illustrates only the memory 330 , the controller includes a communication circuit for performing communication with an external electronic device (eg, the communication circuit 430 of FIG. 4 ) and a processor (eg, FIG. 4 ) for controlling the overall operation of the controller. The processor 410 of 4) may be further included.

The administrator can access the controller 202 and set a connection-oriented policy to control the connection between the access control application 211 and the service servers 205 and 206, so it is more detailed and safer than managing sessions at the service end. You can control network access.

The access policy database 311 may include information on networks and/or services to which the identified network, node, or application can connect. For example, when the access control application 211 requests a network access, the controller 202 may include a network identified based on the policy of the access policy database 311 (eg, a network to which the node 201 belongs), a node, A user (eg, a user of the node 201 ), and/or an application (eg, a target application 212 , 213 included in the node 201 ) may determine whether the service server 205 , 206 is accessible. In an embodiment, the controller 202 may create a whitelist of the target applications 212 and 213 accessible by a specific service (eg, IP and port) based on the access policy database 311 .

The secure session policy database 312 includes gateway 203 information, service server 205, 206 information, and data packets existing at the network boundary of the service servers 205 and 206 on the connection path. Expiration time information for releasing the connection of the access control application 211, expiration time information for periodic renewal of a data flow, or monitoring the secure session at the gateway 203 if authentication or a secure session is not created may include at least one of secure session type information for According to an embodiment, the secure session may be created between the access control application 211 and the gateway 203 , or between the target applications 212 and 213 and the gateway 203 . Depending on the embodiment, the secure session may be created between the access control application 211 and the service servers 205 and 206 , or between the target applications 212 and 213 and the service servers 205 and 206 .

The blacklist policy database 313 is a target (eg, node ID ( identifier), an IP address, a media access control (MAC) address, or at least one of a user ID) may represent a blacklist registration policy for blocking access.

The blacklist database 314 may include a list of objects blocked by the blacklist policy database 313 . For example, the controller 202 may isolate the node 201 by rejecting the network connection request when the identification information of the node 201 requesting the network connection is included in the blacklist database 314 .

The control flow table 315 is an example of a session table for managing the flow (eg, control flow) of control data packets generated between the node 201 and the controller 202 . Upon successful access to the controller 202 , control flow information may be generated by the controller 202 . The control flow information may include at least one of identification information of the control flow, an IP address identified when accessing and authenticating a controller, a node ID, and a user ID. For example, when a connection to the service servers 205 and 206 is requested from the node 201 , the controller 202 may retrieve the control flow information through the control flow identification information received from the node 201 , Whether the node 201 can access the service servers 205 and 206 by mapping at least one of an IP address, a node ID, and a user ID included in the control flow information to the access policy database 311, the gateway 203 ) or whether to generate a data flow for creating a secure session with the service servers 205 and 206 may be determined (determined).

According to one embodiment, the control flow may have an expiration time. The node 201 needs to update the expiration time of the control flow, and if the expiration time is not updated for a certain period of time, the control flow (or control flow information) may be removed. In addition, when it is determined that immediate access blocking is required according to the security event collected from the node 201 , the controller 202 may remove the control flow according to the connection termination request of the node 201 . When the control flow is removed, the previously generated data flow is also removed, so that the connection of the node 201 may be blocked.

The secure session table 316 is a table for managing a secure session created between the access control application 211 or target applications 212 and 213 and the gateway 203 . In addition, the secure session table 316 is a table for managing a secure session created between the access control application 211 or target applications 212 and 213 and the service servers 205 and 206 . According to an embodiment, the secure session table 316 may be included in the data flow table 317 , and information included in the secure session table 316 may be applied to the description of the data flow table 317 of FIG. 3 .

The data flow table 317 is a table for managing a flow (eg, a data flow) through which detailed data packets are transmitted between the node 201 , the gateway 203 , and the service servers 205 and 206 . Data flows can be created in TCP sessions, applications, or more granular units. The data flow table 317 may include an application ID for identifying whether a data packet transmitted from a source is an authorized data packet, a destination IP address, and/or a service port. Since the target application 212, 213 of the node 201 can create a secure session with one or more gateways 203 or service servers 205, 206, the data flow table 317 is based on the control flow ID. can be managed In addition, the data flow table 317 includes whether a secure session is created between the target application 212, 213 or the access control application 211 and the gateway 203 or the service server 205, 206, information related to the secure session ( For example, secure session information including secure session identification information) may be included. In addition, the data flow table 317 includes state information including source IP and destination IP of the data packet, authorized target information for determining whether to forward the data packet based on port information, and whether the data flow is valid. can

According to an embodiment, the data flow table 317 may be equally stored in the node 201 , the gateway 203 , or the service servers 205 and 206 .

4 illustrates a functional block diagram of a node in accordance with various embodiments.

Referring to FIG. 4 , a node may include a processor 410 , a memory 420 , and a communication circuit 430 . According to an embodiment, the node may further include a display 440 to interface with a user.

The processor 410 may control the overall operation of the node. In various embodiments, the processor 410 may include one processor core or a plurality of processor cores. For example, the processor 410 may include a multi-core such as a dual-core, a quad-core, or a hexa-core. According to embodiments, the processor 410 may further include a cache memory located inside or outside. According to embodiments, the processor 410 may be configured with one or more processors. For example, the processor 410 may include at least one of an application processor, a communication processor, and a graphical processing unit (GPU).

All or part of the processor 410 is electrically or operatively coupled to other components within the node (eg, memory 420 , communication circuitry 430 , or display 440 ). It can be coupled with or connected to. The processor 410 may receive commands from other components of the node, interpret the received commands, and perform calculations or process data according to the interpreted commands. The processor 410 may interpret and process a message, data, command, or signal received from the memory 420 , the communication circuit 430 , or the display 440 . The processor 410 may generate a new message, data, instruction, or signal based on the received message, data, instruction, or signal. The processor 410 may provide the processed or generated messages, data, instructions, or signals to the memory 420 , the communication circuitry 430 , or the display 440 .

The processor 410 may process data or signals generated or generated in a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may write (or store) or update instructions, data, or signals to the memory 420 to execute or control a program.

The memory 420 may store a command for controlling a node, a control command code, control data, or user data. For example, the memory 420 may include at least one of an application program, an operating system (OS), middleware, and a device driver.

The memory 420 may include one or more of volatile memory and non-volatile memory. Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). may include The nonvolatile memory may include a read only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, and the like.

The memory 420 includes a nonvolatile medium such as a hard disk drive (HDD), a solid state disk (SSD), an embedded multi media card (eMMC), and a universal flash storage (UFS). may include more.

According to an embodiment, the memory 420 may store the target applications 212 and 213 and the access control application 211 of FIG. 2 . The access control application 211 may perform a network connection and secure session creation with the gateway 203 or service servers 205 and 206 , and a control flow creation and update function with the controller 202 . To this end, the access control application 211 may include one or more security modules. In one embodiment, the target application 212 , 213 may include one or more security modules for creating a secure session with the gateway 203 or service server 205 , 206 .

According to an embodiment, the memory 420 may store some of information included in the memory of the controller (eg, the memory 330 of FIG. 3 ). For example, the memory 420 may store the data flow table 317 described with reference to FIG. 3 .

The communication circuit 430 establishes a wired or wireless communication connection between the node and an external electronic device (eg, the controller 202, the gateway 203, or the service servers 205 and 206 of FIG. 2), and through the established connection. It can support performing communication. According to an embodiment, the communication circuit 430 is a wireless communication circuit (eg, a cellular communication circuit, a short-range wireless communication circuit, or a global navigation satellite system (GNSS) communication circuit) or a wired communication circuit (eg, a local area network (LAN) ) communication circuit, or power line communication circuit), and using the corresponding communication circuit among them, a short-distance communication network such as Bluetooth, WiFi direct or IrDA (infrared data association) or a cellular network, Internet, or long-distance communication such as a computer network It can communicate with an external electronic device through a network. The above-described various types of communication circuits 430 may be implemented as a single chip or as separate chips.

The display 440 may output content, data, or a signal. In various embodiments, the display 440 may display image data processed by the processor 410 . According to embodiments, the display 440 may be configured with an integrated touch screen by being combined with a plurality of touch sensors (not shown) capable of receiving a touch input or the like. When the display 440 is configured as a touch screen, a plurality of touch sensors may be disposed above the display 440 or below the display 440 .

Meanwhile, a server (eg, a controller) according to an embodiment may include a processor 410 , a memory 420 , and a communication circuit 430 . The processor 410 , the memory 420 , and the communication circuit 430 included in the server may be substantially the same as the above-described processor 410 , the memory 420 , and the communication circuit 430 .

5 illustrates an operation of controlling transmission of a data packet according to various embodiments.

Referring to FIG. 5 , the access control application 211 detects a network access request to the first service server 205 from the first target application 212 included in the node 201 , and connects to the node 201 or the node 201 . It may be determined whether the control application 211 is connected to the controller 202 . When the node 201 or the access control application 211 is not connected to the controller 202, the access control application 211 may block transmission of data packets from a kernel or a network driver including the operating system. have. Through the access control application 211 , the node 201 may block access of a malicious application in an application layer of the OSI layer in advance.

In one embodiment, the access control application 211 is not connected to the controller 202 or a secure session has not been created between the access control application 211 or the first target application 212 and the gateway 203 . In this case, the data packet transmitted from the access control application 211 is blocked by the gateway 203 , and the access control application 211 can only request a connection to the controller 202 .

In one embodiment, if the access control application 211 is not installed on the node 201 or a malicious application bypasses the control of the access control application 211 , an unauthorized data packet may be transmitted from the node 201 . . In this case, the gateway 203 existing at the boundary of the network blocks data packets received with unauthorized secure sessions and data packets with no data flow, so data packets transmitted from the node 201 (eg, TCP session) are blocked. data packets for generation) may not reach the first service server 205 . In other words, the node 201 may be isolated from the first service server 205 .

In one embodiment, the access control application 211 detects a network access request to the second service server 206 from the second target application 213 included in the node 201, and controls the node 201 or the access control. It may be determined whether the application 211 is connected to the controller 202 . When the node 201 or the access control application 211 is not connected to the controller 202, the access control application 211 may block transmission of data packets from a kernel or a network driver including the operating system. have.

In one embodiment, the access control application 211 is not connected to the controller 202 or a secure session between the access control application 211 or the second target application 213 and the second service server 206 is If not generated, the data packet transmitted from the access control application 211 is blocked by the second service server 206 , and the access control application 211 can only request a connection to the controller 202 .

6 illustrates a signal flow diagram for controller connection according to various embodiments.

Since the node 201 needs to be authorized by the controller 202 to access or receive the network, the access control application 211 of the node 201 requests the controller 202 to generate a control flow to the node ( 201) can try to connect to the controller.

According to an embodiment, the gateway or server 210 of FIG. 6 may include the gateway 203 and service servers 205 and 206 of FIG. 2 .

Referring to FIG. 6 , the node 201 may detect a controller access event. For example, when the access control application 211 is installed and executed in the node 201 , the node 201 may detect that a connection to the controller 202 is requested.

In operation 605 , the node 201 may request a controller connection from the controller 202 . For example, the access control application 211 may transmit identification information of the access control application 211 to the controller 202 . Additionally, the access control application 211 includes identification information of the node 201 (eg, terminal ID, IP address, MAC address), type, location, environment, identification information of the network to which the node 201 belongs, and/or network Any identification information generated by the system itself may be further transmitted.

In operation 610 , the controller 202 may identify whether a target (eg, the access control application 211 or the node 201 ) requesting access to the controller is accessible. According to an embodiment, the controller 202 determines whether the information received from the node 201 is included in the access policy database 311 or whether the node 201, the network to which the node 201 belongs, and/or access Based on at least one of whether the identification information of the control application 211 is included in the blacklist database 314, it is possible to check whether a target that has requested access to the controller is accessible.

If it is reachable, in operation 615 , the controller 202 may create a control flow between the node 201 (or the access control application 211 ) and the controller 202 . In this case, the controller 202 generates control flow identification information in the form of a random number, and stores identification information of at least one of the node 201 , the network to which the node 201 belongs, or the access control application 211 in the control flow table ( 315) can be stored. The information stored in the control flow table 315 may be used for user authentication of the node 201 , updating information of the node 201 , checking a policy for network access of the node 201 , and/or validation.

In operation 620, the controller 202 uses the identified information (eg, node 201, source network information to which node 201 belongs) and corresponding access policy database 311 and secure session policy database 312 in the Whitelist information of accessible applications can be created. In one embodiment, the controller 202 may send the application white list to the access control application 211 in operation 625 .

In operation 625 , the controller 202 may transmit control flow identification information to the node 201 in response to the controller connection request. According to an embodiment, when a target requesting controller access is unavailable or included in a blacklist, the controller 202 may transmit access unavailable information in operation 625 without generating a control flow. In an embodiment, the controller 202 may transmit the application white list generated by performing operation 620 to the access control application 211 .

In operation 630, the access control application 211 may perform a check on the application. For example, the access control application 211 may perform an application check based on a white list of accessible applications received from the controller 202 . The access control application 211 can check whether the application exists (installed) in the node 201 based on the accessible application information, and in the case of an existing application, check whether the integrity and stability according to the validation policy ( On top of the application, tampering checks, code signing checks, fingerprint checks) can be performed.

In operation 635 , the access control application 211 may transmit an application check result to the controller 202 . For example, the access control application 211 may transmit information of an existing application and a result of the validation check to the controller 202 .

In operation 640 , the controller 202 may check whether the application is valid based on the received application information. If it is a valid application, the controller 202 is a gateway or service server where the node 201 is located in the access policy database 311 and the secure session policy database 312 to allow access of the node 201 connected to the network. (210) can be confirmed. Also, the controller 202 may generate a data flow based on the source IP, destination IP, and port information so that the node 201 can transmit a data packet without a network access request procedure.

The controller 202 may transmit the generated data flow to the gateway or server 210 and the access control application 211 (operations 645 and 650 ).

In operation 655, the access control application 211 may process a result value according to the received response. For example, the access control application 211 may store the received control flow identification information and display a user interface screen indicating that the controller connection is complete to the user. When the controller connection is completed, the network connection request of the node 201 to the destination network may be controlled by the controller 202 .

According to another embodiment, the controller 202 may determine that the node 201 is unreachable. For example, when identification information of the node 201 and/or the network to which the node 201 belongs is included in the blacklist database, the controller 202 may determine that the node 201 is not accessible. In this case, the controller 202 may transmit a response indicating that the controller connection is impossible in operation 625 without generating a control flow in operation 615 . Also, in this case, operations 630 to 650 may not be performed. According to an embodiment, when a retry of the controller connection is required, the access control application 211 may perform operation 605 again.

In addition, when the data flow received from the controller 202 exists, the access control application 211 updates the data flow of the node 201 and transmits the data packet based on the data flow allowed in advance when connecting to the network. data flow can be managed.

According to an embodiment, when it is determined that the application inspection is not necessary, operations 630 to 650 may not be performed.

7 illustrates a signal flow diagram for user authentication according to various embodiments.

In order for the node 201 to be granted detailed access to the destination network, the access control application 211 of the node 201 may receive authentication for the user of the node 201 from the controller 202 .

Referring to FIG. 7 , the node 201 may receive an input for user authentication. The input for user authentication may be, for example, a user input inputting a user ID and password. As another example, the input for user authentication may be a user input (eg, biometric information) for more enhanced authentication. In this case, in operation 705 , the access control application 211 of the node 201 may request user authentication from the controller 202 . If the control flow between the node 201 and the controller 202 has already been created, the access control application 211 may transmit input information for user authentication together with the control flow identification information.

In operation 710 , the controller 202 may authenticate the user based on the information received from the node 201 . For example, the controller 202 may include a user ID, password, and/or enhanced authentication information included in the received information, and a database (eg, the access policy database of FIG. 3 ) included in the memory of the controller 202 . Based on 311 or the blacklist database 314), it is possible to determine whether the user can access according to the access policy and whether the user is included in the blacklist.

If the user is authenticated, in operation 715 , the controller 202 may add user identification information (eg, user ID) to identification information of the control flow. The added user identification information may be used for an authenticated user's controller access or network access.

The controller 202 may generate accessable application information based on the access policy database 311 or the secure session policy database 312 in operation 720 . For example, the accessible application information may be an application whitelist generated based on an access policy.

In operation 725 , the controller 202 may transmit information indicating that the user is authenticated to the node 201 in response to the user authentication request. In addition, the controller 202 may transmit connectable application information to the access control application 211 .

In operation 730, the access control application 211 may perform an application check. For example, the access control application 211 may perform an application check based on a white list of accessible applications received from the controller 202 . The access control application 211 can check whether the application exists (installed) in the node 201 based on the accessible application information, and in the case of an existing application, check whether the integrity and stability according to the validation policy ( On top of the application, tampering checks, code signing checks, fingerprint checks) can be performed.

In operation 735 , the access control application 211 may transmit an application check result to the controller 202 . For example, the access control application 211 may transmit information of an existing application and a result of the validation check to the controller 202 .

In operation 740 , the controller 202 may check whether the application is valid based on the received application information. If it is a valid application, the controller 202 is a gateway or service server where the node 201 is located in the access policy database 311 and the secure session policy database 312 to allow access of the node 201 connected to the network. (210) can be confirmed. Also, the controller 202 may generate a data flow based on the source IP, destination IP, and port information so that the node 201 can transmit the data packet without a network access request procedure.

The controller 202 may transmit the generated data flow to the gateway or server 210 and the access control application 211 (operations 745 and 750).

In operation 755, the access control application 211 may process a result value according to the received response. For example, the access control application 211 may store the received control flow identification information and display a user interface screen indicating that user authentication is complete to the user. When the user authentication is completed, the network connection request of the node 201 to the destination network may be controlled by the controller 202 .

According to another embodiment, the controller 202 may determine that the user authentication of the node 201 is impossible. For example, when the identification information of the node 201 and/or the network to which the node 201 belongs is included in the blacklist database, the controller 202 may determine that the node 201 is inaccessible and user authentication is impossible. . In this case, the controller 202 may transmit a response indicating that access to the controller is impossible in operation 725 without reflecting the user identification information in operation 715 . Also, in this case, operations 730 to 750 may not be performed.

In addition, when the data flow received from the controller 202 exists, the access control application 211 updates the data flow of the node 201 and transmits the data packet based on the data flow allowed in advance when connecting to the network. data flow can be managed.

According to an embodiment, if the application check is not required, operations 730 to 750 may not be performed.

8 illustrates a signal flow diagram for a network connection according to various embodiments.

After the node 201 is authorized from the controller 202, the node 201 controls the network connection of other applications stored in the node 201 through the connection control application 211 of the node 201, thereby providing trusted data. transmission can be guaranteed.

In operation 805 , the access control application 211 may detect a network access event of another application stored in the node 201 (eg, the target applications 212 and 213 of FIG. 2 ).

In operation 810, the access control application 211 may check the existence of a data flow corresponding to the identification information of the application requesting network access, the destination network identification information, and the port information. Depending on the embodiment, if a data flow exists but is not valid, the access control application 211 may drop the data packet. According to another embodiment, when a data flow exists, the access control application 211 may transmit a data packet based on the data flow. According to an embodiment, the access control application 211 of the node 201 may perform a network access request in operation 815 without performing operation 810 .

When the data flow needs to be updated, such as when the data flow does not exist or the authentication time has expired and an update is required, in operation 815 , the access control application 211 may request a network connection from the controller 202 . For example, the network access request may include control flow identification information, identification information of a destination network, and port information.

In operation 820, the controller 202 performs access-requested identification information (eg, identification information of a destination network) in an access policy corresponding to information identified based on the control flow identification information (eg, node, user, and source network identification information). and port information) and whether the destination network can be accessed. According to an embodiment, the controller 202 may check whether the target application can connect to the gateway or the service server 210 . According to an embodiment, when the network connection is impossible, the controller 202 may transmit a connection failure result to the access control application 211 of the node 201 (operation 835 ).

If access is possible, in operation 825 , the controller 202 may determine whether a secure session can be created between the node 201 and the gateway or service server 210 based on the secure session policy.

When secure session creation is possible, the controller 202 may check whether a valid data flow corresponding to the identification information and port information of the destination network exists in the data flow table. According to an embodiment, when a valid data flow exists in the data flow table, the controller 202 may transmit the corresponding data flow to the gateway or server 210 and the access control application (operations 830 and 835 ). According to another embodiment, when a valid data flow does not exist, the target application or access control application 211 can create a secure session with the gateway or service server 210 based on the source IP, destination IP and port information. to create a data flow. In this case, the controller 202 may transmit the generated data flow to the gateway or server 210 and the access control application (operations 830 and 835 ). According to another embodiment, if the network connection is impossible or it is impossible to create a secure session, the controller 202 may transmit a network connection unavailable result to the access control application in operation 835 .

In operation 840 , the access control application 211 of the node 201 may process a result value for the response received from the controller 202 . For example, the access control application 211 may drop a data packet to be transmitted by the target application when receiving a result of network connection failure from the controller 202 . As another example, when a data flow is received from the controller 202 , the access control application 211 may transmit a data packet based on the received data flow.

In an embodiment, after performing operation 810, the access control application 211 may perform a validity check on the access application according to the validity check policy. For example, the access control application 211 may further perform integrity and stability check (application forgery, tampering check, code signing check, fingerprint check, etc.) of the access application. The access control application 211 may perform operation 815 when the validation result is successful.

9 illustrates a signal flow diagram for controlling data packet transmission in accordance with various embodiments.

When transmission of a data packet is detected, the access control application 211 of the node 201 controls the transmission of the data packet based on whether the data packet is a secure session based data packet, thereby providing reliable data packet transmission. can

Referring to FIG. 9 , in operation 905 , the access control application 211 may detect a data packet transmission event. For example, in the connection control application 211 , the target application of the node 201 (eg, the target applications 212 and 213 of FIG. 2 ) transmits the data packet after the network connection is allowed through the operations shown in FIG. 8 . It is possible to detect the motion of transmitting

According to an embodiment, the access control application 211 may identify a target application that transmits the data packet and information included in the data packet (eg, source identification information, destination identification information, port information, etc.). For example, the access control application 211 may check whether a data flow corresponding to the identified information exists, and if the data flow exists, operation 910 may be performed. For another example, if the data flow does not exist or the data flow is invalid, the access control application 211 may drop the data packet.

In operation 910 , the access control application 211 may inspect the data packet. For example, the access control application 211 may check the secure session information of the data flow, and when the secure session creation is completed and the data packet is a secure session related data packet, the access control application 211 may transmit the data packet based on the secure session. As another example, when the data packet is a data packet related to a network connection (eg, related to TCP session creation, etc.), the access control application 211 may transmit the data packet. For another example, the access control application 211 may drop the data packet when the secure session creation is not completed, when the data packet is not a secure session-related data packet, or when the data packet is not a network connection-related data packet. have. For another example, when the data packet is a secure session creation request data packet, the access control application 211 transmits the data packet (operation 915), and inspects the data packet transmitted or received during the secure session creation process to establish the secure session. It is possible to detect whether or not it has been created.

In operation 920 , the gateway or server 210 may process a secure session creation request. For example, the gateway or server 210 may create a secure session with the target application or access control application 211 .

When a secure session is created, in operation 940 , the gateway or server 210 may transmit a secure session creation result to the access control application 211 . For example, the secure session creation result may include a data packet including secure session creation completion information or secure session identification information.

In operation 930 , the access control application 211 may detect a secure session creation result. For example, the access control application 211 may detect a data packet including secure session creation completion information or secure session identification information.

When detecting the secure session creation result, in operation 935 , the access control application 211 may transmit secure session identification information to the controller 202 . According to an embodiment, the access control application 211 may transmit identification information of a data flow corresponding to the transmitted data packet together with the secure session identification information to the controller 202 . According to another embodiment, the access control application 211 may transmit the identification information, destination IP, and port information of the target application that has transmitted the data packet to the controller 202 together with the secure session identification information.

When the secure session is created, in operation 935 , the access control application 211 or the gateway or server 210 that has created the secure session with the target application may transmit secure session identification information of the created secure session to the controller 202 . .

The controller 202 may determine whether to check the secure session identification information in the secure session policy when the secure session identification information is received. For example, if it is determined to check the secure session identification information, the controller 202 may perform operation 945 . As another example, if it is determined not to check the secure session identification information, the controller 202 may perform operation 950 .

At operation 945 , the controller 202 may examine the secure session identification information. For example, the controller 202 may check whether the secure session identification information received from the access control application 211 in operation 935 and the secure session identification information received from the gateway or server 210 in operation 940 are the same. have. According to an embodiment, when the secure session identification information is different from each other, the controller 202 may transmit a connection unavailable result to the node 201 (operation 955). According to another embodiment, when the secure session identification information is the same, the controller 202 may perform operation 950 .

According to an embodiment, when it is determined not to check the secure session identification information, operations 940 and 945 may not be performed.

In operation 950 , the controller 202 may update the data flow based on the secure session identification information. For example, the controller 202 may update the secure session identification information and the secure session creation completion state in the data flow.

In operation 955 , the controller 202 may transmit a data flow in which the secure session identification information and the secure session creation completion state are updated to the access control application 211 . As another example, when it is determined that transmission of the data packet should be blocked, the controller 202 may transmit a result of not being able to connect to the access control application 211 .

According to an embodiment, when the secure session identification information received from the gateway or server 210 does not exist, the controller 202 may transmit a result of retrying the security session identification information check to the access control application 211 . There is (act 955).

In operation 960 , the access control application 211 may process the result received from the controller 202 . For example, when an updated data flow is received from the controller 202 , the access control application 211 may update a pre-stored data flow based on the updated data flow. For another example, when receiving retry information from the controller 202 , the access control application 211 may re-perform the secure session identification information check request after waiting a predetermined time. For another example, when receiving a connection unavailable result from the controller 202 , a secure session may be removed, a data flow may be removed, or a data packet may be dropped.

10 illustrates a signal flow diagram for processing a secure session upon receiving a data packet according to various embodiments of the present disclosure;

Referring to FIG. 10 , in operation 1005 , the gateway or server 210 may detect a data packet reception event. For example, the gateway or server 210 may receive the data packet.

In operation 1010, the gateway or server 210 may examine a data flow. For example, the gateway or server 210 may check whether a data flow corresponding to the received data packet exists. As another example, the gateway or server 210 may check whether a data flow corresponding to the source IP, destination IP, and destination port information included in the 5 tuple information of the data packet exists. According to an embodiment, when there is no data flow, the gateway or server 210 may drop the received data packet. According to an embodiment, when a data flow exists, the gateway or server 210 may perform operation 1015 .

In operation 1015 , the gateway or server 210 may examine the received data packet. For example, the gateway or server 210 may check whether the received data packet is a secure session creation request data packet, a secure session based data packet, or a data packet that is not based on a secure session.

In operation 1020 , the gateway or server 210 may process the data packet based on the test result. According to an embodiment, when the received data packet is a secure session creation request data packet, the gateway or server 210 may generate a secure session in operation 1020 . According to an embodiment, when the received data packet is a secure session-based data packet, the gateway or server 210 performs secure session-related processing (eg, protocol parsing and data packet decryption, etc.) through a secure session-related application in operation 1020 . and can forward or receive data packets. According to an embodiment, when the received data packet is a secure session-based data packet but the secure session processing fails, the gateway or server 210 may drop the data packet. Depending on the embodiment, if the received data packet is a data packet that is not based on a secure session, the gateway or server 210 may drop the data packet.

When the secure session creation process is completed in operation 1020, the gateway or server 210 detects secure session creation completion information or secure session identification information through a secure session processing application, or secures session through data packet inspection of a data packet filter driver. Creation completion information or secure session identification information may be detected. In this case, in operation 1025 , the gateway or server 210 may transmit secure session identification information to the controller 202 to update the data flow that the secure session has been created (operation 1030 ). According to an embodiment, the gateway or server 210 may transmit data flow identification information or destination IP and port information to the controller 202 together with secure session identification information.

In operation 1035 , the controller 202 may update the data flow based on the received secure session identification information. For example, the controller 202 may update the data flow based on the secure session identification information and the secure session creation completion information.

11 illustrates a signal flow diagram for control flow update according to various embodiments.

Referring to FIG. 11 , in operation 1105 , the access control application 211 may detect a control flow update event.

In operation 1110 , the access control application 211 may request the controller 202 to update the control flow based on the control flow identification information.

In operation 1115 , the controller 202 may check whether a control flow exists in a control flow table (eg, the control flow table 315 of FIG. 3 ) based on the received control flow identification information. According to the embodiment, when the control flow does not exist (eg, when the connection is disconnected by another security system, when the connection is disconnected due to self-risk detection, etc.), the controller 202 determines that the connection of the node 201 is valid. Since it does not, the connection unavailable result may be transmitted to the access control application 211 (operation 1120 ).

The controller 202 may update the update time when a control flow exists in the control flow table (eg, the control flow table 315 of FIG. 3 ). In this case, the controller 202 may transmit the updated identification information of the control flow to the access control application 211 (operation 1120 ).

In one embodiment, the controller 202 transmits information about the data flow to the access control application ( 211) (operation 1120).

In operation 1125 , the access control application 211 of the node 201 may process a result value for the response received from the controller 202 . For example, when the control flow update result is impossible, the access control application 211 may block all network connections of the application. As another example, the access control application 211 may update the data flow when the control flow update result is normal and the updated data flow information exists.

12 illustrates a signal flow diagram for disconnection according to various embodiments.

12, in operation 1205, the node 201 terminates the node 201, terminates the access control application 211, terminates the target application, no longer uses the network connection, and information identified from the interworking system. At least one of the connection termination requests may be detected based on the . In this case, in operation 1210 , the node 201 or the access control application 211 may request the controller 202 to remove the control flow.

In operation 1215 , the controller 202 may remove the identified control flow based on the received control flow identification information.

In operation 1220 , the controller 202 may remove all data flows dependent on the removed control flow. Accordingly, node 201 is no longer able to connect to the destination network based on the removed data flow.

In operation 1225 , the controller 202 may perform a removal request for all data flows dependent on the removed control flow to the gateway or server 210 . In this case, the gateway or server 210 may control the application to no longer transmit data packets by removing the data flow and removing the secure session.

13 illustrates a signal flow diagram for terminating application execution according to various embodiments.

Referring to FIG. 13 , in operation 1305 , the access control application 211 of the node 201 may check whether the running application is terminated in real time, and may detect an application execution termination event.

According to an embodiment, the access control application 211 may check whether a data flow corresponding to the terminated application identification information and PID (Process ID and Child Process ID Tree) information exists.

In operation 1310 , the access control application 211 may perform a data flow removal request to the controller 202 . For example, the access control application 211 may transmit identification information of the terminated application or identification information of a data flow corresponding to the terminated application to the controller 202 and perform a data flow removal request.

In operation 1315 , the controller 202 may delete the requested data flow. Also, the controller 202 may perform a removal request for the removed data flow to the gateway or the server 210 . Accordingly, data packets corresponding to the source network, destination network, and port information included in the removed data flow cannot be transmitted any more. In addition, the gateway or server 210 may provide a state in which the corresponding application cannot transmit data packets to the destination anymore by removing the secure session corresponding to the data flow.

14 is a flowchart illustrating a method of operating a connection control application installed in a node according to various embodiments of the present disclosure; Embodiments Accordingly, the operations shown in FIG. 14 may be performed through the access control application 211 of the node 201 of FIG. 2 .

Referring to FIG. 14 , in operation 1405 , the access control application 211 installed in the node 201 may detect a data packet transmission event of the target application.

In operation 1410, the access control application 211 may check whether there is a data flow corresponding to the identification information of the target application and information included in the data packet and authorized from the external server.

In operation 1415, the access control application 211 may check the type of the data packet. For example, the access control application 211 may determine whether the data packet is a secure session creation request data packet, a secure session related data packet, or a network connection data packet.

In operation 1420, when the data packet is a secure session creation request data packet, the access control application 211 may transmit the data packet to the gateway or the service server. For example, the access control application 211 may create a secure session between the target application or the access control application 211 and the gateway or service server by transmitting a secure session creation request data packet.

In operation 1425 , the access control application 211 may transmit secure session identification information to an external server when a secure session is created. For example, the external server may include the controller 202 of FIG. 2 . As another example, the access control application 211 may detect data packets related to secure session creation, and transmit secure session identification information to an external server to update whether the secure session is created in the data flow.

15 is a flowchart illustrating a method of operating a server according to various embodiments. The operations shown in FIG. 15 may be performed through the controller 202 of FIG. 2 .

Referring to FIG. 15 , in operation 1505 , the server (eg, the controller 202 of FIG. 2 ) may receive a network access request from the access control application (eg, the access control application 211 of FIG. 2 ).

In operation 1510, the server may determine whether the target application is accessible based on the database. For example, the server may determine whether the target application is accessible based on the access policy database.

In operation 1515 , if the target application is accessible, the server may check whether a secure session can be created between the node and the gateway or the service server based on the database. For example, the server may check whether a secure session can be created based on the secure session policy database.

In operation 1520 , the server may create a data flow so that the node may establish a secure session with the gateway or service server.

In operation 1525, the server may transmit the generated data flow to the access control application.

The above description is merely illustrative of the technical idea disclosed in this document, and those of ordinary skill in the art to which the embodiments disclosed in this document belong are not departing from the essential characteristics of the embodiments disclosed in this document. Various modifications and variations will be possible.

Accordingly, the embodiments disclosed in this document are for explanation rather than limiting the technical ideas disclosed in this document, and the scope of the technical ideas disclosed in this document is not limited by these embodiments. The scope of protection of the technical ideas disclosed in this document should be interpreted by the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present document.

Claims (14)

In the node,
communication circuit;
a processor operatively coupled to the communication circuitry; and
a memory operatively coupled to the processor and storing a connection control application and a target application, wherein the memory, when executed by the processor, causes the node to:
Through the access control application, detect a data packet transmission event of the target application,
Check whether there is a data flow corresponding to the identification information of the target application and information included in the data packet and authorized from an external server,
check the type of the data packet;
When the data packet is a secure session creation request data packet, sending the data packet to a gateway or a service server to create a secure session between the node and the gateway or the service server,
and to transmit the identification information of the secure session to the external server when the secure session is created. The method of claim 1, wherein the instructions cause the node to:
Inspecting data packets transmitted or received in the process of creating a secure session through the access control application;
Detect a data packet including the secure session identification information in the transmitted or received data packet, or detect a data packet including the secure session creation completion information. The method of claim 1 , wherein the instructions cause the node to:
receiving a data flow updated to include a secure session creation completion status and the secure session identification information from the external server through the access control application;
and update a data flow stored in the node based on the updated data flow. The method of claim 1, wherein the instructions cause the node to:
Drop the data packet through the access control application when the data flow does not exist;
If the data flow exists, it is determined whether the secure session is created based on the data flow,
When the secure session creation is completed and the data packet is a secure session related data packet, transmitting the data packet;
When the data packet is a network connection related data packet, transmit the data packet;
and drop the data packet when the secure session creation is not completed. The method of claim 1, wherein the instructions cause the node to:
Detecting a network access event of the target application through the access control application,
performing a network access request including identification information of the external server and the generated control flow identification information, identification information of the target application, and identification information of the service server to the external server;
to receive the data flow generated from the external server,
The data flow is generated from the external server based on whether the target application is able to connect to the service server and whether a secure session between the gateway or the service server and the node is possible. The method of claim 1, wherein the instructions cause the node to:
performing a controller access request to the external server through the access control application, wherein the controller access request includes identification information of the node or identification information of the access control application;
Receive control flow identification information from the external server,
to receive an application whitelist from the external server;
The application whitelist is generated based on a secure session policy of the external server. The method of claim 1, wherein the instructions cause the node to:
Detect termination of the target application through the access control application,
Check whether there is a data flow corresponding to the target application,
A node to perform a data flow removal request including identification information of a data flow corresponding to the target application or identification information of the target application to the external server. in the server,
communication circuit;
a memory for storing the database; and
a processor operatively coupled with the communication circuitry and the memory, the processor comprising:
Receive a network connection request from a connection control application of a node, wherein the network connection request includes identification information of a target application of the node and identification information of a destination network,
Determining whether the target application is accessible based on the database,
If the target application is accessible, it is checked whether a secure session can be created between the node and the gateway or service server based on the database,
creating a data flow so that the node can establish a secure session with the gateway or the service server;
send the data flow to the access control application;
when a secure session is created, receive identification information of the secure session from the access control application. The method of claim 8, wherein the processor comprises:
receive first secure session identification information from the access control application;
Determine whether to check the secure session identification information based on the database,
updating the first secure session identification information and the secure session completion state in the data flow when it is determined not to check the secure session identification information;
and send the updated data flow to the access control application. 10. The method of claim 9, wherein the processor,
receiving second secure session identification information from the gateway or the service server;
comparing the second secure session identification information with the first secure session identification information when it is determined to examine the secure session identification information;
update the data flow when the second secure session identification information and the first secure session identification information are the same, and send the updated data flow to the access control application;
and, if the second secure session identification information and the first secure session identification information are not the same, delete the data flow, and send a connection unavailable result to the access control application. The method of claim 8, wherein the processor comprises:
receive a control flow termination request from the access control application, wherein the control flow termination request includes control flow identification information;
Remove the identified control flow based on the control flow identification information,
removing a data flow dependent on the control flow;
and request removal of the dependent data flow from the gateway or the service server. The method of claim 8, wherein the processor comprises:
receive a data flow removal request from the access control application, wherein the data flow removal request includes data flow identification information or identification information of the target application;
Remove the data flow identified based on the data flow identification information or the identification information of the target application,
and request removal of the identified data flow from the gateway or the service server. A method of operating a connection control application installed on a node, the method comprising:
detecting a data packet transmission event of a target application;
checking whether there is a data flow corresponding to the identification information of the target application and information included in the data packet and authorized from an external server;
checking the type of the data packet;
transmitting the data packet to a gateway or a service server when the data packet is a secure session creation request data packet to create a secure session between the node and the gateway or the service server; and
transmitting identification information of the secure session to the external server when the secure session is created; A method comprising In the method of operating a server,
receiving a network connection request from a connection control application of a node, wherein the network connection request includes identification information of a target application of the node and identification information of a destination network;
determining whether the target application is accessible based on a database;
checking whether a secure session can be created between the node and a gateway or a service server based on the database when the target application is accessible;
creating a data flow to enable the node to establish a secure session with the gateway or the service server;
sending the data flow to the access control application; and
if the secure session is created, receiving identification information of the secure session from the access control application; A method comprising

Images