KR102443714B1 - Internal Network External Access Security System - Google Patents

Abstract

The present invention relates to a corporate network/external access security system which is implemented to approve only allowed network information to access a corporate network and prevent IP exposure of the corporate network so as to prevent unintentional access or attacks, thereby enabling secure external access. The corporate network/external access security system comprises: an agent which is installed in a user terminal trying to access a corporate network installed in a company from the outside; a security server which checks whether the user terminal is a legitimate user and approves or blocks its access to the corporate network according to whether or not the user terminal determined to be a legitimate user is approved for access to the corporate network; and a masquerade server which sets access approval for an IP of the agent installed in the user terminal requesting access when an access request is transmitted from the security server to the corporate network of the user terminal, sets a connection policy to a destination IP of the IP (Source IP) of the agent for which access to the corporate network is set, and notifies a result of setting the connection policy to the security server, and through which packets to be transmitted from the agent to the corporate network are relayed.

Description

Internal Network External Access Security System

The present invention relates to a system for securing external access to an internal network, and more particularly, by allowing only permitted network information to access the internal network and preventing unintended access or attack by preventing IP exposure of the internal network It relates to a security system for external access to the internal network implemented to enable access.

Recently, many companies have changed the internal network access method through a wired network to the internal network access method through a wireless network such as Wi-Fi in order to improve the portability of work equipment and the hassle of wired wiring for work equipment. In addition, many companies allocate a fixed IP address to each business device such as a laptop for security, and manage the internal network access history of the business device and restrict access using the fixed IP address. And most companies block access to the internal network through the Internet from outside for security. Although access to the internal network through a VPN (Virtual Private Network) is allowed, access to the internal network through a VPN has various problems as follows.

First, business devices connect to the internal network through a fixed IP address. To access the internal network through the Internet from outside, the IP settings must be changed. For example, the laptop is set to access the corporate network through a fixed IP address, but the user connects the laptop to the Internet on a business trip or the like. Then, the laptop has to change the IP settings such as a fixed IP address to the IP settings of the connected Internet.

Second, when a business device connected to the Internet accesses the corporate network through VPN, it has a dynamic IP address assigned from the connected Internet instead of a fixed IP address. Therefore, it is difficult for the corporate management system to manage access history and restrict access of business devices accessed through arbitrary dynamic IP addresses, and thus cannot perform unified IP-based security management.

Third, a separate VPN connection software must be installed for work devices. Business devices run VPN access software and have to wait for a VPN connection, so the initial access time is much longer than in the corporate network.

Fourth, policy updates of security programs such as DRM and DLP installed on business devices are required. Most security programs control network access based on the IP information of the installed terminal. Therefore, when a work device is connected through a VPN, it is necessary to update the security policy for the dynamic IP address. After that, when the business device accesses the corporate network with a static IP address, it is necessary to update the security policy for the static IP address again.

On the other hand, the above-mentioned background art is technical information that the inventor possessed for the derivation of the present invention or acquired in the process of derivation of the present invention, and it cannot be said that it is necessarily a known technique disclosed to the general public before the filing of the present invention. .

Korea Registered Utility Model No. 20-0264584 Korean Patent Registration No. 10-1766444

One aspect of the present invention is an internal network external access security implemented to allow safe external access by allowing only permitted network information to access the internal network and preventing unintended access or attacks by preventing IP exposure of the internal network provide the system.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

an agent installed in a user terminal to access an internal network installed in the company from the outside according to an embodiment of the present invention; a security server that confirms whether the user terminal is a legitimate user, and approves or blocks access of the user terminal to the internal network according to whether the user terminal determined as a political party user approves access to the internal network; and when an access request is transmitted from the security server to the internal network of the user terminal, an access approval of the IP of the agent installed in the user terminal requesting access is set, and the access approval to the corporate network is set. After setting the connection policy from the agent's IP (Source IP) to the destination IP (Destination IP), the result of the set connection policy is notified to the security server, and the packet transmitted from the agent to the corporate network passes through ( It includes a Mesquared server that is relayed).

In an embodiment, the Mesquared server may destroy a connection policy set for the user terminal when the user terminal has terminated access to the internal network.

In an embodiment, the Mesquared server may re-establish a connection policy when a connection approval request is requested again after the connection policy expires after the user terminal has approved access to the corporate network.

In an embodiment, in the Mesquared server, when a connection release request is transmitted from the user terminal or a health check between the user terminal and the user terminal fails, the connection between the user terminal and the internal network is terminated. can be considered to have been

In one embodiment, the Mesquared server may set the connection policy to the destination IP (Destination IP) together with the IP (Source IP) of the agent for which access approval is set and the port (Port) of the agent for which access approval is set. have.

In an embodiment, the Mesquared server is configured to provide the user terminal of the user terminal only when the user of the user terminal is read as a legitimate user by the security server and the integrity of the application to be used in the user terminal is ensured. an anti-malware unit that allows access to the corporate network; A ransomware prevention unit that allows the user terminal to access the corporate network only when the user of the user terminal is read as a legitimate user by the security server and the application to be used in the user terminal is permitted ; and a leak prevention unit for limiting the scope of task performance so that the user terminal, which is working by accessing the internal network, can perform the task only within the range of the set leak security policy.

In an embodiment, the anti-malware unit may determine that integrity is violated when it is determined that the application intended to be used in the user terminal is infected with malware due to binary tampering or DLL injection attack.

In an embodiment, the anti-malware unit determines that the integrity of the application to be used in the user terminal is violated and the access to the corporate network is blocked, using other than the access to the corporate network of the user terminal may not be limited.

In an embodiment, the ransomware prevention unit may block the access of the user terminal to the internal network when the user terminal intends to use an application that is not permitted to be used other than an application that is permitted to be used.

In an embodiment, the agent may be installed in a kernel space of the user terminal.

In one embodiment, the leak prevention unit, when the application being used in the user terminal calls a kernel function to the kernel via the agent using a system call (System Call) only within the scope of a preset policy Limits can be set on the scope of work performance so that it can be performed.

In an embodiment, the leak prevention unit may block the leak by filtering a return value of a kernel function transmitted from the kernel to the application being used in the user terminal via the agent.

A method for securing external access to an internal network according to an embodiment of the present invention includes: an approval request step in which a user terminal requests permission to access an internal network installed in the company from the outside; a user confirmation step of confirming in a security server whether the user terminal requesting access approval is a legitimate user; The destination IP of the IP (Source IP) of the agent to which the access approval of the IP of the agent installed in the user terminal requesting the access to the corporate network is set in the Mesquared server, and the access permission to the corporate network is set a connection policy setting step of setting a connection policy to (Destination IP) in the Mesquared server; an access approval step of approving, by the security server, access to the internal network of the user terminal for which the connection policy is set in the Mesquared server; and an access step in which the agent accesses the internal network while a packet transmitted from the agent to the internal network is relayed through the mesquared server.

In addition, there is provided a computer-readable recording medium in which a computer program is recorded for performing the above-described method for securing external access to an in-house network.

According to one aspect of the present invention described above, packet relay through the Mesquared server is possible only for the allowed IPs already set in the server, and after the connection is disconnected, the corresponding setting disappears and prior to the reconnection request. Because it cannot connect, only authorized users can access the set IP of the company network.

In addition, unlike unilateral security devices, the policy is not set all the time, and it is set and released only when necessary. It can provide the effect of preventing access or attacks.

The effects of the present invention are not limited to the above-mentioned effects, and various effects may be included within the range apparent to those skilled in the art from the description below.

1 is a diagram schematically showing the configuration of an internal network external access security system according to an embodiment of the present invention.
FIG. 2 is a view for explaining an access step of the internal network external access security system according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating an embodiment of the Mesquared server of FIG. 1 .
4 is a view for explaining the installation of the agent according to the present invention.
FIG. 5 is a view for explaining malware prevention by the malware prevention unit of FIG. 3 .
FIG. 6 is a view for explaining ransomware prevention by the ransomware prevention unit of FIG. 3 .
7 is a view for explaining data leakage prevention by the leakage prevention unit of FIG. 3 .
8 is a flowchart illustrating a method for securing external access to an internal internal network for each individual according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0016] Reference is made to the accompanying drawings, which show by way of illustration specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein with respect to one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a diagram schematically showing the configuration of an internal network external access security system according to an embodiment of the present invention.

Referring to FIG. 1 , the internal network external access security system 10 according to an embodiment of the present invention authorizes only allowed network information to access the internal network 500 and exposes the IP of the internal network 500 . It is implemented to enable safe external access by preventing unintentional access or attacks by preventing it, and includes the agent 100 , the security server 200 , and the Mesquared server 300 .

The agent 100 is installed in at least one or more user terminals 400-1 to 400-N to be connected from the outside to the internal networks 500-1 to 500-N respectively installed in at least one company, respectively, and the network Through (N), the security server 200 requests approval of access to the internal network 500 ((1) of FIG. 2).

Here, the user terminal 400 may be composed of one or more, and is widely used by the general public, such as a desktop computer (PC), as well as a notebook (Notebook), a smart phone (Smart Phone), a tablet computer (Tablet PC), etc. It is a broad concept meaning various types of information communication devices and multimedia devices supporting wired and wireless networks, such as mobile communication terminals.

In addition, the network N may include, for example, wireless communication, wired communication, optical ultrasound, or a combination thereof. BAN (Body Area Network), satellite communication, cellular communication, Bluetooth, Near Field Communication (NFC), IrDA (Infrared Data Association standard), WiFi (Wireless Fidelity), and WiMAX (Worldwide Interoperability for Microwave access) are included in the communication path. Ethernet, Digital Subscriber Line (DSL), Fiber to the Home (FTTH), and Plain Old Telephone Service (POTS) are examples of wired communication that can be included in a communication network. Additionally, the communication network may traverse multiple network topologies and distances. For example, the communication network may include a direct connection, a personal area network (PAN), a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or any combination thereof. In addition, it may be achieved through a low power wide area network including LoRaWAN, NB-Fi, and RPMA. However, as for the network N, the description of the communication network is not limited to the above-described communication network, and any latest data communication network may be applied.

The security server 200 checks whether the user terminal 400 is a political party user, and when it is confirmed that the user terminal 400 is a political party user, requests the setting of a connection policy to the Mesquared server 300 (FIG. 2). In (2)), the user terminal 400 accesses the corporate network 500 according to whether the user terminal 400 determined to be a political party user is approved for access to the corporate network 500 by the mesquared server 300 to approve or block ((4) of FIG. 2).

Mesquared server 300, when an access request is transmitted from the security server 200 to the internal network 500 of the user terminal 400, the agent 100 installed in the user terminal 400 requesting access. After setting the IP access approval, and setting the connection policy to the destination IP (Destination IP) of the IP (Source IP) of the agent 100 for which the access approval to the corporate network 500 is set, the result of the set connection policy is sent to the security server 200 ((3) in FIG. 2), and a packet transmitted from the agent 100 to the internal network 500 ((5), (6) in FIG. 2) is relayed. .

That is, all packets transmitted from the agent 100 to the corporate network 500 arrive at the mesquared server 300 ((5) in FIG. 500) ((6) of FIG. 2).

In addition, only IPs allowed in the corporate network 500 are delivered among the packets that arrive, and in this case, the corporate network 500 is able to communicate because the IP of the Mesquared server 300 is allowed.

In an embodiment, the mesquared server 300 may destroy a connection policy set for the user terminal 400 when the user terminal 400 is disconnected from the corporate network 500 .

At this time, the mesquared server 300, when a connection release request is transmitted from the user terminal 400 or a health check between the user terminal 400 and the user terminal 400 fails, the user terminal 400 and the internal network 500 ) can be considered to have been terminated.

In one embodiment, the Mesquared server 300 may re-establish the connection policy when the connection to the corporate network 500 is approved from the user terminal 400 and the connection approval is requested again after the connection policy expires. have.

In one embodiment, the mesquared server 300 is a destination IP (Destination IP) together with the IP (Source IP) of the agent 100 for which the access approval is set and the port of the agent 100 for which the access approval is set. You can set the connection policy to

The internal network external access security system 10 according to an embodiment of the present invention having the configuration as described above is a packet relay through the mesquared server 300 only for the allowed IPs already set in the server. After the connection is disconnected, the setting disappears and connection cannot be made before the reconnection request, so only authorized users can access the set IP of the internal network.

In addition, unlike unilateral security devices, the policy is not set all the time, and it is set and released only when necessary. Access or attack can be prevented.

FIG. 3 is a diagram illustrating an embodiment of the Mesquared server of FIG. 1 .

Referring to FIG. 3 , the Mesquared server 300a according to an embodiment includes a malware prevention unit 310 , a ransomware prevention unit 320 , and a leak prevention unit 330 .

The anti-malware unit 310 is configured only when the user of the user terminal 400 is read as a legitimate user by the security server 200 and the integrity of the application (AP) to be used in the user terminal 400 is guaranteed. The user terminal 400 allows access to the corporate network 500 .

In one embodiment, the anti-malware unit 310 determines that the integrity of the application (AP) to be used in the user terminal 400 is violated when it is determined that the application (AP) is infected with malware (M) due to binary tampering or DLL injection attack. can judge

In an embodiment, when the malware prevention unit 310 determines that the integrity of the application (AP) to be used in the user terminal 400 is violated and the access to the corporate network 500 is blocked, the user terminal 400 ) may not be restricted for use other than the connection to the internal network 500 .

The malware security method of existing products is a structure that checks the pattern of packets coming into the internal network and filters them if they are similar to known malware patterns.

The biggest problem with the current method is that unknown malware cannot be detected, leaving you directly exposed to threats.

In addition, there are many false positives or over-detections, which often interfere with normal business activities, which greatly reduces work efficiency and lowers reliability.

Since the malware prevention unit 310 according to the present invention filters the packet generation of the network packet at the starting point using the agent 100 using a technology recently called Endpoint Security, it is fundamentally impossible to penetrate. .

When the user of the user terminal 400 is read as a legitimate user by the security server 200 and the application (AP) to be used in the user terminal 400 is allowed to be used, the ransomware prevention unit 320 is Only the user terminal 400 is allowed to access the internal network 500 .

In one embodiment, the ransomware prevention unit 320, when the user terminal 400 intends to use an application (R) that is not allowed to be used other than the application (AP) that is allowed to be used, the user terminal 400 is Access to the network 500 may be blocked.

In general, ransomware is executed with a separate process, which is not an allowed application but a separate application, so it is impossible to access the internal network 500 .

Although there is no case of occurrence yet, since an attempt to penetrate in the manner of malware also violates integrity, the ransomware prevention unit 320 can also prevent penetration by using an anti-malware technology.

Although there are various ransomware security methods of existing products, a separate file server is established for ransomware security, which is mainly used, or an application that frequently finds and backs up business files on business equipment is used. These methods require a lot of cost for introduction and maintenance, use a lot of resources of work equipment, reduce work efficiency, and complete trust is also difficult.

The ransomware prevention unit 320 according to the present invention cannot fundamentally penetrate into a business server by using an endpoint security technology like malware.

In addition, since the agent 100 operates in the kernel area, it uses very few resources of the work equipment and can operate quickly.

The leak prevention unit 330 limits the scope of task performance so that the user terminal 400 accessing the internal network 500 can perform the task only within the scope of the set leak security policy.

In an embodiment, the agent 100 may be installed in a kernel space of the user terminal 400 as shown in FIG. 4 .

In an embodiment, the agent 100 may be installed simultaneously in a user space and a kernel space of the user terminal 400 as shown in FIG. 4 .

In one embodiment, the leak prevention unit 330, the application (AP) being used in the user terminal 400 using a system call (System Call) to the kernel (Kernel) via the agent 100 calls a kernel function Restrictions can be set on the scope of work so that work can be performed only within the scope of the policy set at the time.

In one embodiment, the leak prevention unit 330, as shown in Fig. 7, the application (AP) being used in the user terminal 400 using a system call (System Call) via the agent 100 to the kernel When calling a kernel function with (Kernel), the scope of task execution so that tasks can be performed only within the scope of the preset policy (that is, at least one or more of "file storage", "print", and "screen capture" to be described later) limits can be set.

In an embodiment, the leak prevention unit 330 may block the leak by filtering the return value of the kernel function transmitted from the kernel to the application (AP) being used in the user terminal 400 via the agent 100 . .

In one embodiment, the leakage prevention unit 330, "file storage", "print", and "screen capture" for at least one or more functions of the application (AP) being used in the user terminal 400 for performing the task. You can set limits on the range.

In the past, many and huge systems have been introduced, such as using several separate applications such as restricting USB to prevent leakage, and separating networks to prevent leakage at the source.

The leak prevention unit 330 according to the present invention, through a paradigm shift, identifies an exact target through endpoint security, network security and convergence and secures only the target, so that simple and accurate security is possible and the resources of business equipment are conserved. Since it uses very little compared to the existing one, it can be possible to maximize work efficiency.

The in-house network external access security system having the above-described configuration may execute or manufacture various software based on an operating system (OS), that is, the system. The operating system is a system program for software to use the hardware of the device, and is a mobile computer operating system such as Android OS, iOS, Windows Mobile OS, Bada OS, Symbian OS, Blackberry OS and Windows series, Linux series, Unix series, It can include all computer operating systems such as MAC, AIX, and HP-UX.

A method for securing external access to the internal network by each configuration of the internal network external access security system having the above-described configuration will be described later in the method description below with reference to FIG. 8 .

8 is a flowchart illustrating a method for securing external access to an internal internal network for each individual according to an embodiment of the present invention.

Referring to FIG. 8 , in the method for securing external access to an individual internal network according to an embodiment of the present invention, first, the user terminal 400 requests access to the internal network 500 installed in the company from the outside (S110) .

The security server 200 checks whether the user terminal 400 requesting access approval is a legitimate user (S120).

Access approval of the IP of the agent 100 installed in the user terminal 400 requesting access to the internal network 500 is set in the Mesquarade server 300, and the access approval to the internal network 500 is set A connection policy of the IP (Source IP) of the agent 100 to the Destination IP (Destination IP) is set in the Mesquared Server 300 (S130).

The security server 200 approves the access to the corporate network 500 of the user terminal 400 for which the connection policy is set in the mesquared server 300 (S140).

While a packet transmitted from the agent 100 to the company network 500 passes through the mesquared server 300 (Relay), the agent 100 accesses the company network 500 (S150).

The term '~ unit' used in the above embodiments means software or hardware components such as field programmable gate array (FPGA) or ASIC, and '~ unit' performs certain roles. However, '-part' is not limited to software or hardware. '~unit' may be configured to reside on an addressable storage medium or may be configured to refresh one or more processors. Thus, as an example, '~' denotes components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, and procedures. , subroutines, segments of program patent code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

Functions provided in components and '~ units' may be combined into a smaller number of components and '~ units' or separated from additional components and '~ units'.

In addition, components and '~ units' may be implemented to play one or more CPUs in a device or secure multimedia card.

The internal network external access security method according to the present invention may also be implemented in the form of a computer-readable medium for storing instructions and data executable by a computer. In this case, the instructions and data may be stored in the form of program codes, and when executed by the processor, a predetermined program module may be generated to perform a predetermined operation. In addition, computer-readable media can be any available media that can be accessed by a computer, and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer readable medium may be a computer recording medium, which is a volatile and non-volatile and non-volatile embodied in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. It may include both volatile, removable and non-removable media. For example, the computer recording medium may be a magnetic storage medium such as HDD and SSD, an optical recording medium such as CD, DVD, and Blu-ray disc, or a memory included in a server accessible through a network.

The internal network external access security method according to the present invention may be implemented as a computer program (or computer program product) including instructions executable by a computer. The computer program includes programmable machine instructions processed by a processor, and may be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language. . In addition, the computer program may be recorded in a tangible computer-readable recording medium (eg, a memory, a hard disk, a magnetic/optical medium, or a solid-state drive (SSD), etc.).

The internal network external access security method according to the present invention may be implemented by executing the computer program as described above by a computing device. The computing device may include at least a portion of a processor, a memory, a storage device, a high-speed interface connected to the memory and the high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using various buses, and may be mounted on a common motherboard or mounted in any other suitable manner.

Here, the processor may process commands within the computing device, such as for displaying graphic information for providing a Graphical User Interface (GUI) on an external input or output device, such as a display connected to a high-speed interface. Examples are instructions stored in memory or a storage device. In other embodiments, multiple processors and/or multiple buses may be used with multiple memories and types of memory as appropriate. In addition, the processor may be implemented as a chipset formed by chips including a plurality of independent analog and/or digital processors.

Memory also stores information within the computing device. As an example, the memory may be configured as a volatile memory unit or a set thereof. As another example, the memory may be configured as a non-volatile memory unit or a set thereof. The memory may also be another form of computer readable medium such as, for example, a magnetic or optical disk.

In addition, the storage device may provide a large-capacity storage space to the computing device. The storage device may be a computer-readable medium or a component comprising such a medium, and may include, for example, devices or other components within a storage area network (SAN), a floppy disk device, a hard disk device, an optical disk device, Alternatively, it may be a tape device, a flash memory, or other semiconductor memory device or device array similar thereto.

The above-described embodiments are for illustration, and those of ordinary skill in the art to which the above-described embodiments belong can easily transform into other specific forms without changing the technical idea or essential features of the above-described embodiments. You will understand. Therefore, it should be understood that the above-described embodiments are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and likewise components described as distributed may also be implemented in a combined form.

The scope to be protected through this specification is indicated by the claims described below rather than the above detailed description, and should be construed to include all changes or modifications derived from the meaning and scope of the claims and their equivalents. .

10: Internal network external access security system
100: agent
200: security server
300, 300a: Mesquared Server
310: anti-malware unit
320: ransomware prevention unit
330: leak prevention unit
400: user terminal
500: in-house network

Claims (10)

It relates to a security system for external access to the internal network implemented to allow safe external access by allowing only permitted network information to access the internal network and preventing unintended access or attacks by preventing IP exposure of the internal network,
an agent installed in a user terminal to access the internal network installed in the company from the outside;
a security server that confirms whether the user terminal is a legitimate user, and approves or blocks access of the user terminal to the internal network according to whether the user terminal determined as a political party user approves access to the internal network; and
When an access request is transmitted from the security server to the internal network of the user terminal, the agent sets access approval for the IP of the agent installed in the user terminal requesting access, and the agent for which access approval to the corporate network is set After setting the connection policy from the IP (Source IP) to the destination IP (Destination IP) of ) to the Mesquared server; including,
The Mesquared server,
a malware prevention unit allowing the user terminal to access the corporate network only when the user of the user terminal is read as a legitimate user by the security server and the integrity of the application to be used in the user terminal is guaranteed;
A ransomware prevention unit that allows the user terminal to access the corporate network only when the user of the user terminal is read as a legitimate user by the security server and the application to be used in the user terminal is permitted ; and
and a leak prevention unit that limits the scope of business performance so that the user terminal, which is working by accessing the internal network, can perform the business only within the scope of the set leakage security policy; and
The agent is
It is installed in the kernel space of the user terminal,
The leak prevention unit,
When the application being used in the user terminal uses a system call to call a kernel function to the kernel via the agent using a system call, the scope of task execution is limited so that the task can be performed only within the scope of a preset policy. to set,
The anti-malware unit,
If it is determined that the application (AP) to be used in the user terminal is infected with malware (M) due to binary tampering or DLL injection attack, it is determined that integrity is violated,
The anti-malware unit,
When the access to the internal network is blocked because it is determined that the integrity of the application (AP) to be used in the user terminal is violated, there is no restriction on the use of the user terminal other than the access to the internal network,
The leak prevention unit,
An internal network external access security system for setting a limit on the scope of work performance of an application (AP) being used in the user terminal with respect to at least one or more functions of "save file", "print", and "screen capture".
The method of claim 1, wherein the Mesquared server,
When the user terminal terminates the connection to the in-house network, the connection policy set for the user terminal is destroyed, the internal network external access security system.
The method of claim 2, wherein the Mesquared server,
When access to the internal network is approved from the user terminal and access approval is requested again after the connection policy expires, the internal network external access security system for re-establishing a connection policy.
The method of claim 2, wherein the Mesquared server,
When a connection release request is transmitted from the user terminal or a health check fails between the user terminal and the user terminal, it is considered that the connection between the user terminal and the in-house network is terminated.
The method of claim 1, wherein the Mesquared server,
A system for setting a connection policy to a destination IP (Destination IP) together with the IP (Source IP) of the agent for which access approval is set and the port (Port) of the agent for which access approval is set.
delete delete delete delete delete

Images