KR102531376B1 - System for monitoring information security and network security based on network connection and method thereof - Google Patents

Abstract

The present invention discloses a network connection-based information and network security control system and method. That is, the present invention collects user logs, user data, etc. related to a terminal attempting access, analyzes the collected user logs, user data, etc. to create a user behavior pattern, and the generated user behavior pattern turns into an abnormal behavior pattern. If it is confirmed, by forcibly blocking the access of the corresponding terminal, it is possible to provide the best information security environment and highly convenient operation and work environment through information security consulting suitable for the customer's operating environment.

Description

System for monitoring information security and network security based on network connection and method thereof}

The present invention relates to a network connection-based information and network security control system and method, and in particular, collects user logs and user data related to a terminal attempting access, analyzes the collected user logs and user data, and A network connection-based information and network security control system and method for generating a behavior pattern and forcibly blocking access of a corresponding terminal when the generated user behavior pattern is identified as an abnormal behavior pattern.

Network security refers to the means of preventing unauthorized users from accessing the network and preventing access by accidental or intentional methods.

Such network security is treated as an important issue to protect the company network against hacking attempts.

Korean Publication No. 10-2020-0098181 [Title: Network Security System by Integrated Security Network Card]

An object of the present invention is to collect user logs, user data, etc. related to a terminal attempting access, analyze the collected user logs, user data, etc. to create a user behavior pattern, and the generated user behavior pattern turns into an abnormal behavior pattern. It is to provide a network connection-based information and network security control system and method for forcibly blocking the access of the corresponding terminal when confirmed.

Another object of the present invention is to detect a virus, DDoS attack, hacking attempt, etc. in a specific terminal among a plurality of terminals connected to a network-separated internal network, targeting all the plurality of terminals connected to the internal network related to the specific terminal. It is to provide a network connection-based information and network security control system and method for forcibly installing a patch program in response to a corresponding virus, DDoS attack, hacking attempt, etc.

Another object of the present invention is to, when an external terminal attempts to access another terminal among a plurality of terminals connected to a network-separated internal network, register the log record of the terminal in the block chain after performing authentication on the terminal To provide a network connection-based information and network security control system and method for distributing and storing files uploaded or downloaded from a corresponding terminal to another terminal in IPFS.

A network connection-based information and network security control system according to an embodiment of the present invention includes a specific terminal among a plurality of terminals connected to an internal network attempting access to another terminal connected to an external network; and collecting user logs and user data related to the specific terminal, analyzing the collected user logs and user data related to the user of the specific terminal to generate a user behavior pattern related to the user of the specific terminal, and generating the user behavior pattern When the behavior pattern is not normal, a monitoring device may be configured to determine that an access attempt in the specific terminal is abnormal and to block access from the specific terminal to other terminals.

As an example related to the present invention, the user log includes at least one of an IP address of the specific terminal, a destination IP address to be accessed, access date and time information, and information on an app running in the specific terminal, and The data may include at least one of attendance time information, leave time information, annual leave information, class information, and business trip information related to the user of the specific terminal.

In the network connection-based information and network security control method according to an embodiment of the present invention, when a specific terminal among a plurality of terminals connected to an internal network attempts to access another terminal connected to an external network by a monitoring device, the specific Collecting user logs and user data related to the terminal; generating a user behavior pattern related to the user of the specific terminal by analyzing the collected user log and user data related to the user of the specific terminal by the monitoring device; and when the user behavior pattern is not a normal behavior pattern, confirming, by the monitoring device, that an access attempt in the specific terminal is abnormal, and blocking access from the specific terminal to other terminals. .

As an example related to the present invention, in the step of generating a user behavior pattern related to the user of the specific terminal, the collected user log and user data related to the user of the specific terminal are used as input values of a pre-learned user behavior pattern analysis model. Accordingly, machine learning may be performed, and a user behavior pattern related to the user of the specific terminal may be generated based on the machine learning result.

Collecting a plurality of packets transmitted and received through a communication network by the monitoring device as an example related to the present invention; and when at least one of virus infection/distribution, DDoS attack, and hacking attempt for the specific terminal is detected by the monitoring device based on the collected plurality of packets, all connected to the internal network related to the specific terminal The method may further include forcibly installing a patch program corresponding to at least one of virus infection/distribution, DDoS attack, and hacking attempt to a plurality of terminals.

Collecting a plurality of packets transmitted and received through a communication network by the monitoring device as an example related to the present invention; analyzing a network environment based on the collected plurality of packets by the monitoring device, and identifying network security equipment required between specific components in a currently configured network topology; and generating notification information related to network security equipment required between the identified specific components by the monitoring device, and transmitting the generated notification information to an administrator terminal managing an internal network where the corresponding network security equipment is located. It may further include steps to do.

As an example related to the present invention, based on the collected user data related to the specific terminal, in a state in which the user of the specific terminal is not at the place where the specific terminal is located due to any one of before going to work, after work, half leave, annual leave and business trip When the specific terminal connects to another terminal connected to an external network and attempts to transmit one or more files stored in the specific terminal to the other terminal, encryption and decryption preset in relation to the specific terminal by the monitoring device encrypting the one or more files based on a key for; Transmitting, by the monitoring device, the one or more encrypted files to the other terminal; receiving, by the other terminal, the one or more encrypted files; decrypting, by the other terminal, the one or more received encrypted files based on a key for encryption and decryption preset in relation to the specific terminal; and displaying the one or more decrypted files by the other terminal.

As an example related to the present invention, when the validity period is set for the one or more received encrypted files, by the other terminal, the one or more received encrypted files being stored in the other terminal after the validity period has elapsed and automatically deleting one or more decrypted files.

As an example related to the present invention, the one or more file transfer information related to one or more files transmitted from the specific terminal to the other terminal by the monitoring device in conjunction with the blockchain server and the link information from the other terminal storing download management information related to downloading of the above files in a block; Receiving, by the monitoring device, a transaction processing result transmitted from the blockchain server; and storing the received transaction processing result by the monitoring device.

As an example related to the present invention, when an external terminal attempts to access the specific terminal within the internal network, performing authentication on the external terminal by the monitoring device; allowing access to the specific terminal from the external terminal, by the monitoring device, when authentication of the external terminal succeeds; and information on an upload file uploaded from the external terminal to the specific terminal by the monitoring device, information on a download file downloaded from the external terminal from the specific terminal, access date and time information of the external terminal, and the The method may further include storing a log record including at least one of used app information in an external terminal in another block in a blockchain server.

The present invention collects user logs, user data, etc. related to a terminal attempting access, analyzes the collected user logs, user data, etc. to create a user behavior pattern, and the generated user behavior pattern is identified as an abnormal behavior pattern. In this case, by forcibly blocking the connection of the corresponding terminal, it is possible to provide the best information security environment and highly convenient operation and work environment through information security consulting suitable for the operating environment of the customer.

In addition, when a virus, DDoS attack, hacking attempt, etc. is detected in a specific terminal among a plurality of terminals connected to a network-separated internal network, the present invention targets all the plurality of terminals connected to the internal network related to the specific terminal. By forcibly installing a patch program that responds to viruses, DDoS attacks, hacking attempts, etc., the network environment is separated to secure high security, and business continuity and convenience are provided through the establishment of high-performance network linkage. It has the effect of protecting the infrastructure and providing a reliable service network.

In addition, in the present invention, when an external terminal attempts to access another terminal among a plurality of terminals connected to a network-separated internal network, after performing authentication on the corresponding terminal, the log record of the corresponding terminal is registered in the blockchain, and the By storing files uploaded or downloaded from a terminal to other terminals in IPFS, an external terminal accesses the internal network and then uploads the file to IPFS instead of directly transmitting the file to other terminals, and then uploads the link information from the other terminal. Instead of downloading the file uploaded to the corresponding IPFS and directly receiving the file to be downloaded from another terminal, the file uploaded to the IPFS from another terminal is downloaded through the link information in the corresponding terminal. There is an effect of providing enhanced security for the terminal.

1 is a block diagram showing the configuration of a network linkage-based information and network security control system according to an embodiment of the present invention.
2 and 3 are flowcharts illustrating a network connection-based information and network security control method according to an embodiment of the present invention.

It should be noted that technical terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. In addition, technical terms used in the present invention should be interpreted in terms commonly understood by those of ordinary skill in the art to which the present invention belongs, unless specifically defined otherwise in the present invention, and are excessively inclusive. It should not be interpreted in a positive sense or in an excessively reduced sense. In addition, when the technical terms used in the present invention are erroneous technical terms that do not accurately express the spirit of the present invention, they should be replaced with technical terms that those skilled in the art can correctly understand. In addition, general terms used in the present invention should be interpreted as defined in advance or according to context, and should not be interpreted in an excessively reduced sense.

Also, singular expressions used in the present invention include plural expressions unless the context clearly dictates otherwise. Terms such as "consisting of" or "comprising" in the present invention should not be construed as necessarily including all of the various elements or steps described in the invention, and some of the elements or steps may not be included. It should be construed that it may, or may further include additional components or steps.

In addition, terms including ordinal numbers such as first and second used in the present invention may be used to describe components, but components should not be limited by the terms. Terms are used only to distinguish one component from another. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted.

In addition, in describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description will be omitted. In addition, it should be noted that the accompanying drawings are only for easily understanding the spirit of the present invention, and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

1 is a block diagram showing the configuration of a network connection-based information and network security control system 10 according to an embodiment of the present invention.

As shown in FIG. 1, the network connection-based information and network security control system 10 is composed of a plurality of terminals 100, a plurality of other terminals 200, an external terminal 300, and a monitoring device 400. do. Not all of the components of the network connection-based information and network security control system 10 shown in FIG. 1 are essential components, and network connection-based information and network The security control system 10 may be implemented, or the network linkage-based information and network security control system 10 may be implemented with fewer components.

The terminal 100, the other terminal 200, the external terminal 300, and the monitoring device 400 include a smart phone, a portable terminal, a mobile terminal, and a foldable terminal. A foldable terminal, a personal digital assistant (PDA), a portable multimedia player (PMP) terminal, a telematics terminal, a navigation terminal, a personal computer, a notebook computer, a slate PC ( Slate PC), tablet PC (Tablet PC), ultrabook, wearable device (e.g., watch type terminal (Smartwatch), glass type terminal (Smart Glass), HMD (Head Mounted Display), etc. included) ), Wibro terminal, IPTV (Internet Protocol Television) terminal, smart TV, digital broadcasting terminal, AVN (Audio Video Navigation) terminal, A/V (Audio/Video) system, flexible terminal, digital between It can be applied to various terminals such as Nizi devices and kiosks.

In addition, the monitoring device 400 may be configured as a server (not shown), and when the monitoring device 400 is configured as a server, the corresponding server may be implemented in the form of a web server, database server, proxy server, or the like. can In addition, one or more of a network load balancing mechanism and various software enabling the corresponding server to operate on the Internet or other networks may be installed in the server, and through this, it may be implemented as a computerized system. Also, the network can be an http network, a private line, an intranet or any other network. Furthermore, the connection between the terminal 100, the other terminal 200, the external terminal 300 and the server (or the monitoring device 400) is a secure network to prevent data from being attacked by any hacker or other third party. can be connected with In addition, the server may include a plurality of database servers, and these database servers may be implemented in a manner that is separately connected to the server through any type of network connection including a distributed database server architecture.

Each of the terminal 100, the other terminal 200, the external terminal 300, and the monitoring device 400 includes a communication unit (not shown) for performing a communication function with other terminals, various information and programs ( or application) for storing a storage unit (not shown), a display unit (not shown) for displaying various information and program execution results, and an audio output unit (not shown) for outputting audio information corresponding to the various information and program execution results. (not shown), and a control unit (not shown) for controlling various components and functions of each terminal.

As shown in FIG. 1, the plurality of terminals 100 including the terminal 100 form one internal network (or internal network/intranet), and a plurality of terminals including the other terminals 200 Another terminal 200 forms another internal network.

In the embodiment of the present invention, for convenience of description, the terminal 100 and the other terminal 200 are separately described, but the corresponding terminal 100 and the other terminal 200 belong to a specific internal network. , and can communicate with the terminals 100 and 200 included in other internal networks located outside or independently communicate with the external terminal 300 connected to the communication network.

In addition, between the internal networks (or between the terminals 100, 200, 300, 400), a firewall, UTM (Unified Threat Management), APT (Advanced Persistent Threats), IPS (Intrusion Prevention) System: Intrusion prevention system), SSL VPN (Secure Sockets Layer Virtual Private Network: SSL-based virtual private network), such as network security equipment (not shown) may be configured. At this time, the firewall (or the network security equipment) is a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is configured to control traffic between networks.

The terminal 100 configures (or includes) an arbitrary internal network (or internal network/intranet). At this time, the user of the terminal 100 may belong to an arbitrary group (eg, a company, a public institution, etc.) and may use an internal network configured in the group.

In addition, the terminal 100 includes a plurality of terminals 100 configured in the corresponding internal network, a plurality of other terminals 200 configured in the external internal network, an external independent external terminal 300, the monitoring device 400, etc. communicate

When the terminal 100 included in the internal network attempts to access any terminal 100 within the corresponding internal network, or when attempting to access the other terminal 200 connected to the external network, connected to the external network When trying to access the external terminal 300, the terminal 100 accesses the terminal 100 connected to the internal network according to the control (or management) of the monitoring device 400, the corresponding terminal 100 ) performs access to another terminal 200 connected to the external network, access from the corresponding terminal 100 to the external terminal 300, or the like, or ends.

That is, when the terminal 100 included in the internal network attempts to access any terminal 100 within the corresponding internal network, or when attempting to access the other terminal 200 connected to the external network, the external network When trying to access the external terminal 300 connected to the terminal 100, the user behavior pattern related to the terminal 100 is a normal behavior pattern according to the control (or management) of the monitoring device 400. , access to the terminal 100 connected to the internal network, access from the terminal 100 to another terminal 200 connected to the external network, access from the terminal 100 to the external terminal 300, etc. Do it.

In addition, when the terminal 100 included in the internal network attempts to access any terminal 100 within the corresponding internal network, or when attempting to access the other terminal 200 connected to the external network, the external network When trying to access the external terminal 300 connected to the terminal 100, the user behavior pattern related to the terminal 100 is a normal behavior pattern according to the control (or management) of the monitoring device 400. If not confirmed (or if the corresponding user behavior pattern is identified as an abnormal behavior pattern), access to the terminal 100 connected to the internal network, access from the corresponding terminal 100 to another terminal 200 connected to the external network, The connection from the terminal 100 to the external terminal 300 is terminated (or blocked/rejected).

In addition, when a virus infection/distribution, DDoS attack, hacking attempt, etc. occurs in the terminal 100 included in the internal network, a plurality of terminals 100 (or one or more terminals 100 included in the internal network) )) temporarily blocks access to an external network under the control of the monitoring device 400, and installs patch programs corresponding to virus infection/distribution, DDoS attacks, hacking attempts, and the like.

In addition, the terminal 100 in which the patch program is installed can access an external network under the control of the monitoring device 400 .

In addition, the terminal 100 transmits/receives various information (or data/packets) to the other connected terminal 200 and the external terminal 300.

In addition, for remote management, when the external terminal 300 attempts to access the terminal 100 within the internal network and the monitoring device 400 successfully authenticates the external terminal 300, the external terminal 300 is successfully authenticated. The terminal 100 performs access (or communication/connection) with the external terminal 300 .

In addition, the terminal 100 transmits/receives various information with the connected external terminal 300 .

In this way, the terminal 100 can maintain a normal communication state with one or more terminals 100, 200, and 300 in the case of a normal use pattern by interworking with the monitoring device 400, and in the case of an abnormal use pattern, the corresponding one The communication state with the above terminals 100, 200, and 300 is terminated.

The other terminal 200 configures (or includes) any other internal network (or other internal network/other intranet). At this time, the user of the other terminal 200 may belong to any other group (eg, a company, public institution, etc.) and may use an internal network configured in the other group.

In addition, the other terminals 200 include a plurality of other terminals 200 configured in the corresponding other internal network, a plurality of terminals 100 configured in the external internal network, an external independent external terminal 300, and the monitoring device 400 ) and communicate with others.

In addition, when the other terminal 200 included in the other internal network attempts to access any other terminal 200 of the corresponding other internal network, or when attempting to access the terminal 100 connected to the external network , When an attempt is made to access the external terminal 300 connected to the external network, the other terminal 200, under the control (or management) of the monitoring device 400, another terminal 200 connected to the other internal network ), access from the other terminal 200 to the terminal 100 connected to the external network, or access from the other terminal 200 to the external terminal 300, or the like is terminated.

That is, when the other terminal 200 included in the other internal network attempts to access any other terminal 200 of the corresponding other internal network, or when attempting to access the terminal 100 connected to the external network , When attempting to access the external terminal 300 connected to the external network, the other terminal 200 performs a user action related to the other terminal 200 according to the control (or management) of the monitoring device 400. If the pattern is confirmed as a normal behavior pattern, access to the other terminal 200 connected to the other internal network, access from the other terminal 200 to the terminal 100 connected to the external network, and the other terminal 200 to the above Connection to the external terminal 300 is performed.

In addition, when the other terminal 200 included in the other internal network attempts to access any other terminal 200 of the corresponding other internal network, or when attempting to access the terminal 100 connected to the external network , When attempting to access the external terminal 300 connected to the external network, the other terminal 200 performs a user action related to the other terminal 200 according to the control (or management) of the monitoring device 400. If the pattern is not confirmed as a normal behavior pattern (or if the corresponding user behavior pattern is identified as an abnormal behavior pattern), access to another terminal 200 connected to the other internal network, and from the other terminal 200 connected to the external network The connection to the terminal 100 and the connection from the other terminal 200 to the external terminal 300 are terminated (or blocked/rejected).

In addition, based on the collected user data related to the terminal 100, the location where the terminal 100 is located (for example, an office In the case of attempting to transmit one or more files stored in the terminal 100 to the other terminal 200 by accessing from the terminal 100 to another terminal 200 connected to the external network in a state where the terminal 100 is not present (including etc.) ( or in case of transmission), the other terminal 200, under the control of the monitoring device 400, the validity period (for example, 1 day), the number of decryption (for example, 3 times), the encryption process, etc. are applied. Receive more than one file.

In addition, the other terminal 200 decrypts the received one or more encrypted files based on a key for encryption and decryption preset in relation to the corresponding terminal 100, and displays the one or more decrypted files (or store/manage). At this time, the key for encryption and decryption preset in relation to the terminal 100 may be stored in advance in the corresponding other terminal 200 or may be provided after an authentication process with the corresponding monitoring device 400 is performed.

In addition, when the validity period is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 is stored in the other terminal 200 after the validity period has elapsed. The received one or more encrypted files and one or more decrypted files are automatically deleted.

In addition, when the number of times of decryption is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 may set the number of times of decryption or more for the one or more received encrypted files. It is configured (or controlled/managed) so that the decryption function is not performed, and the encrypted file may be automatically deleted if the decryption function is attempted more than the number of times of decryption.

In addition, when virus infection/distribution, DDoS attack, hacking attempt, etc. occur in the other terminals 200 included in the internal network, a plurality of other terminals 200 (or one or more other terminals 200 included in the internal network) Under the control of the monitoring device 400, the terminal 200 temporarily blocks access to an external network, and installs patch programs corresponding to virus infection/distribution, DDoS attacks, hacking attempts, and the like.

In addition, another terminal 200 having the patch program installed may access an external network under the control of the monitoring device 400 .

In addition, the other terminal 200 transmits/receives various information (or data/packets) to the connected terminal 100 and the external terminal 300.

In addition, for remote management, when the external terminal 300 attempts to access the other terminal 200 within the internal network, and the monitoring device 400 successfully authenticates the external terminal 300, The other terminal 200 performs access (or communication/connection) with the external terminal 300 .

In addition, the other terminal 200 transmits/receives various information with the connected external terminal 300.

In this way, the other terminal 200 can maintain a normal communication state with one or more terminals 100, 200, and 300 in the case of a normal use pattern by interworking with the monitoring device 400, and in the case of an abnormal use pattern, the corresponding A communication state with one or more terminals 100, 200, and 300 is terminated.

The external terminal 300 does not configure any internal network (or internal network/intranet), and a plurality of terminals 100 configured in an external internal network in an independent state, and a plurality of other terminals configured in an external internal network ( 200), communicates with the monitoring device 400, and the like.

At this time, the external terminal 300 may be an Internet of Things (IoT) device (not shown), and may include a motion sensor, a temperature sensor, a heating/cooling sensor, a door or window monitoring (opening and closing) sensor, a smart humidifier, and a CCTV , smart refrigerators, smart phones, tablet PCs, boilers, TVs, and the like. These IoT devices can be distributed in a network supporting IoT services, monitor the status and surrounding environment in the network in real time, and report through the network.

In addition, when the external terminal 300 attempts to access any terminal 100 included in the external network, the external terminal 300 attempts to access any other terminal 200 included in the external network. In this case, the external terminal 300 is connected to the terminal 100 connected to the external network from the external terminal 300 according to the control (or management) of the monitoring device 400, the external terminal 300 In , connection to another terminal 200 connected to the external network is performed or terminated.

That is, when the external terminal 300 attempts to access any terminal 100 included in the external network, the external terminal 300 attempts to access any other terminal 200 included in the external network. In this case, the external terminal 300, according to the control (or management) of the monitoring device 400, when the user behavior pattern related to the external terminal 300 is confirmed as a normal behavior pattern, the external terminal 300 , access to the terminal 100 connected to the external network, and access from the external terminal 300 to another terminal 200 connected to the external network are performed.

In addition, when the external terminal 300 attempts to access any terminal 100 included in the external network, the external terminal 300 attempts to access any other terminal 200 included in the external network. In this case, the external terminal 300, according to the control (or management) of the monitoring device 400, if the user behavior pattern related to the external terminal 300 is not confirmed as a normal behavior pattern (or the corresponding user behavior pattern If this abnormal behavior pattern is confirmed), the connection from the external terminal 300 to the terminal 100 connected to the external network, and the connection from the external terminal 300 to another terminal 200 connected to the external network are terminated. (or block/deny).

In addition, based on the collected user data related to the terminal 100, the location where the terminal 100 is located (for example, an office In the case of attempting to transmit one or more files stored in the terminal 100 to the external terminal 300 by accessing the external terminal 300 connected to the external network from the terminal 100 in a state where there is no (including etc.) ( or in case of transmission), the external terminal 300, under the control of the monitoring device 400, the validity period (eg, 1 day), the number of decryption (eg, 3 times), the encryption process, etc. are applied. Receive more than one file.

In addition, the external terminal 300 decrypts the received one or more encrypted files based on a key for encryption and decryption preset in relation to the corresponding terminal 100, and displays the one or more decrypted files (or store/manage). At this time, the key for encryption and decryption preset in relation to the terminal 100 may be stored in advance in the corresponding external terminal 300 or may be provided after an authentication process with the corresponding monitoring device 400 is performed.

In addition, when the validity period is set for the one or more received encrypted files (or the one or more received files), the external terminal 300 is stored in the external terminal 300 after the validity period has elapsed. The received one or more encrypted files and one or more decrypted files are automatically deleted.

In addition, when the number of times of decryption is set for the one or more received encrypted files (or the one or more received files), the external terminal 300 may set the number of times of decryption or more for the one or more received encrypted files. It is configured (or controlled/managed) so that the decryption function is not performed, and the encrypted file may be automatically deleted if the decryption function is attempted more than the number of times of decryption.

In addition, when virus infection/distribution, DDoS attack, hacking attempt, etc. occur in the external terminal 300, the external terminal 300 is controlled by the monitoring device 400 to access the external network. Temporarily block it, and install a patch program to respond to virus infection/distribution, DDoS attack, hacking attempt, etc.

In addition, the external terminal 300 in which the patch program is installed can access an external network under the control of the monitoring device 400 .

In addition, the external terminal 300 transmits/receives various information (or data/packets) to the connected terminal 100 and other terminals 200 and the like.

In addition, for remote management, when the external terminal 300 attempts to access another specific terminal 100 within the internal network, the external terminal 300 performs an authentication process by the monitoring device 400. do.

If the external terminal 300 fails to authenticate, the external terminal 300 is blocked from accessing the specific terminal 100 under the control of the monitoring device 400 .

In addition, when authentication of the external terminal 300 is successful, the external terminal 300 performs an access function to the specific terminal 100 under the control of the monitoring device 400 .

The monitoring device 400 communicates with the terminal 100 , the other terminal 200 , and the external terminal 300 . In this case, the monitoring device 400 may be included in an internal network constituting the plurality of terminals 100 and an internal network constituting the plurality of other terminals 200 .

In addition, the monitoring device 400 can be configured between the corresponding external terminal 300 and the terminal 100 / the other terminal 200 .

In the embodiment of the present invention, it has been described that the monitoring device 400 is configured in a standalone form, but is not limited thereto, and various functions provided by the monitoring device 400 are applied in the form of applications (eg, For example, products installed on servers, PCs, etc., changes in access ports defined during installation, installation possible only with an administrator account, license issuance type, etc.), switch or sensor type (eg aggregation tap, bridge (for example, aggregation tap), bridge ( It is a product in the form of a bridge) or switch, and can be configured with management IP (management IP) settable but not connected (including configuration, etc.).

In addition, the monitoring device 400 may provide various functions provided by the corresponding monitoring device 400 in the form of a USB installation file or an online download.

In addition, a firewall, a switch, and the like may be configured between the terminal 100, the other terminal 200, the external terminal 300, and the monitoring device 400.

In addition, when a specific terminal 100 among a plurality of terminals 100 connected to the internal network tries to access the terminal 100 connected to the internal network or when trying to access another terminal 200 connected to the external network Alternatively, when access to the external terminal 300 is attempted, the monitoring device 400 collects user logs and user data related to the corresponding terminal 100 . At this time, the monitoring device 400 is configured to collect packets (or data/information) transmitted/received between the plurality of devices 100, 200, and 300 in the entire network topology. Here, the user log includes the IP address (or source IP address) of the specific terminal 100, the destination IP address to be accessed (or the IP address of the other terminal 200/external terminal 300), the access date and It includes time information, information on an app running in the specific terminal 100, and the like. In addition, the user data includes information about the time of arrival, time of leaving, annual leave information, class information, and business trip information related to the user of the specific terminal 100 . At this time, the monitoring device 400 may collect user data for each terminal from an administrator terminal (not shown) managing the corresponding internal network or a database (not shown) related to the internal network.

In addition, the monitoring device 400 analyzes the collected user logs and user data related to the user of the corresponding terminal 100 and generates a user behavior pattern related to the user of the corresponding terminal 100 .

At this time, the monitoring device 400 performs artificial intelligence-based machine learning based on the collected user log, user data, etc. related to the user of the corresponding terminal 100, and based on the machine learning result, the corresponding terminal 100 ) may generate (or calculate/calculate/set/determine) a user behavior pattern related to the user.

That is, the monitoring device 400 performs machine learning (or artificial intelligence/deep learning) by using the collected user log, user data, etc. ), and based on the machine learning result (or artificial intelligence result/deep learning result), a user behavior pattern related to the user of the terminal 100 is generated.

In addition, the monitoring device 400 determines (or confirms) whether the generated user behavior pattern is a preset normal behavior pattern.

That is, the monitoring device 400 determines whether the generated user behavior pattern is included in a preset normal behavior policy.

For example, the monitoring device 400 monitors the corresponding terminal 100 when the user of the terminal 100 whose generated user behavior pattern is a preset normal behavior policy is in use while the user of the corresponding terminal 100 is in an office state. It is determined whether or not the corresponding terminal 100 is trying to access the internal network or the external network while the user of the user is at work.

For another example, the monitoring device 400 may monitor the corresponding terminal 100 when the user of the terminal 100 whose generated user behavior pattern is a preset abnormal behavior policy is using the terminal 100 while leaving work. ) When the user of the terminal 100 attempts to access the internal network or the external network while the user is away from work, the user of the terminal 100 is in use for half a day, uses an annual leave, is on a business trip, is on sick leave, etc. It is determined whether it corresponds to the case where the corresponding terminal 100 attempts to access the internal network or the external network in the empty state.

As a result of the determination (or the confirmation result), when the user behavior pattern is a normal behavior pattern, the monitoring device 400 confirms that the access attempt in the specific terminal 100 is normal, and the specific terminal 100 Access to the terminal 100 connected to the internal network, access from the specific terminal 100 to another terminal 200 connected to the external network, access from the specific terminal 100 to the external terminal 300, etc. allow

In addition, as a result of the determination (or the confirmation result), when the user behavior pattern is not a normal behavior pattern (or when the user behavior pattern is an abnormal behavior pattern), the monitoring device 400 determines the specific terminal 100 It is confirmed that the access attempt is abnormal, and access from the specific terminal 100 to the terminal 100 connected to the internal network, access from the specific terminal 100 to another terminal 200 connected to the external network, Access from the specific terminal 100 to the external terminal 300 is blocked.

In addition, when the monitoring device 400 detects virus infection/distribution, DDoS attack, hacking attempt, etc. in another specific terminal 100 among a plurality of terminals 100 connected to the network-separated internal network, the monitoring The device 400 forcibly installs a patch program corresponding to virus infection/distribution, DDoS attack, hacking attempt, etc., targeting all the plurality of terminals 100 connected to the internal network related to the other specific terminal 100. . Here, the patch program may be a security program for protecting the plurality of terminals 100 from the virus, the DDoS attack, and the hacking attempt. At this time, the monitoring device 400 may temporarily block the connection with other external terminals 200 and 300 in the internal network related to the other specific terminal 100 .

That is, the monitoring device 400 collects a plurality of packets from various terminals 100, 200, and 300 that transmit and receive packets (or data/information) through a communication network.

In addition, when the monitoring device 400 detects (or confirms) virus infection/distribution, DDoS attack, hacking attempt, etc. for another specific terminal 100 based on the collected plurality of packets, the monitoring The device 400 forcibly installs a patch program corresponding to virus infection/distribution, DDoS attack, hacking attempt, etc., targeting all the plurality of terminals 100 connected to the internal network related to the other specific terminal 100. .

In addition, the monitoring device 400 is connected to the other terminal 200, the external terminal ( 300) and manages (or controls) the network status so that communication (or connection/connection) is possible.

That is, in a network state in which the monitoring device 400 is temporarily blocked between the internal network related to the other specific terminal 100 and the other external terminals 200 and 300, the terminal 100 having installed the corresponding patch program It can be managed to communicate with other terminals 200 and the external terminal 300 .

In addition, the monitoring device 400 may control network access of unauthorized terminals.

In addition, the monitoring device 400 detects an illegal detour path (eg, including tethering) and blocks the terminal 100 attempting access to another terminal 200 through the illegal detour path.

In addition, the monitoring device 400 integrates and manages wired/wireless user authentication and usage history.

In this way, the monitoring device 400 may perform a network access control function.

In addition, the monitoring device 400 based on the collected plurality of packets (or a plurality of packets collected from various terminals 100, 200, 300 that transmit and receive packets (or data / information) through the communication network) By analyzing the network environment, necessary network security equipment (not shown) between specific components in the currently configured network topology is identified. Here, the network security equipment includes a firewall, UTM, APT, IPS, SSL VPN, and the like.

That is, the monitoring device 400 based on the collected plurality of packets (or a plurality of packets collected from various terminals 100, 200, 300 that transmit and receive packets (or data / information) through the communication network) By analyzing the network environment, security vulnerabilities are identified in the currently configured network topology, and the network security equipment for resolving the identified security vulnerabilities is identified.

In addition, the monitoring device 400 generates notification information related to network security equipment required between the identified specific components, and transmits the generated notification information to an internal network (or other internal network) where the corresponding network security equipment is located. ) is transmitted to a manager terminal (or another manager terminal (not shown)) that manages.

In this way, the monitoring device 400 may provide an integrated function related to network security.

In addition, based on the collected user data related to the terminal 100, the location where the terminal 100 is located (for example, an office etc.) in a state where the terminal 100 accesses the other terminal 200 and/or the external terminal 300 connected to the external network, and saves one or more files stored in the terminal 100 to the other terminal 200. ) and/or when attempting to transmit (or transmit) to the corresponding external terminal 300, the monitoring device 400, based on a key for encryption and decryption preset in relation to the terminal 100, corresponds to One or more files are encrypted, and the one or more encrypted files are transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300 . Here, the monitoring device 400 sets the valid period (for example, 1 day) and the number of times of decoding (eg, 3 times) for the one or more files, and then sets the valid period and the number of times for decoding. One or more files (or one or more encrypted files with the validity period, the number of times of decryption, etc. set) may be transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300 .

At this time, if the file is an electronic document file (eg, including a text file, a PowerPoint file, an Excel file, a Word file, a Hangul file, etc.), the monitoring device 400 converts the file to a preset format (eg, PDF format), and the file (eg, PDF file) converted to the preset format may be transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300.

In addition, the monitoring device 400 distributes and stores one or more files to be transmitted from the terminal 100 in a plurality of IPFS (not shown), and transmits link information in which the one or more files are stored to the corresponding other terminal 200 and / or transmitted to the corresponding external terminal (300).

In this way, in a state in which the user of the terminal 100 cannot use the terminal 100 (eg, before going to work, after work, during annual vacation, during half vacation, during a business trip, etc.), the terminal 100 internally / When transmission of a file to the outside is attempted, the monitoring device 400 may transmit after applying certain constraints to the corresponding file instead of directly transmitting the file from the corresponding terminal 100 for information security.

Accordingly, the other terminal 200 and / or the external terminal 300 receives the link information transmitted from the monitoring device 400, accesses the plurality of IPFS based on the received link information, You can also download that one or more files.

Also, the other terminal 200 and/or the external terminal 300 receives one or more encrypted files transmitted from the monitoring device 400 .

In addition, the other terminal 200 and/or the external terminal 300 decrypts the received one or more encrypted files based on a key for encryption and decryption preset in relation to the corresponding terminal 100, and the Display (or store/manage) one or more decrypted files. At this time, the keys for encryption and decryption preset in relation to the terminal 100 are stored in advance in the corresponding other terminal 200 and/or the corresponding external terminal 300, or authentication with the corresponding monitoring device 400 It can be provided after completing the course.

In addition, when the validity period is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 and/or the external terminal 300 are not activated after the validity period has elapsed. The received one or more encrypted files, one or more decrypted files, etc. stored in the other terminal 200 and/or the corresponding external terminal 300 are automatically deleted.

In addition, when the number of times of decryption is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 and/or the external terminal 300 transmits the received encrypted files. For one or more files, the decryption function is configured (or controlled/managed) so that the decryption function is not performed more than the number of decryption times, and the corresponding encrypted file may be automatically deleted if the decryption function is attempted more than the number of decryption times.

In addition, the monitoring device 400 interworks with a blockchain server (not shown), and files related to one or more files transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. Transfer information (e.g. file information, source IP address, destination IP address, transfer date and time information, etc.), IPFS management information related to IPFS (e.g. link information in IPFS, file upload date and time information) etc.), download management information (for example, download date and time information of one or more files according to link information from the other terminal 200 and/or the external terminal 300, the other terminal 200 and / or the access date and time information of the external terminal 300, the source IP address, etc.) are stored (or registered) in the block. At this time, the blockchain server works in conjunction with a database server (not shown) to receive information about one or more files transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. , transmission date and time information, link information in IPFS, download date and time information of one or more files according to link information from the other terminal 200 and/or the external terminal 300, the other terminal 200 ) and/or the access information of the external terminal 300 may be encrypted and stored. Here, the blockchain server uses a preset consensus algorithm method (for example, POA (for example, POA To transmit to the other terminal 200 and/or the external terminal 300 by applying Proof of Authority (Proof of Authority), POW (Proof of Work), smart contract, etc. Information related to one or more files to be played may be stored in the block. Here, in the POA, the determined management entity creates blocks in turn (or registered accounts sequentially create blocks), so resource consumption and block creation time are less than that of the POW. At this time, the blockchain server can be configured as a private network to maintain speed and confidentiality. In addition, the smart contract is a promise placed on the blockchain, and a code to take a specific action is added to the transaction when a specific condition is satisfied.

In addition, the blockchain server generates a transaction processing result according to block storage of information related to one or more files to be transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. Here, the transaction processing result (or block storage result) includes a block hash value, block number, recipient information (eg, owner name, identification information of the terminal 100, etc.), transaction hash value, and the like.

In addition, the blockchain server transmits the generated transaction processing result to the monitoring device 400.

In addition, the monitoring device 400 receives a transaction processing result transmitted from the blockchain server, and stores (or manages) the received transaction processing result.

Also, for remote management, when the external terminal 300 attempts to access another specific terminal 100 within the internal network, the monitoring device 400 performs authentication on the corresponding external terminal 300 .

That is, when the external terminal 300 attempts to access another specific terminal 100 within the internal network, the monitoring device 400 determines that the IP address of the external terminal 300 is the other specific terminal 100. ), it is checked whether it is included in one or more pre-registered IP addresses. At this time, the monitoring device 400 may determine whether the corresponding external terminal 300 is an IoT device (not shown) based on the identification information of the external terminal 300 .

When authentication of the external terminal 300 fails, the monitoring device 400 blocks access from the corresponding external terminal 300 to the other specific terminal 100 .

That is, as a result of the check, when the IP address of the external terminal 300 is not included in one or more IP addresses pre-registered with respect to another specific terminal 100, the monitoring device 400 Access from the external terminal 300 to the other specific terminal 100 is blocked.

In addition, when the corresponding external terminal 300 is an IoT device, the monitoring device 400 may block access from the corresponding external terminal 300 to the other specific terminal 100 .

In addition, when authentication of the external terminal 300 is successful, the monitoring device 400 permits (or permits) access from the corresponding external terminal 300 to the other specific terminal 100 .

That is, as a result of the confirmation, when the IP address of the external terminal 300 is included in one or more IP addresses pre-registered in relation to the other specific terminal 100, the monitoring device 400 is the corresponding external terminal ( 300) allows access to the other terminal 100.

In addition, when the IP address of the external terminal 300 is included in one or more IP addresses pre-registered with respect to another specific terminal 100, and the external terminal 300 is not an IoT device, the monitoring device (400) may allow access from the external terminal 300 to the other specific terminal 100.

In addition, the monitoring device 400 prevents the inflow of malicious codes through a data linkage function and provides a function to prevent leakage of internal data.

In addition, the monitoring device 400 provides a function of linking streams between the separated internal network and the external network.

In addition, the monitoring device 400 supports (or provides) mail transmission/reception linkage.

In this way, the monitoring device 400 may provide a network connection solution function.

In addition, the monitoring device 400 provides a tool (or function) for analyzing source code security weaknesses.

In addition, the monitoring device 400 provides various source code languages and inspection items.

In addition, the monitoring device 400 provides fast and accurate analysis and vulnerability navigator functions.

In this way, the monitoring device 400 can provide a secure coding solution.

In addition, the monitoring device 400 provides information on an upload file uploaded from the external terminal 300 to another specific terminal 100, and downloads from the external terminal 300 from another specific terminal 100. Log records including information about downloaded files, access date and time information of the external terminal 300, information on apps used in the external terminal 300, etc. are stored in other blocks in the blockchain server.

In addition, the block chain server stores information related to an upload file uploaded from the external terminal to another specific terminal 100 or information related to a download file downloaded from the other specific terminal 100 according to block storage Generates other transaction processing results. Here, the other transaction processing result (or other block storage result) is another block hash value, another block number, other recipient information (eg owner name, identification information of the external terminal 300, another specific terminal 100) identification information, etc.), other transaction hash values, etc.

In addition, the blockchain server transmits the generated other transaction processing result to the monitoring device 400.

In addition, the monitoring device 400 receives another transaction processing result transmitted from the blockchain server, and stores (or manages) the received other transaction processing result.

At this time, the monitoring device 400 extracts a keyword from the information on the uploaded file and/or the information on the download file, and determines whether the extracted keyword corresponds to a preset security keyword.

As a result of the determination, when the extracted keyword does not correspond to a preset security keyword, the monitoring device 400 continues to perform the monitoring function.

In addition, as a result of the determination, when the extracted keyword corresponds to a preset security keyword, the monitoring device 400 temporarily suspends the process of uploading a corresponding upload file, the process of downloading a corresponding download file, etc., and sends alarm information to the corresponding It is transmitted to an administrator terminal that manages an internal network related to another terminal 100 . At this time, the manager terminal may determine whether or not to resume the upload process of the temporarily suspended upload file and whether to resume the download process of the download file according to the control of the manager of the corresponding manager terminal.

In this way, user logs and user data related to the terminal attempting access are collected, and user behavior patterns are generated by analyzing the collected user logs and user data, and the generated user behavior patterns are identified as abnormal behavior patterns. In this case, the access of the corresponding terminal can be forcibly blocked.

In addition, when a virus, DDoS attack, hacking attempt, etc. is detected in a specific terminal among a plurality of terminals connected to the network-separated internal network, the corresponding terminal is targeted at all terminals connected to the internal network related to the specific terminal. You can forcibly install patch programs that respond to viruses, DDoS attacks, and hacking attempts.

In addition, in this way, when an external terminal attempts to access another terminal among a plurality of terminals connected to the network-separated internal network, after performing authentication for the terminal, the log record of the terminal is registered in the blockchain, and the corresponding terminal Files uploaded or downloaded from one terminal to another terminal can be distributed and stored in IPFS.

Hereinafter, a network connection-based information and network security control method according to the present invention will be described in detail with reference to FIGS. 1 to 3.

2 and 3 are flowcharts illustrating a network connection-based information and network security control method according to an embodiment of the present invention.

First, when a specific terminal 100 among a plurality of terminals 100 connected to the internal network tries to access the terminal 100 connected to the internal network or when trying to access another terminal 200 connected to the external network Alternatively, when access to the external terminal 300 is attempted, the monitoring device 400 collects user logs and user data related to the corresponding terminal 100 . At this time, the monitoring device 400 is configured to collect packets (or data/information) transmitted/received between the plurality of devices 100, 200, and 300 in the entire network topology. Here, the user log includes the IP address (or source IP address) of the specific terminal 100, the destination IP address to be accessed (or the IP address of the other terminal 200/external terminal 300), the access date and It includes time information, information on an app running in the specific terminal 100, and the like. In addition, the user data includes information about the time of arrival, time of leaving, annual leave information, class information, and business trip information related to the user of the specific terminal 100 . At this time, the monitoring device 400 may collect user data for each terminal from an administrator terminal (not shown) managing the corresponding internal network or a database (not shown) related to the internal network.

For example, from a first terminal 100 among a plurality of terminals 100 connected to the first internal network in ABCDE company to a 103rd terminal 200 among a plurality of other terminals 200 connected to the 101st internal network in ASDFG company When access is attempted, the monitoring device 400 records a first user log related to the first terminal (for example, the IP address of the first terminal, the IP address of the corresponding 103rd terminal, the date and time of access in 2022) July 1 at 11:20:10 AM, including information on the 1st-5 apps running on the first terminal), the first user data related to the first user of the first terminal (for example, July 2022 Month 01 to July 08, 2022 Start time information and leave time information, 1st annual information: July 11, 2022, 1st business trip information: July 18, 2022 to July 22, 2022 etc.) and the like are collected (S210).

Thereafter, the monitoring device 400 analyzes the collected user logs and user data related to the user of the corresponding terminal 100 and generates a user behavior pattern related to the user of the corresponding terminal 100 .

At this time, the monitoring device 400 performs artificial intelligence-based machine learning based on the collected user log, user data, etc. related to the user of the corresponding terminal 100, and based on the machine learning result, the corresponding terminal 100 ) may generate (or calculate/calculate/set/determine) a user behavior pattern related to the user.

That is, the monitoring device 400 performs machine learning (or artificial intelligence/deep learning) by using the collected user log, user data, etc. ), and based on the machine learning result (or artificial intelligence result/deep learning result), a user behavior pattern related to the user of the terminal 100 is generated.

For example, the monitoring device 400 collects the first user log related to the first terminal (eg, the IP address of the first terminal, the IP address of the corresponding 103rd terminal, the date and time of access, 07/2022) 11:20:10 am on the 1st of the month, including information on the 1st to 5th apps running on the first terminal), the first user data related to the first user of the first terminal (e.g., July 2022) Information on arrival and departure times from 01st to 07/08/2022, 1st annual information: 07/11/2022, 1st business trip information: 07/18/2022 - 07/22/2022, etc. including), etc., a first user behavior pattern related to the first user of the first terminal is generated (S220).

Thereafter, the monitoring device 400 determines (or confirms) whether the generated user behavior pattern is a preset normal behavior pattern.

That is, the monitoring device 400 determines whether the generated user behavior pattern is included in a preset normal behavior policy.

For example, the monitoring device 400 determines whether the generated first user behavior pattern corresponds to a preset normal behavior pattern (S230).

As a result of the determination (or the confirmation result), when the user behavior pattern is a normal behavior pattern, the monitoring device 400 confirms that the access attempt in the specific terminal 100 is normal, and the specific terminal 100 Access to the terminal 100 connected to the internal network, access from the specific terminal 100 to another terminal 200 connected to the external network, access from the specific terminal 100 to the external terminal 300, etc. allow

As an example, as a result of the determination, when the first user behavior pattern (eg, a pattern of attempting to access a preset destination IP address during weekday working hours) is determined to be a normal behavior pattern, the monitoring device 400 determines that the first user behavior pattern is a normal behavior pattern. Terminal 1 connects the connection to the 103rd terminal (S240).

In addition, as a result of the determination (or the confirmation result), when the user behavior pattern is not a normal behavior pattern (or when the user behavior pattern is an abnormal behavior pattern), the monitoring device 400 determines the specific terminal 100 It is confirmed that the access attempt is abnormal, and access from the specific terminal 100 to the terminal 100 connected to the internal network, access from the specific terminal 100 to another terminal 200 connected to the external network, Access from the specific terminal 100 to the external terminal 300 is blocked.

For example, as a result of the determination, when the first user behavior pattern (for example, a connection attempt pattern from the first terminal to the 103 terminal while the first user has left work) is determined to be an abnormal behavior pattern, the monitoring The apparatus 400 forcibly blocks the connection from the first terminal to the 103rd terminal (S250).

Thereafter, when the monitoring device 400 detects virus infection/distribution, DDoS attack, hacking attempt, etc. in another specific terminal 100 among a plurality of terminals 100 connected to the network-separated internal network, the monitoring The device 400 forcibly installs a patch program corresponding to virus infection/distribution, DDoS attack, hacking attempt, etc., targeting all the plurality of terminals 100 connected to the internal network related to the other specific terminal 100. . Here, the patch program may be a security program for protecting the plurality of terminals 100 from the virus, the DDoS attack, and the hacking attempt. At this time, the monitoring device 400 may temporarily block the connection with other external terminals 200 and 300 in the internal network related to the other specific terminal 100 .

That is, the monitoring device 400 collects a plurality of packets from various terminals 100, 200, and 300 that transmit and receive packets (or data/information) through a communication network.

In addition, when the monitoring device 400 detects (or confirms) virus infection/distribution, DDoS attack, hacking attempt, etc. for another specific terminal 100 based on the collected plurality of packets, the monitoring The device 400 forcibly installs a patch program corresponding to virus infection/distribution, DDoS attack, hacking attempt, etc., targeting all the plurality of terminals 100 connected to the internal network related to the other specific terminal 100. .

In addition, the monitoring device 400 is connected to the other terminal 200, the external terminal ( 300) and manages (or controls) the network status so that communication (or connection/connection) is possible.

That is, in a network state in which the monitoring device 400 is temporarily blocked between the internal network related to the other specific terminal 100 and the other external terminals 200 and 300, the terminal 100 having installed the corresponding patch program It can be managed to communicate with other terminals 200 and the external terminal 300 .

For example, the monitoring device 400 collects a plurality of packets transmitted and received between the plurality of terminals 100, 200, and 300 connected through the communication network.

In addition, when the monitoring device 400 detects an attempt to distribute a virus to a fifth terminal 100 among a plurality of terminals 100 included in the first internal network based on the collected plurality of packets, Connection with other external terminals 200 and 300 is temporarily blocked in the first internal network including the fifth terminal, and the first to 100 terminals 100 included in the first internal network are targeted. The 11th patch program corresponding to the virus is forcibly installed respectively.

In addition, the monitoring device 400 manages the 1st to 100th terminals installed with the 11th patch program to communicate with the other terminals 200 and the external terminal 300 connected to another external internal network. Do (S260).

After that, the monitoring device 400 based on the collected plurality of packets (or a plurality of packets collected from various terminals 100, 200, 300 that transmit and receive packets (or data / information) through the communication network) By analyzing the network environment, necessary network security equipment (not shown) between specific components in the currently configured network topology is identified. Here, the network security equipment includes a firewall, UTM, APT, IPS, SSL VPN, and the like.

That is, the monitoring device 400 based on the collected plurality of packets (or a plurality of packets collected from various terminals 100, 200, 300 that transmit and receive packets (or data / information) through the communication network) By analyzing the network environment, security vulnerabilities are identified in the currently configured network topology, and the network security equipment for resolving the identified security vulnerabilities is identified.

In addition, the monitoring device 400 generates notification information related to network security equipment required between the identified specific components, and transmits the generated notification information to an internal network (or other internal network) where the corresponding network security equipment is located. ) is transmitted to a manager terminal (or another manager terminal (not shown)) that manages.

For example, the monitoring device 400 determines that an additional firewall is required between a seventh terminal 100 among a plurality of terminals 100 included in the first internal network and the communication network based on the collected plurality of packets. A first manager terminal that checks, generates first notification information including that an additional firewall is required on one side of the seventh terminal according to the confirmation, and uses the generated first notification information to manage the corresponding first internal network It is transmitted to (S270).

Then, based on the collected user data related to the terminal 100, the user of the terminal 100 goes to work before going to work, after work, half of the day, annual leave, business trip, etc., where the terminal 100 is located (for example, an office etc.) in a state where the terminal 100 accesses the other terminal 200 and/or the external terminal 300 connected to the external network, and saves one or more files stored in the terminal 100 to the other terminal 200. ) and/or when attempting to transmit (or transmit) to the corresponding external terminal 300, the monitoring device 400, based on a key for encryption and decryption preset in relation to the terminal 100, corresponds to One or more files are encrypted, and the one or more encrypted files are transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300 . Here, the monitoring device 400 sets the valid period (for example, 1 day) and the number of times of decoding (eg, 3 times) for the one or more files, and then sets the valid period and the number of times for decoding. One or more files (or one or more encrypted files with the validity period, the number of times of decryption, etc. set) may be transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300 .

At this time, if the file is an electronic document file (eg, including a text file, a PowerPoint file, an Excel file, a Word file, a Hangul file, etc.), the monitoring device 400 converts the file to a preset format (eg, PDF format), and the file (eg, PDF file) converted to the preset format may be transmitted to the corresponding other terminal 200 and/or the corresponding external terminal 300.

In addition, the monitoring device 400 distributes and stores one or more files to be transmitted from the terminal 100 in a plurality of IPFS (not shown), and transmits link information in which the one or more files are stored to the corresponding other terminal 200 and / or transmitted to the corresponding external terminal (300).

In this way, in a state in which the user of the terminal 100 cannot use the terminal 100 (eg, before going to work, after work, during annual vacation, during half vacation, during a business trip, etc.), the terminal 100 internally / When transmission of a file to the outside is attempted, the monitoring device 400 may transmit after applying certain constraints to the corresponding file instead of directly transmitting the file from the corresponding terminal 100 for information security.

Accordingly, the other terminal 200 and / or the external terminal 300 receives the link information transmitted from the monitoring device 400, accesses the plurality of IPFS based on the received link information, You can also download that one or more files.

Also, the other terminal 200 and/or the external terminal 300 receives one or more encrypted files transmitted from the monitoring device 400 .

In addition, the other terminal 200 and/or the external terminal 300 decrypts the received one or more encrypted files based on a key for encryption and decryption preset in relation to the corresponding terminal 100, and the Display (or store/manage) one or more decrypted files. At this time, the keys for encryption and decryption preset in relation to the terminal 100 are stored in advance in the corresponding other terminal 200 and/or the corresponding external terminal 300, or authentication with the corresponding monitoring device 400 It can be provided after completing the course.

In addition, when the validity period is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 and/or the external terminal 300 are not activated after the validity period has elapsed. The received one or more encrypted files, one or more decrypted files, etc. stored in the other terminal 200 and/or the corresponding external terminal 300 are automatically deleted.

In addition, when the number of times of decryption is set for the one or more received encrypted files (or the one or more received files), the other terminal 200 and/or the external terminal 300 transmits the received encrypted files. For one or more files, the decryption function is configured (or controlled/managed) so that the decryption function is not performed more than the number of decryption times, and the corresponding encrypted file may be automatically deleted if the decryption function is attempted more than the number of decryption times.

For example, the collected first user data (eg, attendance time information from July 01, 2022 to July 08, 2022, leave time information, first annual information: July 11, 2022, 1 Business trip information: July 18, 2022 ~ July 22, 2022, etc.), the first user of the first terminal is on an annual leave on July 11, 2022, when the first terminal connects to another internal network After accessing the located 105th other terminal 200, when attempting to transmit the 201st file previously stored in the first terminal from the first terminal to the 105th other terminal, the monitoring terminal 400 The 201st file is encrypted based on the first key for encryption and decryption preset in relation to the first terminal, and for the encrypted 201st file, the 201st valid period (for example, 1 day), the 201st decryption The number of times (for example, 3 times) is set, and the encrypted 201st file for which the 201st valid period and the 201st number of times of decryption are set is transmitted to the 105th other terminal.

In addition, the 105th other terminal receives the encrypted 201st file for which the 201st validity period and the 201st decryption number are set transmitted from the monitoring device 400 .

In addition, the 105th other terminal decrypts the received encrypted 201st file based on a first key preset in relation to the corresponding 1st terminal, and displays the decrypted 201st file (S280).

Thereafter, the monitoring device 400 interworks with a blockchain server (not shown), and files related to one or more files transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. Transfer information (e.g. file information, source IP address, destination IP address, transfer date and time information, etc.), IPFS management information related to IPFS (e.g. link information in IPFS, file upload date and time information) etc.), download management information (for example, download date and time information of one or more files according to link information from the other terminal 200 and/or the external terminal 300, the other terminal 200 and / or the access date and time information of the external terminal 300, the source IP address, etc.) are stored (or registered) in the block. At this time, the blockchain server works in conjunction with a database server (not shown) to receive information about one or more files transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. , transmission date and time information, link information in IPFS, download date and time information of one or more files according to link information from the other terminal 200 and/or the external terminal 300, the other terminal 200 ) and/or the access information of the external terminal 300 may be encrypted and stored. Here, the blockchain server uses a preset consensus algorithm method (for example, POA (for example, POA To transmit to the other terminal 200 and/or the external terminal 300 by applying Proof of Authority (including proof of authority), POW (Proof of Work), smart contract, etc. Information related to one or more files to be played may be stored in the block. Here, in the POA, the determined management entity creates blocks in turn (or registered accounts sequentially create blocks), so resource consumption and block creation time are less than that of the POW. At this time, the blockchain server can be configured as a private network to maintain speed and confidentiality. In addition, the smart contract is a promise placed on the blockchain, and a code to take a specific action is added to the transaction when a specific condition is satisfied.

In addition, the blockchain server generates a transaction processing result according to block storage of information related to one or more files to be transmitted from the terminal 100 to the other terminal 200 and/or the external terminal 300. Here, the transaction processing result (or block storage result) includes a block hash value, block number, recipient information (eg, owner name, identification information of the terminal 100, etc.), transaction hash value, and the like.

In addition, the blockchain server transmits the generated transaction processing result to the monitoring device 400.

In addition, the monitoring device 400 receives a transaction processing result transmitted from the blockchain server, and stores (or manages) the received transaction processing result.

For example, the monitoring device 400 interworks with the blockchain server to provide 201st file transfer information related to the 201st file (eg, information on the 201st file, IP address of the first terminal, 105 The IP address of another terminal, transmission date and time information (including July 11, 2022 at 11:22:30 am), etc. are stored in the 201st block.

In addition, the monitoring device 400 receives the 201st transaction processing result transmitted from the blockchain server and stores the received 201st transaction processing result (S290).

Then, for remote management, when the external terminal 300 attempts to access another specific terminal 100 within the internal network, the monitoring device 400 performs authentication on the corresponding external terminal 300 .

That is, when the external terminal 300 attempts to access another specific terminal 100 within the internal network, the monitoring device 400 determines that the IP address of the external terminal 300 is the other specific terminal 100. ), it is checked whether it is included in one or more pre-registered IP addresses. At this time, the monitoring device 400 may determine whether the corresponding external terminal 300 is an IoT device (not shown) based on the identification information of the external terminal 300 .

For example, when the 301st external terminal 300 attempts to access the 9th terminal 100 within the first internal network, the monitoring device 400 determines that the IP address of the 301st external terminal is the 9th terminal. It is checked whether it is included in one or more pre-registered IP addresses in relation to , and based on the identification information of the 301st external terminal, it is determined whether the corresponding 301st external terminal is an IoT device (S300).

When authentication of the external terminal 300 fails, the monitoring device 400 blocks access from the corresponding external terminal 300 to the other specific terminal 100 .

That is, as a result of the check, when the IP address of the external terminal 300 is not included in one or more IP addresses pre-registered with respect to another specific terminal 100, the monitoring device 400 Access from the external terminal 300 to the other specific terminal 100 is blocked.

In addition, when the corresponding external terminal 300 is an IoT device, the monitoring device 400 may block access from the corresponding external terminal 300 to the other specific terminal 100 .

For example, as a result of the check, when the IP address of the 301st external terminal is not included in one or more IP addresses pre-registered with respect to the 9th terminal and the 301st external terminal is an IoT device, the monitoring device ( 400) blocks the access of the 301st external terminal to the 9th terminal (S310).

In addition, when authentication of the external terminal 300 is successful, the monitoring device 400 permits (or permits) access from the corresponding external terminal 300 to the other specific terminal 100 .

That is, as a result of the confirmation, when the IP address of the external terminal 300 is included in one or more IP addresses pre-registered in relation to the other specific terminal 100, the monitoring device 400 is the corresponding external terminal ( 300) allows access to the other terminal 100.

In addition, when the IP address of the external terminal 300 is included in one or more IP addresses pre-registered with respect to another specific terminal 100, and the external terminal 300 is not an IoT device, the monitoring device (400) may allow access from the external terminal 300 to the other specific terminal 100.

For example, as a result of the confirmation, when the IP address of the 301st external terminal is included in one or more IP addresses pre-registered with respect to the 9th terminal and the 301st external terminal is not an IoT device, the monitoring device ( 400) allows the 301st external terminal to access the 9th terminal (S320).

Thereafter, the monitoring device 400 provides information on an upload file uploaded from the external terminal 300 to another specific terminal 100, and downloads from the external terminal 300 from the other specific terminal 100. Log records including information about downloaded files, access date and time information of the external terminal 300, information on apps used in the external terminal 300, etc. are stored in other blocks in the blockchain server.

In addition, the block chain server stores information related to an upload file uploaded from the external terminal to another specific terminal 100 or information related to a download file downloaded from the other specific terminal 100 according to block storage Generates other transaction processing results. Here, the other transaction processing result (or other block storage result) is another block hash value, another block number, other recipient information (eg owner name, identification information of the external terminal 300, another specific terminal 100) identification information, etc.), other transaction hash values, etc.

In addition, the blockchain server transmits the generated other transaction processing result to the monitoring device 400.

In addition, the monitoring device 400 receives another transaction processing result transmitted from the blockchain server, and stores (or manages) the received other transaction processing result.

At this time, the monitoring device 400 extracts a keyword from the information on the uploaded file and/or the information on the download file, and determines whether the extracted keyword corresponds to a preset security keyword.

As a result of the determination, when the extracted keyword corresponds to a preset security keyword, the monitoring device 400 temporarily suspends the process of uploading a corresponding upload file, the process of downloading a corresponding download file, etc., and sends alarm information to another corresponding It is transmitted to the manager terminal that manages the internal network related to the terminal 100 . At this time, the manager terminal may determine whether or not to resume the upload process of the temporarily suspended upload file and whether to resume the download process of the download file according to the control of the manager of the corresponding manager terminal.

For example, the monitoring device 400 interworks with the blockchain server, information on a 301st file uploaded from the 301st external terminal to the 9th terminal, access date and time information of the 301st external terminal ( For example, at 08:09:10 pm on July 11, 2022), the 301st used app information from the 301st external terminal is stored in the 301st block.

In addition, the monitoring device 400 receives the 301st transaction processing result transmitted from the blockchain server and stores the received 301st transaction processing result (S330).

As described above, an embodiment of the present invention collects user logs, user data, etc. related to a terminal attempting access, analyzes the collected user logs, user data, etc. to generate a user behavior pattern, and generates a user behavior pattern. If a behavioral pattern is identified as an abnormal behavioral pattern, access to the terminal is forcibly blocked, providing the best information security environment and highly convenient operation and work environment through information security consulting tailored to the customer's operating environment.

In addition, as described above, in the embodiment of the present invention, when a virus, DDoS attack, hacking attempt, etc. is detected in a specific terminal among a plurality of terminals connected to a network-separated internal network, an internal network related to the specific terminal is detected. By compulsorily installing a patch program that responds to viruses, DDoS attacks, hacking attempts, etc. to all connected terminals, high security is ensured by separating the network environment, and business continuity is achieved by establishing a high-performance network connection. and convenience, protect internal/external infrastructure, and provide a reliable service network.

In addition, as described above, in the embodiment of the present invention, when an external terminal attempts to access another terminal among a plurality of terminals connected to a network-separated internal network, after performing authentication on the corresponding terminal, the log log of the corresponding terminal Records are registered in the blockchain, files uploaded or downloaded from the terminal to other terminals are distributed and stored in IPFS, and the external terminal accesses the internal network and uploads the file to be uploaded to IPFS instead of directly sending it to other terminals. After that, the other terminal downloads the file uploaded to the IPFS through the link information, and instead of directly receiving the file to be downloaded from the other terminal, the other terminal downloads the file uploaded to IPFS through the link information Accordingly, it is possible to provide enhanced security for a plurality of terminals connected to the company network.

The foregoing may be modified and modified by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

10: Network-based information and network security control system
100: a plurality of terminals 200: a plurality of other terminals
300: external terminal 400: monitoring device

Claims (10)

A specific terminal among a plurality of terminals connected to the internal network attempting access to another terminal connected to the external network; and
User logs and user data related to the specific terminal are collected, and a user behavior pattern related to the user of the specific terminal is generated by analyzing the collected user log and user data related to the user of the specific terminal, and the user behavior pattern is When it is not a normal behavior pattern, a monitoring device confirms that an access attempt from the specific terminal is abnormal and blocks access from the specific terminal to other terminals,
The user log is
At least one of an IP address of the specific terminal, a destination IP address to be accessed, access date and time information, and information about an app running in the specific terminal;
The user data is
At least one of information about the time of arrival, time of leaving work, annual leave information, class information, and business trip information related to the user of the specific terminal,
The monitoring device,
A plurality of packets transmitted and received through a communication network are collected, and when at least one of virus infection/distribution, DDoS attack, and hacking attempt for the specific terminal is detected based on the collected plurality of packets, related to the specific terminal Temporarily blocking access to the external network for all a plurality of terminals connected to the internal network, and forcibly installing a patch program corresponding to at least one of the virus infection/distribution, DDoS attack, and hacking attempt Network-based information and network security control system. delete Collecting, by the monitoring device, user logs and user data related to the specific terminal when a specific terminal among a plurality of terminals connected to the internal network attempts to access another terminal connected to the external network;
generating a user behavior pattern related to the user of the specific terminal by analyzing the collected user log and user data related to the user of the specific terminal by the monitoring device;
When the user behavior pattern is not a normal behavior pattern, determining, by the monitoring device, that an access attempt in the specific terminal is abnormal, and blocking access from the specific terminal to other terminals;
Collecting, by the monitoring device, a plurality of packets transmitted and received through a communication network; and
When at least one of virus infection/distribution, DDoS attack, and hacking attempt for the specific terminal is detected by the monitoring device based on the collected plurality of packets, all pluralities connected to the internal network related to the specific terminal Temporarily blocking access to an external network for a terminal and forcibly installing a patch program corresponding to at least one of the virus infection/distribution, DDoS attack, and hacking attempt,
The user log is
At least one of an IP address of the specific terminal, a destination IP address to be accessed, access date and time information, and information about an app running in the specific terminal;
The user data is
Network linkage-based information and network security control method comprising at least one of information on arrival time, time information on leaving work, annual leave information, class information and business trip information related to the user of the specific terminal. According to claim 3,
The step of generating a user behavior pattern related to the user of the specific terminal,
Machine learning is performed using the collected user logs and user data related to the user of the specific terminal as input values of a pre-learned user behavior pattern analysis model, and based on the machine learning result, the user behavior pattern related to the user of the specific terminal Network connection-based information and network security control method, characterized in that for generating. delete According to claim 3,
Collecting, by the monitoring device, a plurality of packets transmitted and received through a communication network;
analyzing a network environment based on the collected plurality of packets by the monitoring device, and identifying network security equipment required between specific components in a currently configured network topology; and
By the monitoring device, generating notification information related to network security equipment required between the identified specific components, and transmitting the generated notification information to an administrator terminal that manages an internal network where the corresponding network security equipment is located Network connection-based information and network security control method, characterized in that it further comprises the step. According to claim 3,
Based on the collected user data related to the specific terminal, the user of the specific terminal connects to the external network from the specific terminal in a state where the specific terminal is not located due to any one of before going to work, after work, half leave, annual leave, and business trip. When connecting to another connected terminal and attempting to transmit one or more files stored in the specific terminal to the other terminal, the monitoring device performs the encrypting one or more files;
Transmitting, by the monitoring device, the one or more encrypted files to the other terminal;
receiving, by the other terminal, the one or more encrypted files;
decrypting, by the other terminal, the one or more received encrypted files based on a key for encryption and decryption preset in relation to the specific terminal; and
Network linkage-based information and network security control method, characterized in that it further comprises the step of displaying the one or more decrypted files by the other terminal. According to claim 7,
When the validity period is set for the received one or more encrypted files, the received encrypted one or more files and the one or more decrypted files being stored in the other terminal are stored by the other terminal after the validity period has elapsed. Network connection-based information and network security control method further comprising the step of automatically deleting. According to claim 3,
Download related to the downloading of the one or more files according to the file transfer information related to the one or more files transmitted from the specific terminal to the other terminal and the link information from the other terminal by the monitoring device in conjunction with the blockchain server. storing management information in a block;
Receiving, by the monitoring device, a transaction processing result transmitted from the blockchain server; and
The network connection-based information and network security control method further comprising the step of storing the received transaction processing result by the monitoring device. According to claim 3,
performing authentication on the external terminal by the monitoring device when an external terminal attempts to access the specific terminal within the internal network;
allowing access to the specific terminal from the external terminal, by the monitoring device, when authentication of the external terminal succeeds; and
By the monitoring device, information on an upload file uploaded from the external terminal to the specific terminal, information on a download file downloaded from the external terminal from the specific terminal, access date and time information of the external terminal, and the external terminal A method for controlling information and network security based on network linkage, further comprising storing a log record including at least one of application information used in a terminal in another block in a blockchain server.

Images