KR102550813B1 - System and method for network security - Google Patents

Abstract

Network security systems and methods are provided. A network security system according to an embodiment of the present invention includes a cache server storing a domain address for each of a plurality of web pages provided by a web server and an IP address corresponding to the domain address; a DNS server that redirects traffic of the attacker terminal to an attack blocking server by changing Domain Name Service (DNS) information when an attacker terminal wants to access a web page provided by the web server; and the attack blocking server connected to the cache server, blocking attack traffic among traffic of the attacker terminal and forwarding normal traffic to the cache server, wherein the cache server includes a domain address and an IP address stored in the cache server. The normal traffic is forwarded to the web server using the address.

Description

Network security system and method {SYSTEM AND METHOD FOR NETWORK SECURITY}

Embodiments of the present invention relate to network security technology for efficiently coping with an attacker's attack.

A DDoS attack is one of the hacking methods in which one or more attacker's terminals instantaneously generate a large amount of traffic that the server or network bandwidth cannot handle, paralyzing the server or degrading the performance of the network.

In order to cope with these attacks, the traffic of the attacker's terminal is diverted to a separate attack blocking server (eg, Korea Internet & Security Agency (KISA)'s cyber shelter) that has recently built a large-scale defense zone against the above attacks. A network security technique that blocks attack traffic on a blocking server and forwards normal traffic to a web server is being used.

1 is a diagram showing the detailed configuration of a network security system 10 according to the prior art.

Referring to FIG. 1, when an attacker terminal 12 tries to access a web page (eg, “abc.com”) provided by a web server 20 located inside the company intranet 40, the IP The blocking engine 14 blocks the IP address (for example, 1.1.1.1) of the web page accessible through the external Internet network 30, and the DNS server 16 blocks the DNS (Domain Name Service) for the web page. ) information to divert the traffic of the attacker terminal 12 and the user terminal (not shown) to the attack blocking server 18. Thereafter, the attack blocking server 18 refers to the changed IP address (eg, 3.3.3.3) of the DNS server 16 to block attack traffic among incoming traffic, and the changed IP address for the web page (eg, 3.3.3.3). For example, it forwards normal traffic to the web server 20 with 1.1.1.2.

However, according to the prior art, it is difficult to secure a plurality of IP addresses in that an IP address must be additionally assigned to each web page (or service) to be defended. In addition, since the band of the changed IP address is generally the same as the band of the original IP address of the web page, when an attacker attacks lines of a similar band, it is difficult to respond to the attack due to band exhaustion.

In addition, according to the prior art, when attacking the attacker terminal 12, the procedure for responding to the attack is complicated in that the process of blocking the IP address, changing DNS settings, and changing the IP address is performed, and according to the change of the IP address, the network and There is a problem in that a firewall setting change operation must be additionally performed.

Korea Patent Registration No. 10-1042291 (2011.06.10)

Embodiments of the present invention are intended to enhance network security by simplifying the application process of an attack blocking server (eg, a cyber shelter) and hiding an IP address to be defended.

According to an exemplary embodiment of the present invention, a cache server for storing a domain address for each of a plurality of web pages provided by a web server and an IP address corresponding to the domain address; a DNS server that redirects traffic of the attacker terminal to an attack blocking server by changing Domain Name Service (DNS) information when an attacker terminal wants to access a web page provided by the web server; and the attack blocking server connected to the cache server, blocking attack traffic among traffic of the attacker terminal and forwarding normal traffic to the cache server, wherein the cache server includes a domain address and an IP address stored in the cache server. A network security system is provided that forwards the normal traffic to the web server using an address.

The web server and the cache server may be located inside the company intranet, and the DNS server and the attack blocking server may be located outside the company intranet.

A band of IP addresses for each of the plurality of web pages provided by the web server may be different from a band of IP addresses of the cache server.

The attack blocking server transmits the domain address of the web page to the cache server, and the cache server includes a web address having an IP address corresponding to the domain address received from the attack blocking server among IP addresses stored in the cache server. The normal traffic may be forwarded to the server.

The network security system may further include an IP blocking engine that blocks the IP address of the web page accessible through an external Internet network when the attacker terminal tries to access the web page provided by the web server.

According to another exemplary embodiment of the present invention, in the DNS server, when an attacker terminal wants to access a web page provided by the web server, DNS (Domain Name Service) information is changed to direct traffic of the attacker terminal to the attack blocking server. bypassing; Blocking, in the attack blocking server, attack traffic among traffic of the attacker's terminal; forwarding normal traffic from the attack blocking server to a cache server storing a domain address for each of a plurality of web pages provided by the web server and an IP address corresponding to the domain address; and forwarding, in the cache server, the normal traffic to the web server using the domain address and IP address stored in the cache server.

The web server and the cache server may be located inside the company intranet, and the DNS server and the attack blocking server may be located outside the company intranet.

A band of IP addresses for each of the plurality of web pages provided by the web server may be different from a band of IP addresses of the cache server.

The forwarding of the normal traffic to the web server may include receiving a domain address of the web page from the attack blocking server; and forwarding the normal traffic to a web server having an IP address corresponding to a domain address received from the attack blocking server among IP addresses stored in the cache server.

The network security method may further include blocking an IP address of the web page accessible through an external Internet network in an IP blocking engine before the step of diverting the traffic of the attacker terminal to the attack blocking server. .

According to the embodiments of the present invention, it is possible to easily forward the normal traffic received from the attack blocking server to the web server using the domain address-IP address pair stored in the cache server, and accordingly, each web page to be defended ( or service), there is no need to additionally allocate an IP address.

In addition, according to the embodiments of the present invention, since there is no need to additionally allocate an IP address for each web page (or service) to be defended, there is no need to additionally change network and firewall settings, and there is no need to perform an attack by an attacker terminal. The response process can be simplified.

Furthermore, according to the embodiments of the present invention, since the range of IP addresses for each of the plurality of web pages provided by the web server is different from the range of IP addresses of the cache server, the effect of hiding the IP address of the cache server to the outside , and thus network security can be strengthened.

1 is a diagram showing a detailed configuration of a network security system according to the prior art;
2 is a diagram showing a detailed configuration of a network security system according to an embodiment of the present invention
3 is a flowchart for explaining a network security method according to an embodiment of the present invention

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The detailed descriptions that follow are provided to provide a comprehensive understanding of the methods, devices and/or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or operator. Therefore, the definition should be made based on the contents throughout this specification. Terminology used in the detailed description is only for describing the embodiments of the present invention and should in no way be limiting. Unless expressly used otherwise, singular forms of expression include plural forms. In this description, expressions such as "comprising" or "comprising" are intended to indicate any characteristic, number, step, operation, element, portion or combination thereof, one or more other than those described. It should not be construed to exclude the existence or possibility of any other feature, number, step, operation, element, part or combination thereof.

2 is a diagram showing a detailed configuration of a network security system 100 according to an embodiment of the present invention. As shown in Figure 2, the network security system 100 according to an embodiment of the present invention, when the attacker terminal 102 tries to access the web page provided by the web server 110 (ie, the attacker terminal ( 102) to attack the web server 110) to effectively cope with the above attack and to strengthen the security of the network, the IP blocking engine 104, DNS server 106, attack blocking server 108 and cache server 112.

Here, the attacker terminal 102 is a terminal owned by the attacker or a terminal used by the attacker for the attack, and may be, for example, an electronic device such as a desktop computer, a laptop computer, a smart phone, or a PDA. In addition, although not shown in the drawing, a user terminal (not shown) to be mentioned below is a terminal possessed by a general user and may be an electronic device such as a desktop, a laptop computer, a smartphone, a PDA, and the like, like the attacker terminal 102. there is. In addition, the web server 110 is a device that provides one or more web pages (or services) and may be located inside the company intranet 130 . Although only one web server 110 is shown in FIG. 2 for convenience of description, a plurality of web servers 110 may exist within the company intranet 130 according to the type or number of web pages (or services). In addition, as shown in FIG. 2, the IP blocking engine 104, the web server 110, and the cache server 112 are located inside the company intranet 130, and the attacker terminal 102, DNS server 106 ) and the attack blocking server 108 are located outside the company intranet 130 and can mutually transmit and receive data through the Internet network 120.

In the embodiments of the present invention, the Internet network 120 and the company intranet 130 are classified according to entities that provide network resources. Specifically, the in-house intranet 130 refers to a network provided by an entity closely related to an in-house business or service, and the Internet network 120 is a service provider other than the provider of the in-house intranet 130, for example For example, it refers to a network provided by a mobile communication service provider. The Internet network 120 may be, for example, a mobile communication network or a public wireless network (Public WiFi) to which the attacker terminal 102 and the user terminal are subscribed.

In addition, in the present embodiments, the attack of the attacker terminal 102 is an act of paralyzing a server or degrading network performance, for example, a Distributed Denial Service (DDoS) attack, a worm attack, etc. It can be. Hereinafter, a detailed configuration of the network security system 100 will be described in detail with reference to FIG. 2 .

When the attacker terminal 102 tries to access the web page provided by the web server 102, the IP blocking engine 104 uses the IP address of the web page accessible through the external Internet network 120 (for example, “1.1 .1.1”). The IP blocking engine 104 may include an attack detection means (not shown) such as a DDoS detection device, and detects attack traffic (or harmful traffic) generated from the attacker terminal 102 by using the attack detection means. can do. As an example, the IP blocking engine 104 may determine that attack traffic is generated when traffic flowing into the web server 110 exceeds a set value during a specific time period. When an attack by the attacker terminal 102 is detected through the attack detection unit, the IP blocking engine 104 may block the IP address of the web page to be defended at the top of the network. At this time, the IP blocking engine 104 may block all normal traffic generated from the user terminal as well as attack traffic generated from the attacker terminal 102 . Accordingly, all traffic flowing into the company intranet 130 through the Internet network 120 may be blocked.

The DNS server 106 is a device that converts a domain address into an IP address, and may be located outside the company intranet 130 . The DNS server 106 diverts the traffic of the attacker terminal 102 and the user terminal to the attack blocking server 108 by changing Domain Name Service (DNS) information for a web page that the attacker terminal 102 wants to access. Specifically, the DNS server 106 blocks the traffic of the attacker terminal 102 and the user terminal by changing the IP address of the DNS server 106 to the IP address of the attack blocking server 108 (eg, 3.3.3.3). It can be diverted to the attack blocking server 108. Accordingly, an inflow path of traffic generated from the attacker terminal 102 and the user terminal trying to access the web page may be changed to the attack blocking server 108 .

The attack blocking server 108 is a device that blocks attack traffic among traffic generated from the attacker terminal 102 and has a large-scale defense zone against the attack. The attack blocking server 108 may include, for example, a DDoS protection device, and may detect and block attack traffic using the DDoS protection device. The attack blocking server 108 may be, for example, a server that performs the same or similar function as a cyber shelter of the Korea Internet & Security Agency (KISA). As shown in FIG. 2 , the IP address of the attack blocking server 108 may be, for example, “3.3.3.3” and may be located outside the company intranet 130 .

At this time, the attack blocking server 108 refers to the changed IP address of the DNS server 16 (eg, 3.3.3.3) and transfers normal traffic (traffic from which attack traffic has been removed from all traffic) among the incoming traffic to the cache server. It can be transmitted to the web server 110 through (112). To this end, the attack blocking server 108 may be connected 1:1 with the cache server 112 .

The cache server 112 is a storage in which domain addresses for each of a plurality of web pages provided by the web server 110 and IP addresses corresponding to the domain addresses are stored, and may be located inside the company intranet 130. . The domain address and IP address stored in the cache server 112 are, for example, "abc.com: 1.1.1.1, def.com: 1.1.1.2, ghi.com: 1.1.1.3... ” and so on. Although FIG. 2 shows only three domain address-IP address pairs for convenience of description, the number of domain address-IP address pairs stored in the cache server 112 may be hundreds or thousands. That is, the cache server 112 stores a domain address-IP address pair for each of a plurality of web pages provided by one or more web servers 110, and uses the stored domain address-IP address pair to normalize the above-mentioned. Traffic may be forwarded to the web server 110 .

As described above, the cache server 112 may be connected 1:1 to the attack blocking server 108 and receive normal traffic from the attack blocking server 108 . At this time, the attack blocking server 108 may transmit the domain address (eg, “abc.com”) of the web page that the attacker terminal 102 wants to access to the cache server 112 . The cache server 112 uses an IP address (ie, “1.1.1.1”) corresponding to the domain address (ie, “abc.com”) received from the attack blocking server 108 among the IP addresses stored in the cache server 112. The normal traffic can be delivered to the web server 110 having That is, the cache server 112 can forward the normal traffic to the web server 110 by converting the access IP address of the normal traffic to the IP address stored in the cache server 112 (ie, “1.1.1.1”). . As described above, since the cache server 112 is located in the same network as the web server 110 (that is, inside the company intranet 130), the normal traffic is transmitted to the web server 110 through the company intranet 130. ) can be smoothly transmitted.

According to embodiments of the present invention, normal traffic received from the attack blocking server 108 can be easily forwarded to the web server 110 using the domain address-IP address pair stored in the cache server 112. Accordingly, unlike the prior art, there is no need to additionally allocate an IP address for each web page (or service) to be defended. In addition, according to the embodiments of the present invention, since there is no need to additionally allocate an IP address for each web page (or service) to be defended, unlike the prior art, there is no need to additionally change network and firewall settings. A response procedure for an attack by the attacker terminal 102 can be simplified.

In addition, a range of IP addresses for each of a plurality of web pages provided by the web server 110 may be different from a range of IP addresses of the cache server 112 . As an example, the range of IP addresses for each of the plurality of web pages provided by the web server 110 may be “1.1.1.1 to 1.1.1.255”, but the range of IP addresses of the cache server 112 is different from this. It can be “2.2.2.2”. That is, according to the embodiments of the present invention, since the range of IP addresses for each of the plurality of web pages provided by the web server 110 is different from the range of IP addresses of the cache server 112, the external cache server ( 112) has the effect of hiding the IP address, and thus network security can be strengthened.

3 is a flowchart illustrating a network security method according to an embodiment of the present invention. In the illustrated flowchart, the method is divided into a plurality of steps, but at least some of the steps are performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, or not shown. One or more steps may be added and performed.

In step S302, the IP blocking engine 104 blocks the IP address of the web page accessible through the external internet network 120 when the attacker terminal 102 tries to access the web page provided by the web server 110. do. The IP blocking engine 104 may include an attack detection means (not shown) such as a DDoS detection device, and when an attack of the attacker terminal 102 is detected through the attack detection means, the web page to be defended IP addresses can be blocked at the top of the network. At this time, the IP blocking engine 104 may block all normal traffic generated from the user terminal as well as attack traffic generated from the attacker terminal 102 . Accordingly, all traffic flowing into the company intranet 130 through the Internet network 120 may be blocked.

In step S304, the DNS server 106 changes the DNS information of the web page that the attacker terminal 102 wants to access and diverts the traffic of the attacker terminal 102 and the user terminal to the attack blocking server 108. Specifically, the DNS server 106 blocks the traffic of the attacker terminal 102 and the user terminal by changing the IP address of the DNS server 106 to the IP address of the attack blocking server 108 (eg, 3.3.3.3). It can be diverted to the attack blocking server 108. Accordingly, an inflow path of traffic generated from the attacker terminal 102 and the user terminal trying to access the web page may be changed to the attack blocking server 108 .

In step S306, the attack blocking server 108 refers to the changed IP address (eg, 3.3.3.3) of the DNS server 106 and blocks attack traffic among incoming traffic. The attack blocking server 108 may include, for example, a DDoS protection device, and may detect and block attack traffic using the DDoS protection device. As described above, the attack blocking server 108 may be located outside the company intranet 130 and may be connected to the cache server 112 1:1. Accordingly, the attack blocking server 108 may block the attack traffic and deliver the remaining normal traffic to the cache server 112 . At this time, the attack blocking server 108 may transmit the domain address of the web page to the cache server 112 .

In step S308, the cache server 112 transfers the normal traffic to the web server 110 using the domain address and IP address stored in the cache server 112. Specifically, the cache server 112 may forward the normal traffic to the web server 100 having an IP address corresponding to the domain address received from the attack blocking server 108 among the IP addresses stored in the cache server 112. . That is, the cache server 112 can forward the normal traffic to the web server 110 by converting the access IP address of the normal traffic into an IP address corresponding to the domain address received from the attack blocking server 108 .

Although the present invention has been described in detail through representative examples above, those skilled in the art can make various modifications to the above-described embodiments without departing from the scope of the present invention. will understand Therefore, the scope of the present invention should not be limited to the described embodiments and should not be defined, and should be defined by not only the claims to be described later, but also those equivalent to these claims.

10, 100: network security system
12, 102: attacker terminal
14, 104: IP blocking engine
16, 106: DNS server
18, 108: attack blocking server
20, 110: web server
112: cache server
30, 120: internet network
40, 130: in-house intranet

Claims (10)

By changing the IP address of the DNS (Domain Name Service) information for the web page provided by the web server to the IP address of the attack blocking server, the attack traffic of the attacker's terminal and the normal traffic of the user terminal for the web page are transferred to the attack blocking server. DNS servers configured to bypass;
the attack blocking server configured to block the attack traffic and forward the normal traffic and the domain address of the web page to a cache server; and
It stores domain address-IP address pairs for a plurality of web pages provided by the web server, and corresponds to the domain address received from the attack blocking server using the domain address-IP address pair, and the IP address of the attack blocking server and the cache server configured to acquire an IP address that has not been changed as an address, and deliver the normal traffic to the web server using the acquired IP address.
The method of claim 1,
The web server and the cache server are located inside the company intranet,
The DNS server and the attack blocking server are located outside the company intranet, the network security system.
The method of claim 2,
A band of IP addresses for a plurality of web pages provided by the web server is different from a band of IP addresses of the cache server, the network security system.
delete The method of claim 1,
The network security system further comprises an IP blocking engine configured to block an IP address of the web page accessible through an external Internet network when attack traffic to the web page is detected.
In the DNS server, the IP address of the DNS (Domain Name Service) information for the web page provided by the web server is changed to the IP address of the attack blocking server, so that the attack traffic of the attacker terminal and the normal traffic of the user terminal for the web page are changed. bypassing the attack blocking server;
In the attack blocking server, blocking the attack traffic and forwarding the normal traffic and the domain address of the web page to a cache server; and
The cache server stores domain address-IP address pairs for a plurality of web pages provided by the web server, and corresponds to the domain address received from the attack blocking server using the domain address IP address pair, and the attack A network security method comprising obtaining an IP address that is not changed as an IP address of a blocking server and forwarding the normal traffic to the web server using the obtained IP address.
The method of claim 6,
The web server and the cache server are located inside the company intranet,
The network security method of claim 1 , wherein the DNS server and the attack blocking server are located outside the company intranet.
The method of claim 7,
Bands of IP addresses for a plurality of web pages provided by the web server are different from bands of IP addresses of the cache server, network security method.
delete The method of claim 6,
The network security method of claim 1 , further comprising blocking an IP address of the web page accessible through an external internet network when an attack traffic to the web page is detected by an IP blocking engine.

Images