KR102649648B1 - Firewall policy application automation server, system having the same, and method using the same - Google Patents

Abstract

The present invention relates to a firewall policy application automation server, a system including the same, and a firewall policy application automation method using the same. A firewall capable of automatically operating heterogeneous firewall systems by automating policy application to heterogeneous firewalls without subjective intervention by the user. It relates to a policy application automation server, a system including the same, and a method of automating firewall policy application using the same.
The present invention is a firewall policy application automation server 200 for heterogeneous firewalls, and includes a firewall policy application automation server 200 that receives an application request containing information on a new firewall policy and applies the new firewall policy. , the firewall policy application automation server 200 includes a work log unit 260 that collects and stores work records related to the application of the new firewall policy. do.

Description

Firewall policy application automation server, automation system including the same, and firewall policy application automation method using the same {Firewall policy application automation server, system having the same, and method using the same}

The present invention relates to a firewall policy application automation server, a system, and a firewall policy application automation method using the same according to the present invention, which can automatically operate heterogeneous firewall systems by automating policy application to heterogeneous firewalls without subjective intervention by the user. This relates to a firewall policy application automation system and a firewall policy application automation method using the same.

A firewall or firewall refers to a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules to determine whether to allow or block certain traffic. Constructs a barrier between trusted internal networks and untrusted external networks.

IT infrastructure is continuously expanding and subdividing, and most companies and organizations above a certain size use a variety of different vendor firewalls (heterogeneous).

As external hacking attempts through the network are increasing exponentially, the number and type of firewalls to prevent attacks using vulnerabilities and variant malicious codes are bound to increase. Considering various network devices such as routers and switches, many problems in operating firewalls and network devices result from the complexity of these environments. In the case of places that operate up to hundreds of firewalls, business inefficiency is bound to increase because they operate more security and analysis equipment compared to the operating personnel.

There are dozens or even hundreds of operational and security control policies that practitioners must manage. The number of policy objects can reach hundreds of thousands depending on business complexity and security level. For this reason, it is necessary to understand the contents and characteristics of all managed services, but in reality, it is too difficult to achieve this. If the policy applicant is unaware of the effectiveness and appropriateness of the permitted policy and has low interest, a practical permission policy based on network security cannot be expected. In these situations, the policy application or evidence requested by the application department is often not left intact. When multiple or heterogeneous firewall policies are discovered that have not been used for a long time or whose purpose is unclear, policy managers cannot quickly make decisions such as discontinuing or deleting policies if policy history is not fully managed. This management difficulty becomes a security hole.

Operating heterogeneous firewalls means that other firewalls may be affected by newly applied policies and may interfere with normal operation between networks. The reality is that 99% of network security incidents are caused by incorrect policy configuration, not by defects in security equipment.

Increasing the complexity of policy settings or management for each firewall causes increased workload for practitioners, which inevitably increases time and cost. In other words, the time and cost required to understand the multiple security policies applied to the firewall and their mutually influencing relationships inevitably increase as heterogeneous firewalls are operated. To solve this problem, an integrated management tool is needed that provides analysis and optimization of usage rates by policy and rule and can automate the application of heterogeneous firewall policies.

The purpose of the present invention, in recognition of the above-mentioned need, is to provide a firewall policy application automation system optimized for new policy reception, design, analysis, automated application, and operation verification for heterogeneous firewalls, and an automated firewall policy application method using the same. there is.

The present invention was created to achieve the purpose of the present invention as described above, and discloses a firewall policy application automation server 200 that receives an application request containing information on a new firewall policy and applies the new firewall policy. .

The firewall policy application automation server 200 may include a work log unit 260 that collects and stores work records related to application of the new firewall policy.

The firewall policy application automation server 200 includes a receiving unit 210 that receives the application request, a request recognition/registration unit 220 that registers information about the new firewall policy included in the application request, and the new It may include a policy configuration unit 230 that designs a policy application plan according to information about the firewall policy, and a policy application unit 240 that applies the new firewall policy to the firewall of the associated network based on the policy application plan. there is.

The firewall policy application automation server 200 may further include a schedule management unit 250 that sets a schedule for applying the policy application method.

The policy application unit 240 may include a playbook module (SP) that manages a playbook including policy application scenarios for each firewall device.

The work log unit 260 may include a work video unit 262 that generates a work video visualizing the process of applying the new firewall policy.

The work log unit 260 may include a screen capture unit 264 that generates screenshots for each application step of the new firewall policy.

The work log unit 260 may include a work log collection unit 266 that collects event logs for each step of applying the new firewall policy.

The firewall policy application automation server 200 may further include an operation verification unit 270 that checks whether the new firewall policy is applied normally after completion of application.

The firewall policy application automation server 200 may further include a policy synchronization processing unit 280 that detects whether the policy of each firewall device has changed and synchronizes the firewall policy.

In another aspect, the present invention is an automated firewall policy application system 1000 for heterogeneous firewalls, comprising a user terminal 100; It is connected to the user terminal 100 through a network and includes a firewall policy application automation server 200 that receives an application request containing information about a new firewall policy from the user terminal 100.

In another aspect, the present invention discloses a method of automating firewall policy application performed by the firewall policy application automation server 200, which automates firewall policy application to heterogeneous firewalls.

The firewall policy application automation server, the system including the same, and the firewall policy application automation method using the same according to the present invention enable tasks without restrictions such as creating a new policy, utilizing an existing policy, deleting an existing policy, adding an existing configuration, and removing an existing configuration, thereby enabling automation. It has the advantage of improving the reliability of automated work by expanding the scope and verifying work details.

In addition, the firewall policy application automation server according to the present invention, the system including the same, and the firewall policy application automation method using the same allow the automated work history to be visually confirmed by visualizing the policy application process through video and screen capture to check the work history. It has the advantage of ensuring transparency of automation work.

In addition, the firewall policy application automation server, the system including the same, and the firewall policy application automation method using the same according to the present invention have the advantage of securing the diversity of automation work by supporting automated work methods according to the characteristics of each heterogeneous firewall equipment. there is.

In addition, the firewall policy application automation server, the system including the same, and the firewall policy application automation method using the same according to the present invention have the advantage of being able to verify whether the new firewall policy has been applied properly after completing the task for applying the new firewall policy.

Figure 1 is a conceptual diagram showing an automated firewall policy application system according to an embodiment of the present invention.
FIG. 2 is a conceptual diagram illustrating an automated firewall policy application process performed in the firewall policy application automation system of FIG. 1.
Figure 3 is a block diagram showing the firewall policy application automation server that constitutes the firewall policy application automation system of Figure 1.
FIG. 4 is a flow chart explaining a method of automating firewall policy application performed in the firewall policy application automation system of FIG. 1.

Hereinafter, the firewall policy application automation server according to the present invention, the system including the same, and the firewall policy application automation method using the same will be described with reference to the attached drawings.

As shown in FIG. 1, the firewall policy application automation system 1000 according to the present invention is connected to the user terminal 100 and the user terminal 100 through a network, and receives new information from the user terminal 100. It may include a firewall policy application automation server 200 that receives an application request containing information about the firewall policy and applies the new firewall policy.

The user terminal 100 corresponds to a computing device connected through a network to the firewall policy application automation server 200, which will be described later, and may be implemented as, for example, a desktop, laptop, tablet PC, or smartphone, and may be implemented through a firewall. It may include a network interface for network connection to the policy application automation server 200 and a user input/output interface for user input/output.

For example, the user terminal 100 may correspond to a mobile terminal and may be connected to the firewall policy application automation server 200 through cellular communication or Wi-Fi communication.

As another example, the user terminal 100 may correspond to a desktop and may be connected to the firewall policy application automation server 200 through the Internet.

An application request containing information about a new firewall policy may be entered into the user terminal 100.

Here, a new firewall policy may include a wide range of tasks such as creating a new policy, utilizing an existing policy, deleting an existing policy, adding an existing policy configuration, and deleting an existing policy configuration.

To this end, the firewall policy application automation system can be linked to the firewall application system 300 through API or EAI. Through this, policy application services such as firewall policy application, reception, application/approval history management, and work/processing status inquiry can be provided.

The application request includes information about the new firewall policy and can be entered in the form of a UI including a document, DB to DB, API, etc.

If the application request is entered in document form, it may be defined as an application document.

The application document may be a document file in the form of HWP, PDF, etc., and may be uploaded through the firewall application system 300.

The above application documents include applicant information (organization name, department name, name, phone number, fax number, e-mail, etc.), basis for application, application details (application classification (allow/block), source IP address, destination address) (Destination IP Address), permission request port, TCP port, communication direction (unidirectional/bidirectional), permission request period, business purpose, etc. may be included.

As another example, of course, the application request can be entered through direct linkage between the UI of the user terminal 100 and the data of the firewall application system 300, in addition to the application document.

The feasibility of the application request (application document) can be reviewed through the firewall application system 300, and the application request (application document) can be approved or rejected depending on the review results.

The approved application request can be received and newly registered by the firewall policy application automation server 200, which will be described later.

The firewall policy application automation server 200 is connected to the user terminal 100 through a network, and receives an application request containing information about a new firewall policy from the user terminal 100 to apply the new firewall policy. Various configurations are possible depending on the configuration applied.

The firewall policy application automation server 200 is a plurality of heterogeneous firewall equipment (A ₁ , ??, A _N , B ₁ , ??, B _M ) included in each of a plurality of networks (NET1, NET2, ??) ) may be a server for automating policy application operation.

For example, the firewall policy application automation server 200 includes a receiving unit 210 that receives the application request from the user terminal 100, and a request recognition device that registers information about the new firewall policy included in the application request. /register 220, a policy composition unit 230 that designs a policy application plan according to the information about the new firewall policy included in the application request, and a network associated with the new firewall policy based on the policy application plan It may include a policy application unit 240 that applies to the firewall.

The receiving unit 210 can have various configurations for receiving the application request from the user terminal 100.

As an example, the receiving unit 210 may receive a newly registered application document uploaded through the firewall application system 300.

The request recognition/registration unit 220 is configured to recognize and register the received application request. When the application request is received in the form of an application document, it recognizes the items in the application document by component through character recognition (OCR). (File conversion) and automatically register new firewall policy application details for each item.

A new firewall policy application can be constructed from the application request received through the request recognition/registration unit 220.

The policy configuration unit 230 can be configured to design a policy application plan according to the information about the new firewall policy included in the application request, and can be configured in various ways.

The policy composition unit 230 can automatically process policy composition design work based on the new firewall policy application formed by the request recognition/registration unit 220 to derive a policy application plan.

The policy configuration unit 230 can configure object work contents according to the firewall information according to the policy application plan.

The policy composition unit 230 may analyze the firewall equipment subject to the new firewall policy, check the suitability and compliance of the data fields of the new firewall policy application, and construct a draft design work.

The policy configuration unit 230 can automatically analyze the information collected for each heterogeneous firewall equipment and the applied new firewall policy to derive an optimized design plan without the intervention of a firewall manager.

At this time, the policy composition unit 230 may analyze existing overlapping or similar firewall policies and confirm the design for applying the new firewall policy.

Additionally, the policy configuration unit 230 may include a playbook module (SP) that manages a playbook including policy application scenarios (policy design plan, application plan, etc.) for each firewall device.

The policy configuration unit 230 provides policy application scenarios and automation progress steps for each firewall device (application request reception (application document upload), request recognition/registration (file conversion), new firewall policy application form through the playbook module (SP). configuration, policy configuration, and schedule configuration) can be adjusted.

The policy application unit 240 can be configured in various configurations to automatically apply the new firewall policy to the firewall of the associated network based on the policy application plan (design plan)/playbook settings/schedule configuration.

The policy application unit 240 performs automation work when the design of the policy application plan is confirmed through the policy configuration unit 230, and in the case of a policy application plan that is outside the processing scope of the automated work, it is classified as an incorrect policy application plan design and automated. Work can be prevented.

The policy application unit 240 can apply a new firewall policy by supporting various work methods for linking work target systems such as CLI, GUI, and API depending on the characteristics of the firewall equipment.

In addition, the policy application unit 240 may be an RPA (Robotic Process Automation) for automating the application of a new firewall policy, and may be operated in isolation in a security sandbox in attended RPA (in-attend mode). there is.

At this time, the policy application unit 240 is firewall equipment such as HTML WEB GUI RPA, FLASH WEB GUI RPA, WINDOWS APP GUI RPA, REST API RPA (JSON), SOAP API RPA (XML), and SSH CLI RPA (COMMAND LINE). It can respond automatically according to the manufacturer's method of provision.

The policy application unit 240 imitates human interaction for automated firewall policy processing within the GUI, so that the process of automating the application of a new firewall policy within the GUI can be visualized. there is.

The automated work process of applying the new firewall policy through the policy application unit 240 can be checked in real time by the user through the live screen.

Although not shown, the policy application unit 240 may also include a playbook module (SP) that manages a playbook including policy application scenarios, and the design plan derived through the policy configuration unit 230 may be used to implement the policy. In the application unit 240, it can be applied to the corresponding firewall according to the policy application scenario by the playbook module (SP).

Meanwhile, the firewall policy application automation server 200 may additionally include a schedule management unit 250 that sets a schedule for applying the policy application method.

The schedule management unit 250 can be configured in various configurations to manage a schedule to automate the application of a new firewall policy according to the policy application method.

The schedule management unit 250 can set a schedule for automatically applying a new firewall policy. Depending on the firewall equipment, the schedule management unit 250 can apply the new firewall policy immediately after configuring the policy, or set a separate schedule to configure the new firewall policy application schedule.

Additionally, the firewall policy application automation server 200 may include a work log unit 260 that collects and stores work records related to application of the new firewall policy.

The work log unit 260 can be configured to accumulate work records for post-verification, such as the appropriateness of new firewall policy automation work and identification of malfunctions, and can be configured in various ways.

As an example, the work log unit 260 may include a work video unit 262 that generates a work video visualizing the process of applying the new firewall policy.

The working video is a video that visualizes all stages of the process of applying a new firewall policy like a CCTV, and can be transmitted (live screen) and stored in real time when working.

Since the execution of the command to apply the new firewall policy is performed in the background, errors occurring during operation during the application of the new firewall policy are determined only through the response information of the work command. Therefore, there is a problem in that errors occurring inside the firewall equipment cannot be determined. .

The work video unit 262 according to the present invention creates a work video by visualizing all work operations in the background/foreground, so it has the advantage of being able to accurately determine whether there is an operation abnormality between operations and the time of malfunction later.

Additionally, the work log unit 260 may include a screen capture unit 264 that generates screenshots for each application step of the new firewall policy.

The screen capture unit 264 can generate screenshots for each stage of application of the new firewall policy and store proof of work results for each stage.

Additionally, the work log collection unit 260 may include a work log collection unit 266 that collects event logs for each step of applying the new firewall policy.

The work log collection unit 266 records request and response logs between tasks for each application stage of the new firewall policy, creates traces between unit tasks, and enables verification of malfunctions when a defect occurs. there is.

The work log unit 260 according to the present invention can easily implement post-verification of automated processing results by collecting/saving work videos, screenshots, event logs, and parameters for each step of applying the new fire prevention policy. There is an advantage.

Meanwhile, the firewall policy application automation server 200 may additionally include an operation verification unit 270 that checks whether the new firewall policy is applied normally after completion of application.

The work verification unit 270 can verify work details for each step of the automation work and automatically verify whether the work has been properly applied after completion of the automation work.

After completion of the automation task, the task verification unit 270 collects the firewall policy and checks whether the applied new firewall policy has been properly applied to the firewall, thereby verifying whether the automation task has been properly applied.

When the firewall policy application automation server 200 confirms normal application through the operation verification unit 270, it can reply (send) to the user terminal 100 that the new firewall policy has been properly applied.

Meanwhile, the firewall policy application automation server 200 may additionally include a policy synchronization processing unit 280 that synchronizes the firewall policy by detecting whether the policy of each firewall device has changed for heterogeneous firewalls.

The policy synchronization processing unit 280 continuously receives syslogs from each firewall device in real time and can detect signatures related to firewall policy changes in the syslogs. The policy synchronization processing unit 280 can immediately synchronize the firewall policy when detecting a change in the firewall policy.

Since the firewall policy application automation server 200 according to the present invention always accurately synchronizes the firewall policy through the policy synchronization processing unit 280, the policy composition unit 230 derives an optimal policy application method suitable for each point in time. can do.

Meanwhile, the firewall policy application automation server 200 according to the present invention, in addition to the above-described configuration, includes an abnormality symptom monitoring module for various events that occur when heterogeneous firewalls are operated, various screen resource operation management modules, and automatic application of firewall policy to telecommuters. To this end, a user identification module linked to the human resources system, an information security asset registration/management/analysis module for heterogeneous firewall management, and a dashboard module showing firewall policy application status (application status, reception status, application status, application status, etc.) were added. It can be included as .

By using the firewall policy application automation server 200 according to the present invention, the entire process of firewall policy application, approval, reception, design, application, and verification can be implemented as automated operation (autopilot) without subjective user intervention.

Hereinafter, with reference to FIGS. 2 and 4, the method of automating firewall policy application performed by the firewall policy application automation server 200 will be described in detail.

The firewall policy application automation method includes a request reception step (S401) of receiving an application request containing information about a new firewall policy, a request recognition/registration step (S402) of recognizing/registering application requests received at all times, and A policy configuration step (S403) for configuring a policy application plan for applying a new firewall policy based on the application request, and a schedule configuration step (S404) for configuring a schedule to perform automation tasks according to the policy application plan, A policy application step (S405) to automatically apply a new firewall policy according to the policy application plan and schedule, a work verification step (S406) to verify work details according to the automated work, and the work completion details to the user terminal (100). It may include a task completion details transmission step (S407).

Since the above is only a description of some of the preferred embodiments that can be implemented by the present invention, as is well known, the scope of the present invention should not be construed as limited to the above embodiments, and the scope of the present invention described above Both the technical idea and the technical idea underlying it will be said to be included in the scope of the present invention.

100: User terminal
200: Firewall policy application automation server

Claims (11)

As a firewall policy application automation server (200) for heterogeneous firewalls,
It includes a firewall policy application automation server 200 that receives an application request containing information about a new firewall policy and applies the new firewall policy,
The firewall policy application automation server 200 includes a work log unit 260 that collects and stores work records related to the application of the new firewall policy,
The firewall policy application automation server 200 includes a receiving unit 210 that receives the application request, a request recognition/registration unit 220 that registers information about the new firewall policy included in the application request, and the new It includes a policy configuration unit 230 that designs a policy application plan according to information about the firewall policy, and a policy application unit 240 that applies the new firewall policy to the firewall of the associated network based on the policy application plan,
The policy application unit 240 is an RPA for automated work that applies the new firewall policy,
The work log unit 260 includes a work video unit 262 that generates a work video visualizing the process of applying the new firewall policy by the RPA,
The firewall policy application automation server 200 is characterized in that the work video is transmitted in real time through a live screen. delete In claim 1,
The firewall policy application automation server 200 further includes a schedule management unit 250 that sets a schedule for applying the policy application method. In claim 1,
The policy application unit 240 is a firewall policy application automation server 200, characterized in that it includes a playbook module (SP) that manages a playbook including policy application scenarios for each firewall device. delete In claim 1,
The work log unit 260 includes a screen capture unit 264 that generates screenshots for each application step of the new firewall policy. In claim 1,
The work log unit 260 includes a work log collection unit 266 that collects event logs for each step of applying the new firewall policy. In claim 1,
The firewall policy application automation server 200 further includes an operation verification unit 270 that checks whether the new firewall policy is applied normally after completion of application. In claim 1,
The firewall policy application automation server 200 further includes a policy synchronization processing unit 280 that detects whether the policy of each firewall device has changed and synchronizes the firewall policy. As an automated firewall policy application system (1000) for heterogeneous firewalls,
A user terminal 100;
Any of claims 1, 3, 4, and 6 to 9, which is connected to the user terminal 100 through a network and receives an application request containing information about a new firewall policy from the user terminal 100. A firewall policy application automation system (1000) comprising a firewall policy application automation server (200) according to one clause. A method of automating firewall policy application performed in the firewall policy application automation server 200 according to any one of claims 1, 3, 4, and claims 6 to 9, which automates firewall policy application to heterogeneous firewalls.

Images