KR102666943B1 - Method for managing network using micro-segmentation for zero trust security and access switch using the same - Google Patents

Abstract

The present invention relates to a method of managing a network using micro-segmentation for zero trust security, (a) a specific access switch, which is one of the access switches that allow network devices to communicate with each other within the network, When the first forwarding is performed for a packet transmitted to a specific port among the ports of the access switch, the source MAC address corresponding to the specific network device that transmitted the packet is obtained from the Ethernet head of the packet, and the source MAC Check whether the address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, group each port of each of the access switches according to a network security policy for zero trust security. Among the classified micro-segments, the source MAC address is registered in the MAC table with reference to the specific user security policy set for the specific micro-segmentation corresponding to the specific port of the specific access switch, and the source MAC address is registered in the MAC table. In a state registered in a table, checking whether the source MAC address satisfies the specific user security policy, and performing second forwarding for the packet if the source MAC address satisfies the specific user security policy; and (b) the specific access switch obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is not registered in the routing table. In this case, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and a destination IP address is selected from the IP head of the packet. or filtering the packet on which the third forwarding is performed by obtaining a service port and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation; It relates to a method of including .

Description

Method for managing a network using micro-segmentation for zero trust security and access switch using the same {METHOD FOR MANAGING NETWORK USING MICRO-SEGMENTATION FOR ZERO TRUST SECURITY AND ACCESS SWITCH USING THE SAME}

The present invention relates to a network management method for zero trust security, and more specifically, to a method of managing a network by having an access switch of the network perform packet switching using micro segmentation for zero trust security. .

The perimeter security model is a powerful network security model for controlling access from a company's external network to its internal network, but the biggest problem with the perimeter security model lies in the boundary itself. That is, security controls are concentrated at the perimeter, and once the boundary is crossed, security controls can no longer be applied.

In the boundary security model, allowing access means trusting the accessing subject, so access to internal resources is allowed because the accessor is trusted. For example, computers located on the internal business network use internal IP addresses, so they operate on the principle of basic trust by internal security equipment.

Attackers are abusing this trust relationship and using it for attacks, seizing internal terminals that have already been granted trust and exploiting them for attacks. The border security module applies security control only at the border, which is the interface between the external network and the internal network, so it cannot detect or block threats located inside beyond the border.

In other words, an attacker can use malicious code to infect computers located on the internal network and then use the infected computer as a base to attack information assets. Therefore, the company's internal network, which was previously a source of trust, can no longer be trusted. It has disappeared. Therefore, it is necessary to assume that an attacker has already infiltrated the company's internal network, and procedures to detect and respond to attacks have become necessary even in the worst-case scenario.

As a way to solve the problems of this perimeter security model, the Zero Trust Security model was proposed.

Zero trust security essentially keeps data and resources inaccessible and allows users limited access to those data and resources under appropriate circumstances. This is called least-privilege access.

The Zero Trust security model assumes that every user, device or application on the network is a potential threat and must undergo an authentication step before being granted access. In other words, rather than granting access based on the user's location or network, permission is granted based on identity, device used, and requested content.

Therefore, the zero trust security model has the advantage of being excellent in safety because it enforces device authentication for all access requests, and improving work flexibility by allowing users to access safely from anywhere. Additionally, security can be applied flexibly because the operation of users and devices is continuously monitored.

However, significant time and investment is required to implement the zero trust security model in the system, and each access request must be individually authenticated, which complicates implementation and increases management costs. Additionally, since authentication is forced on the user, there is a problem of deteriorating the user experience.

Therefore, the present applicant would like to propose a method to more efficiently implement the network security model for zero trust security.

The purpose of the present invention is to solve all the problems of the prior art described above.

Another purpose of the present invention is to enable a network security model for zero trust security to be implemented quickly and at low cost.

Additionally, another purpose of the present invention is to enable a simpler implementation of a network security model for zero trust security.

Another purpose of the present invention is to enable low-cost management of a network security model for zero trust security.

Another purpose of the present invention is to prevent deterioration of user experience due to application of a network security model for zero trust security.

A representative configuration of the present invention to achieve the above object is as follows.

According to an embodiment of the present invention, in a method of managing a network using micro-segmentation for zero trust security, (a) a specific device, one of the access switches that allow network devices to communicate with each other within the network, When the access switch performs the first forwarding of a packet transmitted to a specific port among the ports of the specific access switch, a source MAC address corresponding to the specific network device that transmitted the packet is generated from the Ethernet head of the packet. Obtain and check whether the source MAC address is registered in the MAC address table. If the source MAC address is not registered in the MAC address table, configure each port of the access switches for zero trust security. The source MAC address is registered in the MAC table by referring to a specific user security policy set for a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segments grouped and classified according to a network security policy, and With the source MAC address registered in the MAC table, check whether the source MAC address satisfies the specific user security policy, and if the source MAC address satisfies the specific user security policy, second forwarding for the packet performing steps; and (b) the specific access switch obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is not registered in the routing table. In this case, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and a destination IP address is selected from the IP head of the packet. or filtering the packet on which the third forwarding is performed by obtaining a service port and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation; A method including is provided.

In one embodiment, the micro-segments are set by a network controller that manages the access switches, and the micro-segments are set by the network controller by dividing into pairs of access switches and ports according to the network security policy, , with each user security policy set for each of the micro-segments, analyzing ARP (Address Resolution Protocol) packets obtained by filtering each packet for which the first forwarding is performed in each of the access switches. Each of the network devices coupled to each of the ports of each of the access switches is detected, and the network devices are connected to each of the micro-segments corresponding to each of the ports to which each of the network devices is coupled to each user. It may have been registered in accordance with the security policy.

In one embodiment, in step (a), the specific user security policy enables MAC address learning for all MAC addresses and forwards learned MAC addresses, but only MAC addresses registered as a blacklist. and a first blacklist mode that drops, wherein in the first blacklist mode, the specific access switch, with the MAC address learning enabled, (i) registers the source MAC address in the MAC address table. As a result of checking whether the source MAC address is registered in the MAC address table, it is checked whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, the packet block the second forwarding for the packet, and perform the second forwarding for the packet if the source MAC address is not registered in the blacklist, and (ii) determine whether the source MAC address is registered in the MAC address table. As a result of checking, if it is confirmed that the source MAC address is not registered in the MAC address table, the source MAC address is registered in the MAC address table through MAC address learning, and the source MAC address is registered in the blacklist. Check whether the source MAC address is registered in the blacklist, block the second forwarding for the packet, and if the source MAC address is not registered in the blacklist, block the second forwarding for the packet. It can be done.

In one embodiment, in step (a), the specific user security policy disables MAC address learning for all MAC addresses, and registers and forwards only MAC addresses registered as a whitelist in the MAC address table. However, it includes a first whitelist mode in which the remaining MAC addresses are dropped, and in the first whitelist mode, the specific access switch, with the MAC address learning disabled, (i) the source MAC address If it is confirmed that the source MAC address is registered in the MAC address table as a result of checking whether the source MAC address is registered in the MAC address table, the second forwarding is performed for the packet, and (ii) the source MAC address is registered in the MAC address table. As a result of checking whether the source MAC address is registered in the MAC address table, if it is confirmed that the source MAC address is not registered in the MAC address table, it is checked whether the source MAC address is registered in the whitelist, and the source MAC address is registered in the whitelist. Register the source MAC address in the MAC address table and perform the second forwarding for the packet, and if the source MAC address is not registered in the whitelist, block the second forwarding for the packet. You can.

In the above embodiment, in step (b), the specific service security policy includes a second blacklist mode for forwarding remaining destination IP addresses or remaining service ports excluding the set destination IP address or set service port, and Includes any one of a second whitelist mode that drops the remaining destination IP addresses or remaining service ports except for the set destination IP address or set service port, and (i) the specific service security policy is set to the second black list mode. In the case of list mode, the specific access switch checks whether the destination IP address or the service port of the packet on which the third forwarding is performed is registered in the blacklist, and the destination IP address or the service port is registered in the blacklist. If it is confirmed that the port is registered in the blacklist, the third forwarding for the packet is blocked, and if it is confirmed that the destination IP address or the service port is not registered in the blacklist, the third forwarding for the packet is blocked. (ii) when the specific service security policy is the second whitelist mode, the specific access switch selects the destination IP address of the packet for which the third forwarding is performed, or Check whether the service port is registered in the whitelist, and if it is confirmed that the destination IP address or the service port is registered in the whitelist, the third forwarding for the packet is permitted, and the destination If it is confirmed that the IP address or the service port is not registered in the whitelist, the third forwarding of the packet can be blocked.

In the embodiment, when the specific access switch blocks the third forwarding of the packet, the specific access switch transmits information related to the packet for which the third forwarding was blocked to the network controller to enable the network controller to transmit the third forwarding to the network controller. 3 By referring to the information related to the packet whose forwarding has been blocked, at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation can be updated, or the specific port of the specific access switch can be updated. It is possible to reset the corresponding specific micro segmentation.

In the above embodiment, in step (b), when the packet for which the second forwarding is performed is an ARP packet, the specific access switch does not perform the third forwarding for the packet and forwards the packet. Flooding can be done to ports other than the specific port of the specific access switch.

In the above embodiment, (c) the specific access switch transmits the packet on which the third forwarding is performed to a security module and causes the security module to analyze the packet to determine whether the packet is an abnormal packet, If the packet is confirmed to be an abnormal packet, blocking the third forwarding for the packet; It may further include.

According to another embodiment of the present invention, an access switch for managing a network using micro segmentation for zero trust security includes: a memory storing instructions for managing a network using micro segmentation for zero trust security; and a processor that manages a network using micro-segmentation for zero trust security according to the instructions stored in the memory. It includes, wherein the processor: (I) When the first forwarding is performed for a packet transmitted to a specific port among the ports of the access switch, the Ethernet head of the packet corresponds to the specific network device that transmitted the packet. , obtain the source MAC address, check whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, each port of the access switches Among the micro-segments grouped and classified according to the network security policy for zero trust security, the source MAC address is entered into the MAC table with reference to the specific user security policy set for the specific micro-segmentation corresponding to the specific port of the specific access switch. Register, and with the source MAC address registered in the MAC table, check whether the source MAC address satisfies the specific user security policy, and if the source MAC address satisfies the specific user security policy, the packet a process for performing second forwarding, and (II) obtaining a source IP address from the IP head of the packet, checking whether the source IP address is registered in the routing table, and determining whether the source IP address is registered in the routing table. If not registered, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and the IP header of the packet is A process of filtering the packet on which the third forwarding is performed by obtaining a destination IP address or service port and checking whether the destination IP address or service port satisfies a specific service security policy set for the specific micro-segmentation. An access switch that performs is provided.

In another embodiment, the micro-segments are set by a network controller that manages access switches that allow network devices to communicate with each other within a network, and are configured by the network controller to access switches and ports according to the network security policy. The micro-segments are set by dividing them into pairs, and with each user security policy set for each of the micro-segments, each packet for which the first forwarding is performed in each of the access switches is filtered and obtained. Each of the network devices coupled to each of the ports of each of the access switches is detected by analyzing one ARP (Address Resolution Protocol) packet, and the micro segmentation corresponding to each of the ports to which each of the network devices is coupled is performed. Each of the network devices may be registered according to the respective user security policy.

In the other embodiment, the processor, in process (I), configures the specific user security policy to enable MAC address learning for all MAC addresses, forward learned MAC addresses, and register them as a blacklist. A first blacklist mode that drops only MAC addresses that have been selected, and in the first blacklist mode, with the MAC address learning enabled, (i) whether the source MAC address is registered in the MAC address table. As a result of checking, if it is confirmed that the source MAC address is registered in the MAC address table, it is checked whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, the packet blocking the second forwarding, performing the second forwarding for the packet if the source MAC address is not registered in the blacklist, and (ii) checking whether the source MAC address is registered in the MAC address table. As a result, if it is confirmed that the source MAC address is not registered in the MAC address table, the source MAC address is registered in the MAC address table through MAC address learning, and whether the source MAC address is registered in the blacklist is determined. Check and block the second forwarding for the packet if the source MAC address is registered in the blacklist, and perform the second forwarding for the packet if the source MAC address is not registered in the blacklist. You can.

In the other embodiment, the processor, in process (I), disables MAC address learning for all MAC addresses, and only whitelists registered MAC addresses are stored in the MAC address table. and a first whitelist mode in which the remaining MAC addresses are registered and forwarded, and in the first whitelist mode, in a state in which the MAC address learning is disabled, (i) the source MAC address is If it is confirmed that the source MAC address is registered in the MAC address table as a result of checking whether it is registered in the MAC address table, the second forwarding is performed for the packet, and (ii) the source MAC address is the MAC address. As a result of checking whether the source MAC address is registered in the table, if it is confirmed that the source MAC address is not registered in the MAC address table, it is checked whether the source MAC address is registered in the white list, and the source MAC address is registered in the white list. If the source MAC address is registered in the MAC address table, the second forwarding for the packet can be performed, and if the source MAC address is not registered in the whitelist, the second forwarding for the packet can be blocked. .

In the other embodiment, the processor, in the process (II), sets the specific service security policy to a second black for forwarding the remaining destination IP addresses or remaining service ports excluding the configured destination IP address or configured service port. Includes any one of a list mode and a second whitelist mode that drops the remaining destination IP addresses or remaining service ports except for the set destination IP address or set service port, and (i) the specific service security policy is In the case of the second blacklist mode, it is checked whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in the blacklist, and whether the destination IP address or the service port is registered in the blacklist. If it is confirmed that it is registered in the blacklist, the third forwarding for the packet is blocked, and if it is confirmed that the destination IP address or the service port is not registered in the blacklist, the third forwarding for the packet is blocked. Third forwarding is permitted, and (ii) when the specific service security policy is the second whitelist mode, the destination IP address or the service port of the packet for which the third forwarding is performed is registered in the whitelist. If it is confirmed that the destination IP address or the service port is registered in the whitelist, the third forwarding for the packet is allowed, and the destination IP address or the service port is whitelisted. If it is confirmed that it is not registered in the list, the third forwarding for the packet can be blocked.

In the other embodiment, when the third forwarding of the packet is blocked, the processor transmits information related to the packet for which the third forwarding has been blocked to the network controller to enable the network controller to block the third forwarding. By referring to the information related to the blocked packet, at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation can be updated, or the information corresponding to the specific port of the specific access switch can be updated. The specific micro segmentation can be reset.

In the other embodiment, in the process (II), if the packet for which the first forwarding is performed is an ARP packet, the processor does not perform the third forwarding for the packet and forwards the packet to the specific Flooding can be done to the remaining ports of the access switch except for the specific port.

In the other embodiment, the processor, (III) transmits the packet on which the third forwarding is performed to a security module to have the security module analyze the packet to determine whether the packet is an abnormal packet, and If it is confirmed that this is an abnormal packet, a process of blocking the third forwarding for the packet can be further performed.

In addition, a computer-readable recording medium for recording a computer program for executing the method of the present invention is further provided.

According to the present invention, a network security model for zero trust security can be implemented quickly and at low cost.

According to the present invention, it is possible to more simply implement a network security model for zero trust security.

According to the present invention, it is possible to manage a network security model for zero trust security at low cost.

According to the present invention, it is possible to prevent deterioration in user experience due to applying a network security model for zero trust security.

The following drawings attached for use in explaining embodiments of the present invention are only some of the embodiments of the present invention, and to those skilled in the art (hereinafter “those skilled in the art”), the invention Other drawings can be obtained based on these drawings without further work being done.
Figure 1 schematically shows an access switch that manages a network using micro-segmentation for zero trust security according to an embodiment of the present invention.
Figure 2 schematically shows a method of managing a network using micro-segmentation for zero trust security according to an embodiment of the present invention.
Figure 3 schematically shows a network managed using micro-segmentation for zero trust security according to an embodiment of the present invention.

The detailed description of the present invention described below refers to the accompanying drawings, which show by way of example specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the invention are different from one another but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein may be implemented with changes from one embodiment to another without departing from the spirit and scope of the invention. Additionally, it should be understood that the location or arrangement of individual components within each embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the present invention should be taken to encompass the scope claimed by the claims and all equivalents thereof. Like reference numbers in the drawings indicate identical or similar elements throughout various aspects.

Hereinafter, several preferred embodiments of the present invention will be described in detail with reference to the attached drawings in order to enable those skilled in the art to easily practice the present invention.

1 schematically shows an access switch that manages a network using micro-segmentation for zero trust security according to an embodiment of the present invention. The access switch 1000 manages the network using micro-segmentation for zero trust security. It may include a memory 1100 in which instructions for managing are stored, and a processor 1200 that performs an operation of managing a network using micro-segmentation for zero trust security according to the instructions stored in the memory 1100. .

Specifically, access switch 1000 is typically a computing device (e.g., a device that may include a computer processor, memory, storage, input and output devices, and other components of a traditional computing device; electronic devices such as routers, switches, etc. The desired system utilizes a combination of communication devices (electronic information storage systems, such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner). This may be to achieve performance, but is not limited to this.

Additionally, the processor of the computing device may include hardware components such as a Micro Processing Unit (MPU) or Central Processing Unit (CPU), cache memory, and data bus. Additionally, the computing device may further include an operating system and a software component of an application that performs a specific purpose.

However, this does not exclude the case where the computing device includes an integrated processor in which a medium, processor, and memory are integrated for implementing the present invention.

Meanwhile, when the processor 1200 of the access switch 1000 performs the first forwarding of the packet transmitted to a specific port among the ports of the access switch according to the instructions stored in the memory 1100, the Ethernet head of the packet , obtain the source MAC address corresponding to the specific network device that transmitted the packet, check whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, the access switch Among the micro-segments in which each port is grouped and classified according to the network security policy for zero trust security, the source MAC address is determined by referring to the specific user security policy set in the specific micro-segmentation corresponding to the specific port of the specific access switch. Registered in the MAC table, and with the source MAC address registered in the MAC table, check whether the source MAC address satisfies a specific user security policy, and if the source MAC address satisfies the specific user security policy, a second A process that performs forwarding, and obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and if the source IP address is not registered in the routing table, the source IP address is routed. register in the table, perform third forwarding for the packet with the source IP address registered in the routing table, obtain the destination IP address or service port from the IP head of the packet, and obtain the destination IP address or service port A process of filtering packets for which third forwarding is performed can be performed by checking whether the service satisfies a specific service security policy set for a specific micro-segmentation.

A method of managing a network using micro-segmentation for zero trust security using an access switch according to an embodiment of the present invention configured as described above will be described with reference to FIG. 2 as follows.

First, the network controller that manages the access switches that allow network devices to communicate with each other within the network sets micro-segments that group each port of the access switches according to a network security policy for zero trust security. You can. In other words, the network controller can set micro-segments by dividing them into pairs of access switches and ports according to the network security policy for zero trust security, and set each user security policy for zero trust security for each of the set micro-segments. The set micro-segmentation and user security policies can be shown in Table 1 below.

Micro
Segmentation User Security Policy switch port network device default 1st blacklist mode not set
switches not set
ports A 1st blacklist mode Switch S1 GE1-10 B 1st whitelist mode switch S2 GE1-2 C 1st whitelist mode switch S2 GE3 switch s3 GE1 D 1st whitelist mode router GE1-10

According to Table 1 above, port GE1 to port GE10 of switch S1 can be set to micro segmentation A, port GE1 and port GE2 of switch S2 can be set to micro segmentation B, and port GE3 of switch S2 and port GE3 of switch S3. Port GE1 of can be set to micro segmentation C, and port GE1 to port GE10 of the router can be set to micro segmentation D. And, unspecified switches and port pairs can be set as default.

And, the network controller can set each user security policy for each micro segmentation.

As an example, according to Table 1 above, the first blacklist mode may be set in micro segmentation A, the first white list mode may be set in micro segmentation B, and the first white list mode may be set in micro segmentation C. It can be, and the first whitelist mode can be set in micro segmentation D. And, the first blacklist mode can be set as default. At this time, the first blacklist mode may be a user security policy that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered as a blacklist, and the first white The list mode may be a user security policy that disables MAC address learning for all MAC addresses, registers only whitelisted MAC addresses in the MAC address table and forwards them, but drops the remaining MAC addresses.

In addition, the network controller can set each service security policy for each micro segmentation. As an example, the status of setting the service security policy for each micro segmentation can be shown in Table 2 below.

Micro
Segmentation service security group Service Security Policy Service IP or port default None A II 2nd blacklist mode TELENTFTP
SV1-SV5 B II 2nd blacklist mode TELENTFTP
SV1-SV5 C I Second whitelist mode SV1
SV2 & SSH
SV3 & :8080, SSH
HTTPS D III Second whitelist mode SSH
SFTP

According to Table 2 above, in micro-segmentation A and micro-segmentation B, a second blacklist mode can be set as a service security policy, and service security group II with TELENT, FTP, and SV1-SV5 registered as service IPs or ports can be set. In micro-segmentation C, the second whitelist mode is set as the service security policy, and service security group I has SV1, “SV2 & SSH”, “SV3 & :8080, SSH”, and HTTPS registered as the service IP or port. It can be set, and in micro segmentation D, a second whitelist mode can be set as a service security policy, and service security group III with SSH and SFTP registered as a service IP or port can be set. At this time, the second blacklist mode may be a service security policy that forwards the remaining destination IP addresses or service ports except the set destination IP address or set service port, and the second whitelist mode may be a service security policy that forwards the set destination IP address or the remaining service port. Alternatively, it may be a service security policy that drops the remaining destination IP addresses or remaining service ports except for the set service port.

Additionally, the network controller transmits the user security policy and service security policy set for each micro-segmentation to each access switch so that each of the access switches can process packets according to the user security policy and service security policy set for each micro-segmentation. can do.

In this state, each of the access switches that allows network devices to communicate with each other within the network filters ARP packets from packets transmitted to its ports through an ARP (Address Resolution Protocol) filter, and each access switch uses its own By transmitting to the security module, each security module in each of the access switches analyzes the ARP packet, detects network devices connected to each port, and transmits the information on the detected network devices to the network controller that manages the access switches. It can be done. Then, the network controller refers to the micro-segments established by dividing into pairs of access switches and ports according to the network security policy, and assigns network devices to each user in each of the micro-segments corresponding to each port to which each of the network devices is connected. It can be registered (S100) according to the security policy.

Regarding this, the process by which the network controller sets up micro-segments is described in more detail with reference to FIG. 3 as follows.

Network devices physically connected to ports of each of the access switches located within the network, such as a wireless hub, router, switch S1, switch S2, and switch S3, can be detected as shown in Table 3 below.

network device switch port MAC address IP address W01 wireless hub 00:00:00:00:00:01 192.168.201.1 W02 wireless hub 00:00:00:00:00:02 192.168.201.2 M01 Switch S1 GE1 00:00:00:00:00:03 192.168.202.1 M02 Switch S1 GE2 00:00:00:00:00:04 192.168.202.2 M03 Switch S1 GE3 00:00:00:00:00:05 192.168.202.3 M04 switch S2 GE1 00:00:00:00:00:06 192.168.202.4 M05 switch S2 GE2 00:00:00:00:00:07 192.168.202.5 M06 switch S2 GE3 00:00:00:00:00:08 192.168.202.6 M07 switch s3 GE1 00:00:00:00:00:09 192.168.202.7 SV1 router GE1 00:00:00:00:00:10 192.168.203.1 SV2 router GE2 00:00:00:00:00:11 192.168.203.2 SV3 router GE3 00:00:00:00:00:12 192.168.203.3 SV4 router GE4 00:00:00:00:00:13 192.168.203.4 SV5 router GE5 00:00:00:00:00:14 192.168.203.5 SV6 router GE6 00:00:00:00:00:15 192.168.203.6

At this time, the information on the detected network devices may include the corresponding port of the access switch to which each of the network devices is connected, and the MAC address and IP address for each of the network devices.

Then, the network controller can group pairs of access switches and ports according to network security policies and register each network corresponding to the set micro-segments according to each user security policy, for example: It can be expressed as Table 4.

Micro
Segmentation User Security Policy switch port network device default 1st blacklist mode not set
switches not set
ports A 1st blacklist mode Switch S1 GE1-10 B 1st whitelist mode switch S2 GE1-2 M04 C 1st whitelist mode switch S2 GE3 M06
M07 switch s3 GE1 D 1st whitelist mode router GE1-10 SV1
SV2
SV3
SV4
SV5

That is, the network controller can register network devices corresponding to each blacklist or whitelist for each micro segmentation.

For example, according to Table 4 above, network device M04 may be registered in micro-segmentation B, network devices M06 and M07 may be registered in micro-segmentation C, and network devices SV1 to SV5 may be registered in micro-segmentation D, and the list of these network devices may be registered by the user. Depending on the security policy, it may be a blacklist or a whitelist. That is, when the user security policy is in the first blacklist mode, the network device list can be a blacklist, and when the user security policy is in the first whitelist mode, the network device list can be a whitelist. For example, for ports GE1 to GE10 of the router, in micro-segmentation D set to the first whitelist mode, it can be seen that server SV6 connected to port GE6 of the router is excluded from the network device list because it is a network device that is not allowed to communicate. there is. In addition, with respect to port GE1 and port GE2 of switch S2, in micro segmentation B set to the first whitelist mode, the network device M05 connected to port GE2 of switch S2 is a network device that is not allowed to communicate and is therefore excluded from the network device list. Able to know.

Referring again to FIG. 2, in this state, a specific access switch 1000, which is one of the access switches that allow network devices to communicate with each other within the network, checks the source MAC address of a packet transmitted to a specific port. And, MAC learning can be performed (S200) according to a specific user security policy set in a specific micro-segmentation corresponding to a specific port. This may be to perform access control on connected devices trying to access the network according to the network security model for zero trust security through an access switch directly connected to the host, which is a network device.

That is, when the first forwarding is performed on a packet transmitted to a specific port among the ports of the specific access switch 1000, the Ethernet head of the packet corresponds to the specific network device that transmitted the packet. , the source MAC address can be obtained. In addition, the specific access switch 1000 checks whether the source MAC address is registered in the MAC address table and, if the source MAC address is not registered in the MAC address table, zero trust security for each port of the access switches. Among the micro-segments grouped and classified according to the network security policy for With the address registered in the MAC address table, it can be checked whether the source MAC address satisfies a specific user security policy, and if the source MAC address satisfies the specific user security policy, second forwarding of the packet can be performed. That is, the specific access switch 1000 can perform the L2 process according to the specific user security policy set for the specific port.

For example, when the specific user security policy for a specific port of a specific access switch is the first blacklist mode, the specific access switch 1000, with MAC address learning enabled, enters the source MAC address in the MAC address table. If it is confirmed that the source MAC address is registered in the MAC address table as a result of checking whether it is registered, it can be confirmed whether the source MAC address is registered in the blacklist. And, if the source MAC address is registered in the blacklist, the specific access switch 1000 blocks the second forwarding of the packet, and if the source MAC address is not registered in the blacklist, the specific access switch 1000 can perform the second forwarding of the packet. there is.

In addition, the specific access switch 1000 checks whether the source MAC address is registered in the MAC address table. If it is confirmed that the source MAC address is not registered in the MAC address table, the source MAC address is converted to the MAC address through MAC address learning. It is registered in the table, and you can check whether the source MAC address is registered in the blacklist. And, if the source MAC address is registered in the blacklist, the specific access switch 1000 blocks the second forwarding of the packet, and if the source MAC address is not registered in the blacklist, the specific access switch 1000 performs the second forwarding of the packet. You can.

As another example, when the specific user security policy for a specific port of a specific access switch is the first whitelist mode, the specific access switch 1000, with MAC address learning disabled, enters the source MAC address in the MAC address table. If it is confirmed that the source MAC address is registered in the MAC address table as a result of checking whether it is registered, second forwarding of the packet can be performed.

In addition, the specific access switch 1000 checks whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is not registered in the MAC address table, it determines whether the source MAC address is registered in the whitelist. You can check it. And, if the source MAC address is registered in the whitelist, the specific access switch 1000 can register the source MAC address in the MAC address table and perform the second forwarding for the packet, and if the source MAC address is registered in the whitelist If not, the second forwarding of the packet may be blocked.

Next, the specific access switch 1000 may check the IP address of the packet and, if the source IP address is not registered in the routing table, register the source IP address in the routing table (S300).

That is, the specific access switch 1000 obtains the source IP address from the IP head of the packet on which the second forwarding was performed, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is registered in the routing table. If not, the source IP address can be registered in the routing table, and third forwarding of the packet can be performed while the source IP address is registered in the routing table.

Meanwhile, when the specific access switch 1000 analyzes the IP head of the second forwarded packet and determines that the second forwarded packet is an ARP packet, it does not perform third forwarding on the packet. Packets can be flooded to ports other than the specific port of a specific access switch.

Next, the specific access switch 1000 may filter packets (S400) according to a specific service security policy set for specific micro-segmentation. This may be to perform service access control on hosts that are allowed to control access to connected equipment according to the network security model for zero trust security through an access switch directly connected to the host, which is a network device.

That is, the specific access switch 1000 obtains the destination IP address or service port from the IP head of the packet for which third forwarding is performed, and the destination IP address or service port satisfies the specific service security policy set for the specific micro segmentation. By checking whether 3rd party forwarding is performed, packets on which 3rd forwarding is performed can be filtered.

For example, when the specific service security policy is in the second blacklist mode, the specific access switch 1000 can check whether the destination IP address or service port of the packet for which third forwarding is performed is registered in the blacklist. there is. In addition, if it is confirmed that the destination IP address or service port is registered in the blacklist, the specific access switch 1000 blocks third forwarding for the packet and registers the destination IP address or service port in the blacklist. If it is confirmed that it is not, third forwarding of the packet can be permitted.

As another example, when the specific service security policy is in the second whitelist mode, the specific access switch 1000 can check whether the destination IP address or service port of the packet for which third forwarding is performed is registered in the whitelist. there is. In addition, when it is confirmed that the destination IP address or service port is registered in the whitelist, the specific access switch 1000 allows third forwarding for the packet, and the destination IP address or service port is registered in the whitelist. If it is confirmed that it is not, third forwarding of the packet can be blocked.

In addition, when third forwarding for a packet is blocked, the specific access switch 1000 transmits information related to the third forwarding blocked packet to the network controller to enable the network controller to provide information related to the third forwarding blocked packet. By referring to the information, at least one of a specific user security policy and a specific service security policy corresponding to a specific micro-segmentation can be updated, or a specific micro-segmentation corresponding to a specific port of a specific access switch can be reset.

In addition, the specific access switch 1000 transmits the third forwarding packet to the security module and causes the security module to analyze the packet to check whether the packet is an abnormal packet. If the packet is confirmed to be an abnormal packet, the packet You can also block third-party forwarding.

As described above, according to the present invention, all network devices connected to the network are automatically detected, and the detected information can be established as a security policy and used for access control for zero trust security. In addition, all network devices connected to the access switch are controlled and managed at the location where communication begins, that is, at the access layer. Since the access layer can provide minimum access rights to access resources, it can be implemented quickly and at low cost. You can build a zero trust security model. And, according to the present invention, there is. In addition, according to the present invention, the movement, traffic status, and abnormal behavior of all network devices connected to the network can be monitored in real time, a resource access control function can be provided in real time, and the security status of all assets can be checked. In addition, according to the present invention, whether to allow communication is determined through administrator authentication for all connected network devices, i.e., blacklist or whitelist, and network devices permitted to communicate are divided into micro-segments to provide minimum access rights. can be provided. In addition, according to the present invention, it is possible to continuously update the network security policy by converting the connection status, traffic, movement, and communication status of all connected network devices into data.

The embodiments according to the present invention described above can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., singly or in combination. The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention or may be known and usable by those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and perform program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include not only machine language code such as that created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the invention and vice versa.

In the above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but this is only provided to facilitate a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , a person skilled in the art to which the present invention pertains can make various modifications and variations from this description.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments, and the scope of the patent claims described below as well as all modifications equivalent to or equivalent to the scope of the claims fall within the scope of the spirit of the present invention. They will say they do it.

1000: access switch,
1100: memory,
1200: Processor

Claims (16)

In a method of managing a network using micro segmentation for zero trust security,
(a) When a specific access switch, which is one of the access switches that allow network devices to communicate with each other within a network, performs first forwarding on a packet transmitted to a specific port among the ports of the specific access switch, From the Ethernet head of the packet, obtain the source MAC address corresponding to the specific network device that transmitted the packet, check whether the source MAC address is registered in the MAC address table, and enter the source MAC address in the MAC address table. If not registered, a specific micro-segment corresponding to the specific port of the specific access switch among micro-segments in which each port of the access switches is grouped and classified according to a network security policy for zero trust security. The source MAC address is registered in the MAC address table by referring to the specific user security policy set in the MAC address table, and with the source MAC address registered in the MAC address table, the source MAC address satisfies the specific user security policy. checking whether the source MAC address satisfies the specific user security policy, and performing a second forwarding of the packet; and
(b) The specific access switch obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is registered in the routing table. The source IP address is registered in the routing table, a third forwarding is performed on the packet while the source IP address is registered in the routing table, and a destination IP address or filtering the packet on which the third forwarding is performed by obtaining a service port and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation;
Including,
The micro-segments are set by a network controller that manages the access switches,
The network controller sets the micro-segments by dividing them into pairs of access switches and ports according to the network security policy, and with each user security policy set for each of the micro-segments, each of the access switches Each of the network devices coupled to each port of the access switches is detected by analyzing ARP (Address Resolution Protocol) packets obtained by filtering each packet for which the first forwarding is performed, and the network A network management method wherein the network devices are registered in each of the micro-segments corresponding to each of the ports to which each device is coupled according to the respective user security policies. delete According to paragraph 1,
In step (a) above,
The specific user security policy includes a first blacklist mode that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered in the blacklist,
In the first blacklist mode, with the MAC address learning enabled, the specific access switch (i) checks whether the source MAC address is registered in the MAC address table and determines whether the source MAC address is registered in the MAC address table. If it is confirmed that the source MAC address is registered in the MAC address table, check whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, block the second forwarding for the packet, and If the source MAC address is not registered in the blacklist, perform the second forwarding for the packet, and (ii) check whether the source MAC address is registered in the MAC address table. As a result, the source MAC address is the MAC address. If it is confirmed that it is not registered in the table, the source MAC address is registered in the MAC address table through the MAC address learning, it is checked whether the source MAC address is registered in the blacklist, and the source MAC address is registered in the MAC address table. A network management method for blocking the second forwarding of the packet if the source MAC address is registered in the blacklist, and performing the second forwarding of the packet if the source MAC address is not registered in the blacklist. According to paragraph 1,
In step (a) above,
The specific user security policy is a first white list that disables MAC address learning for all MAC addresses, registers only MAC addresses registered as a whitelist in the MAC address table and forwards, but drops the remaining MAC addresses. Contains modes,
In the first whitelist mode, the specific access switch, with the MAC address learning disabled, (i) checks whether the source MAC address is registered in the MAC address table, and as a result, the source MAC address is If it is confirmed that it is registered in the MAC address table, the second forwarding is performed for the packet, and (ii) as a result of checking whether the source MAC address is registered in the MAC address table, the source MAC address is the MAC address. If it is confirmed that it is not registered in the table, it is checked whether the source MAC address is registered in the whitelist. If the source MAC address is registered in the whitelist, the source MAC address is registered in the MAC address table and the packet A network management method for performing the second forwarding for the packet, and blocking the second forwarding for the packet if the source MAC address is not registered in a whitelist. According to paragraph 1,
In step (b) above,
The specific service security policy includes a second blacklist mode that forwards the remaining destination IP addresses or remaining service ports except for the set destination IP address or set service port, and the remaining destination IP addresses or set service ports are forwarded. Includes either a nation IP address or a second whitelist mode that drops the remaining service ports,
(i) When the specific service security policy is the second blacklist mode, the specific access switch registers the destination IP address or the service port of the packet for which the third forwarding is performed in the blacklist. If it is confirmed that the destination IP address or the service port is registered in the blacklist, the third forwarding for the packet is blocked, and the destination IP address or the service port is registered in the blacklist. If it is confirmed that it is not registered in , the third forwarding of the packet is permitted,
(ii) When the specific service security policy is the second whitelist mode, the specific access switch registers the destination IP address or the service port of the packet for which the third forwarding is performed in the whitelist. If it is confirmed that the destination IP address or the service port is registered in the whitelist, the third forwarding for the packet is permitted, and the destination IP address or the service port is registered in the whitelist. A network management method for blocking the third forwarding of the packet if it is confirmed that the packet is not registered. According to clause 5,
When the specific access switch blocks the third forwarding of the packet, it transmits information related to the packet for which the third forwarding has been blocked to the network controller to tell the network controller that the third forwarding has been blocked. By referring to packet-related information, at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segment can be updated, or the specific micro-segment corresponding to the specific port of the specific access switch A network management method that allows you to reset . In a method of managing a network using micro segmentation for zero trust security,
(a) When a specific access switch, which is one of the access switches that allow network devices to communicate with each other within a network, performs first forwarding on a packet transmitted to a specific port among the ports of the specific access switch, From the Ethernet head of the packet, obtain the source MAC address corresponding to the specific network device that transmitted the packet, check whether the source MAC address is registered in the MAC address table, and enter the source MAC address in the MAC address table. If not registered, a specific micro-segment corresponding to the specific port of the specific access switch among micro-segments in which each port of the access switches is grouped and classified according to a network security policy for zero trust security. The source MAC address is registered in the MAC address table by referring to the specific user security policy set in the MAC address table, and with the source MAC address registered in the MAC address table, the source MAC address satisfies the specific user security policy. checking whether the source MAC address satisfies the specific user security policy, and performing a second forwarding of the packet; and
(b) The specific access switch obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is registered in the routing table. The source IP address is registered in the routing table, a third forwarding is performed on the packet while the source IP address is registered in the routing table, and a destination IP address or filtering the packet on which the third forwarding is performed by obtaining a service port and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation;
Including,
In step (b) above,
When the packet for which the second forwarding is performed is an ARP packet, the specific access switch does not perform the third forwarding on the packet and forwards the packet to the remaining ports except the specific port of the specific access switch. Network management method for flooding. In a method of managing a network using micro segmentation for zero trust security,
(a) When a specific access switch, which is one of the access switches that allow network devices to communicate with each other within a network, performs first forwarding on a packet transmitted to a specific port among the ports of the specific access switch, From the Ethernet head of the packet, obtain the source MAC address corresponding to the specific network device that transmitted the packet, check whether the source MAC address is registered in the MAC address table, and enter the source MAC address in the MAC address table. If not registered, a specific micro-segment corresponding to the specific port of the specific access switch among micro-segments in which each port of the access switches is grouped and classified according to a network security policy for zero trust security. The source MAC address is registered in the MAC address table by referring to the specific user security policy set in the MAC address table, and with the source MAC address registered in the MAC address table, the source MAC address satisfies the specific user security policy. checking whether the source MAC address satisfies the specific user security policy, and performing a second forwarding of the packet; and
(b) The specific access switch obtains the source IP address from the IP head of the packet, checks whether the source IP address is registered in the routing table, and determines whether the source IP address is registered in the routing table. The source IP address is registered in the routing table, a third forwarding is performed on the packet while the source IP address is registered in the routing table, and a destination IP address or filtering the packet on which the third forwarding is performed by obtaining a service port and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation;
Including,
(c) The specific access switch transmits the packet on which the third forwarding is performed to the security module to analyze the packet and determine whether the packet is an abnormal packet. if confirmed, blocking the third forwarding for the packet;
A network management method further comprising: In an access switch that manages a network using micro segmentation for zero trust security,
Memory storing instructions for managing a network using micro-segmentation for zero trust security; and
a processor that performs an operation of managing a network using micro-segmentation for zero trust security according to the instructions stored in the memory;
Includes,
The processor, (I) when the first forwarding is performed for a packet transmitted to a specific port among the ports of a specific access switch including the processor, from the Ethernet head of the packet to the specific network device that transmitted the packet Obtain the corresponding source MAC address, check whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, ports of each of the access switches. Among the micro-segments grouped and classified according to the network security policy for zero trust security, the source MAC address is the MAC address with reference to the specific user security policy set in the specific micro-segmentation corresponding to the specific port of the specific access switch. table, and with the source MAC address registered in the MAC address table, check whether the source MAC address satisfies the specific user security policy, and determine whether the source MAC address satisfies the specific user security policy. (II) a process for performing a second forwarding for the packet, and (II) obtaining a source IP address from the IP head of the packet, and checking whether the source IP address is registered in the routing table to determine whether the source IP address is registered in the routing table. If it is not registered in the routing table, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and the source IP address is registered in the routing table. Obtaining a destination IP address or service port from an IP head, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation. carry out the process,
The micro-segments are established by a network controller that manages the access switches that allow network devices to communicate with each other within the network,
The network controller sets the micro-segments by dividing them into pairs of access switches and ports according to the network security policy, and with each user security policy set for each of the micro-segments, each of the access switches Each of the network devices coupled to each port of the access switches is detected by analyzing ARP (Address Resolution Protocol) packets obtained by filtering each packet for which the first forwarding is performed, and the network An access switch wherein the network devices are registered in each of the micro-segments corresponding to each of the ports to which each of the devices is coupled according to the respective user security policies. delete According to clause 9,
The processor, in the (I) process, enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered as a blacklist. Includes a first blacklist mode,
In the first blacklist mode, with the MAC address learning enabled, (i) it is checked whether the source MAC address is registered in the MAC address table, and the source MAC address is registered in the MAC address table. If confirmed to be present, it is checked whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, the second forwarding for the packet is blocked, and the source MAC address is registered in the blacklist. If it is not registered, perform the second forwarding for the packet, and (ii) check whether the source MAC address is registered in the MAC address table. As a result, the source MAC address is not registered in the MAC address table. If confirmed, the source MAC address is registered in the MAC address table through MAC address learning, and it is checked whether the source MAC address is registered in the blacklist. If the source MAC address is registered in the blacklist, An access switch that blocks the second forwarding of the packet and performs the second forwarding of the packet if the source MAC address is not registered in a blacklist. According to clause 9,
In the process (I), the processor disables MAC address learning for all MAC addresses, and registers only whitelisted MAC addresses in the MAC address table to be forwarded. , including a first whitelist mode that drops the remaining MAC addresses,
In the first whitelist mode, with the MAC address learning disabled, (i) it is checked whether the source MAC address is registered in the MAC address table, and the source MAC address is registered in the MAC address table. If confirmed to be present, perform the second forwarding of the packet, and (ii) check whether the source MAC address is registered in the MAC address table and determine that the source MAC address is not registered in the MAC address table. If confirmed, it is checked whether the source MAC address is registered in the whitelist, and if the source MAC address is registered in the whitelist, the source MAC address is registered in the MAC address table and the second forwarding for the packet is performed. An access switch performs and blocks the second forwarding of the packet if the source MAC address is not registered in a whitelist. According to clause 9,
The processor, in the process (II), sets the specific service security policy to a second blacklist mode for forwarding remaining destination IP addresses or remaining service ports excluding the set destination IP address or set service port, and the set destination IP address or set service port. Includes any one of the second whitelist modes that drops the destination IP address or the remaining service ports except for the nation IP address or the set service port,
(i) If the specific service security policy is the second blacklist mode, check whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in the blacklist, and If it is confirmed that the destination IP address or the service port is registered in the blacklist, the third forwarding of the packet is blocked, and the destination IP address or the service port is not registered in the blacklist. If confirmed, the third forwarding of the packet is permitted,
(ii) If the specific service security policy is the second whitelist mode, check whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in the whitelist, and If it is confirmed that the destination IP address or the service port is registered in the whitelist, the third forwarding of the packet is permitted, and the destination IP address or the service port is not registered in the whitelist. An access switch that, if confirmed, blocks the third forwarding of the packet. According to clause 13,
When the third forwarding of the packet is blocked, the processor transmits information related to the packet for which the third forwarding has been blocked to the network controller to cause the network controller to detect the packet for which the third forwarding has been blocked. By referring to related information, at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation can be updated, or the specific micro-segmentation corresponding to the specific port of the specific access switch can be reset. An access switch that allows you to do so. In an access switch that manages a network using micro segmentation for zero trust security,
Memory storing instructions for managing a network using micro-segmentation for zero trust security; and
a processor that performs an operation of managing a network using micro-segmentation for zero trust security according to the instructions stored in the memory;
Includes,
The processor, (I) when the first forwarding is performed for a packet transmitted to a specific port among the ports of a specific access switch including the processor, from the Ethernet head of the packet to the specific network device that transmitted the packet Obtain the corresponding source MAC address, check whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, ports of each of the access switches. Among the micro-segments grouped and classified according to the network security policy for zero trust security, the source MAC address is the MAC address with reference to the specific user security policy set in the specific micro-segmentation corresponding to the specific port of the specific access switch. table, and with the source MAC address registered in the MAC address table, check whether the source MAC address satisfies the specific user security policy, and determine whether the source MAC address satisfies the specific user security policy. a process for performing a second forwarding for the packet, and (II) obtaining a source IP address from the IP head of the packet, and checking whether the source IP address is registered in the routing table to determine whether the source IP address is registered in the routing table. If it is not registered in the routing table, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and the source IP address is registered in the routing table. Obtaining a destination IP address or service port from an IP head, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation. carry out the process,
In the process (II), if the packet for which the first forwarding is performed is an ARP packet, the processor does not perform the third forwarding for the packet and forwards the packet to the specific port of the specific access switch. An access switch that floods the remaining ports except . In an access switch that manages a network using micro segmentation for zero trust security,
Memory storing instructions for managing a network using micro-segmentation for zero trust security; and
a processor that performs an operation of managing a network using micro-segmentation for zero trust security according to the instructions stored in the memory;
Includes,
The processor, (I) when the first forwarding is performed for a packet transmitted to a specific port among the ports of a specific access switch including the processor, from the Ethernet head of the packet to the specific network device that transmitted the packet Obtain the corresponding source MAC address, check whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, ports of each of the access switches. Among the micro-segments grouped and classified according to the network security policy for zero trust security, the source MAC address is the MAC address with reference to the specific user security policy set in the specific micro-segmentation corresponding to the specific port of the specific access switch. table, and with the source MAC address registered in the MAC address table, check whether the source MAC address satisfies the specific user security policy, and determine whether the source MAC address satisfies the specific user security policy. (II) a process for performing a second forwarding for the packet, and (II) obtaining a source IP address from the IP head of the packet, and checking whether the source IP address is registered in the routing table to determine whether the source IP address is registered in the routing table. If it is not registered in the routing table, the source IP address is registered in the routing table, third forwarding is performed on the packet while the source IP address is registered in the routing table, and the source IP address is registered in the routing table. Obtaining a destination IP address or service port from an IP head, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation. carry out the process,
The processor, (III) transmits the packet on which the third forwarding is performed to a security module to have the security module analyze the packet to determine whether the packet is an abnormal packet, and confirm that the packet is an abnormal packet. If so, the access switch further performs a process of blocking the third forwarding of the packet.