KR20020096194A - Network security method and system for integration security network card - Google Patents

Abstract

PURPOSE: A network security method by a unified security NIC(Network Interface Card) and a system therefor are provided to automatically transmit information generated on a network without providing a load to a separate PC system and monitor the abnormal state of a PC in real time by mounting an SPU(Security Processing Unit) and transmitting log data of a network connection IP(Internet Protocol) analyzed by the SPU to an event console. CONSTITUTION: A PCI(Programmable Communication Interface) unit(110) is composed to be installed in an internal portion of a PC or a network server of the Intranet. A line connection unit(120) connects an external communication line divided from a router or hub. A LAN(Local Area Network) chip(130) determines a data transmission rate when transmitting and receiving data. A data storing unit(140) temporarily stores data gathered through the PCI unit(110). A program logic unit(150) determines a physical address by a transmission signal. An SPU function unit(190) has a network operating unit(160) for performing a separate security function, a program driving unit(170) for performing a booting system, and a central memory unit(180).

Description

Network security method and system for integrated security network card {Network security method and system for integration security network card}

The present invention relates to a network security system and a network security method according to the integrated security network card for strengthening the network security of the personal PC (PC), more specifically in the form of software that satisfies the standard specification of the existing network card (NIC) It is equipped with a security processing unit (SPU: Security Processing Unit, or SPU), which is operated by an individual network security system between each personal computer (PC) by the security unit (SPU), and the storage unit is stored. The present invention relates to a network security method and system using an integrated security network card by real time monitoring of an administrator by transmitting analyzed access IP log data to a centralized event console.

Recently, due to the development of internet network and network technology, distant computers can be connected as LAN (wide area network) and wide area network (WAN) and used as computers next to each other. It was done.

However, in contrast to this, problems such as the leakage of security-protected information and the destruction of the system due to illegal intrusion through the network have been easily generated. It was recognized that only a small number of people could do it, but recently, hacking information and programs scattered on the Internet have made it easy for beginners to hack.

In order to prevent such hacking, it is required to develop a security solution that can secure the security and stability of the network by blocking unauthorized network intrusion by insiders or outsiders in advance. There is an intrusion detection system and an intrusion detection system (IDS).

An intrusion prevention system, one of the conventional security solutions, is a technology that blocks intrusion prevention (firewall) systems between networks, and has the advantage of stable inspection and physical separation of the network. Because it can not perform the test and intercepts the flow of network traffic, it delays the traffic speed and can be applied only at low bandwidth, and the hacker attack through the authenticated IP becomes useless.

In addition, conventional intrusion detection systems go beyond simple access control and use a pattern database of intrusions and specialized systems to monitor network or system usage in real time and detect intrusions. It is pointed out that it is not possible to take special measures in a series of attacks, and the limitation of the intrusion detection method is exposed to hacker intrusion using various attack methods.

In addition, the conventional intrusion detection system provides the administrator with the corresponding IP address as the information on the attacker when the host is attacked. In recent years, the ISP (Internet) that uses the dynamic IP address allocation method due to the lack of the IP address is provided. There are a growing number of Service Providers, in which case it is virtually impossible to track an attacker by the provided IP address.

The network security system as described above is mainly composed of a separate software environment, which is expensive due to the additional equipment of the security system configuration in addition to the network configuration cost, and the operation rate of the entire system due to the security system when a load caused by network traffic is generated. This degrades and acts as a factor in system down.

On the other hand, hardware security systems, which are recently attracting attention, operate more powerfully than software systems in terms of network security, but have a disadvantage of not yet settled due to the high price.

Accordingly, the present invention has been made to solve the above-mentioned disadvantages and problems in the security related system of the conventional network, and satisfies the network card (NIC) standard, which is a network connection component between individual computers or between a server and a personal computer. It is equipped with a software-driven secretion unit, and the individual network security system by the SPU is activated so that the log data of the network connection IP analyzed by the SPU is transmitted to the event console so as not to burden the individual PC system. It automatically transmits the information generated on the network to monitor the abnormal state of the PC in real time, and also performs encryption and decryption functions of data transmitted and received from each PC by the SPU mounted on the network card (NIC). Improvement of data processing speed of ingot personal PC A network security system and thus provides a network security method according to the byeokhan integrated security environment Integrated security network card that there is a purpose of the invention.

1 is a schematic network security system construction by the present invention integrated security network card.

Figure 2 is an internal configuration of the integrated security network card of the present invention.

3 is a network diagram of a system according to the present invention;

Figure 4 is a flow chart illustrating a process of obtaining an authentication key when transmitting and receiving data according to the present invention.

5 is a flowchart illustrating a process of performing an individual intrusion prevention function of an integrated security network card according to the present invention.

((Explanation of symbols for main parts of drawing))

100. Integrated security network card 110. PCI interface unit

120. Line connection 130. LAN chip

140. Data storage section 150. Program logic section

160. Network operation unit 170. Program driver

180. Central memory section 190. SPU function section

The above object of the present invention is a network card (NIC) mounted inside an individual personal computer (PC) constituting the intranet or a server constituting a server group in the configuration of an intranet using a network in a company or a predetermined group through a plurality of servers. This is achieved by software installation of a Security Processing Unit (SPU), which is run as a separate operating system and can be executed as an application program.

Technical features of the hardware configuration of the network card according to the present invention is connected to the communication line by a single line jack (RJ-45, etc.) and connected to the communication line of the individual PC by a PCI interface, and data and control through the PCI interface In a typical network card (NIC) system in which a signal is generated, a flash ROM in which a central processing unit (CPU) operated by an individual real-time operating system (RTOS) is mounted and an individual security program is booted. The SPU program unit is composed of a central memory for storing transmission and reception log data by driving.

The SPU program unit basically performs specific encryption and decryption functions of data received from individual PCs and servers, and the intrusion prevention function is performed on a network card (NIC) mounted system equipped with the SPU program unit.

In addition, by checking the communication events and security status generated from the network card (NIC) equipped PC and server on the intranet connected to the Internet from time to time, the data on abnormal program execution is sent to the upper event console for real-time transmission and data. The backup function will be performed.

On the other hand, when transferring data between integrated security network cards (NICs) mounted on individual PCs or network servers forming an intranet, an encryption algorithm for data implemented in hardware in the SPU of the sending network card (NIC) The secreted data can be transmitted to the receiving network card (NIC).

Matters concerning the operational effects including the technical configuration of the network security system and the network security method according to the present invention with the integrated security network card according to the present invention are described in the following detailed description with reference to the drawings showing preferred embodiments of the present invention. Will be clearly understood.

First, Figure 1 is a schematic diagram of a network security system construction by the integrated security network card of the present invention, Figure 2 is an internal configuration of the integrated security network card of the present invention.

As shown, the network security system by the integrated security network card of the present invention includes a PCI interface unit 110 to be mounted inside the individual PC or network server constituting the intranet; A line connection unit 120 for connecting an external communication line separated from the router or hub; LAN chip 130 for determining the data transmission rate when transmitting and receiving data; The data storage unit 140 temporarily stores data collected through the PCI interface unit 110, the program logic unit 150 determining a physical address based on a transmission signal, the individual network operating unit 160, and a booting system. The SPU function unit 190 is configured to include a program driver 170 and a central memory unit 180 as a storage device.

The network operation unit 160 of the SPU function unit 190 is equipped with a real-time operating system (RTOS) of an individual network connection to perform individual security functions according to various encryptions of transmission and reception data, and basic data transmission and reception. It is designed to support network connection by protocol TCP / IP.

In addition, the program driver 170 has a main application program mounted thereon to operate an individual security program on a flash ROM, and the security program is executed on individual PCs and network servers by driving the application program.

In the program driver 170, the decryption function is performed together with encryption of data exchanged between PC users equipped with the network card of the present invention so that decryption of the encrypted data is impossible even if an external leakage of the data occurs due to hacking. It is configured to.

On the other hand, the central memory unit 180 of the SPU function unit 190 is equipped with 32MB SDRAM to operate the security program according to the independent real-time operating system (RTOS) through the program driver 170 and the network operator 160 And log messages of the program interface and the intranet-configured PCs by the security program.

The SPU function unit 190 performs a separate encryption and decryption function for data transmitted and received from individual PCs and network servers equipped with a network card (NIC), and thus is transmitted on the intranet by a hacker who invades from the outside. The technical feature is that even if the packet is hijacked, the contents of the encrypted data cannot be decrypted.

When transmitting data through the SPU function unit 190, the receiving side network card (NIC) must be equipped with the SPU function unit 190, which is driven in the same manner, to authenticate the data transmitted and transmitted on the intranet and decrypt the smooth encryption. This can be done.

In addition, when the security program is driven through the program driver 170 of the SPU function unit 190, an intrusion blocking function is performed on a given system of an individual PC and a network server, and log data stored in the central memory unit 180 is stored. The communication events such as data transmission and reception, etc., are backed up to the upper event console.

As such, the SPU function unit 190 installed in the network security system by the integrated security network card of the present invention is a separate operating system mounted on the network operating unit 160, and is equipped with a real-time operating system (RTOS) composed of a 32-bit CPU. Therefore, the individual security program is driven and the communication data is saved accordingly, thereby preventing network degradation due to communication overload.

Briefly described the network security system construction process of Figure 1 by the integrated security network card of the present invention as described above.

First, an intranet in which intruders 10, such as hackers, crackers, or info-terrorists, are interconnected to multiple personal PCs 41 and servers 42 via the public Internet 20. If 40 or a plurality of network servers 51 is attempted to hack the server group 50 connected to the primary intrusion blocking system 30, the primary hack is blocked and the intranet 40 and server group 50 Secondary hacking is prevented by the integrated security network cards 41a and 51a mounted on the plurality of PCs 41 and the servers 42 and 51.

In addition, data exchanged between the PCs 41 having the integrated security network cards 41a and 51a or between the server 42 and the PC 41 by the SPU function unit mounted in the integrated security network card. Encrypted data exchange is performed by encryption and decryption, and intrusion detection from outside and communication events of users having a predetermined public or private IP are transmitted to the monitoring system 43 to be managed in real time.

Next, Figure 3 is a network configuration diagram by the system according to the present invention, as shown, the integrated security network card security system of the present invention is a network security program individually driven in the SPU function unit 190 of the integrated security network card Encrypted and decrypted data is transmitted and received by the data is compressed by the operation of the network driver 200 by a communication protocol such as TCP / IP or UDP / IP to the protocol of other integrated security network card Are sent in real time.

In this case, the address resolution protocol 210 (ARP: Address Resolution Protocol, hereinafter referred to as ARP) used to map an IP address to a physical network address on a network when transmitting data through TCP / IP and UDP / IP is used. The physical network address information can then be called and sent.

Various information generated between the network card stored in the central memory unit 180 of the SPU function unit 190 is transmitted in real time to the event console 220 without load on the individual PC by the RTOS operated by the individual operating system, The event contents transmitted as described above transmit the connection time of the access IP and the counterpart IP and the information of the transmission / reception data at the time when the network communication is connected, and the result of repeated data movement and the confirmed data contents and the network. From time to time, the status of individual PCs on the PC can be checked for abnormal program execution and data transmission on intruder information.

As such, the communication event information generated during each data transmission can be confirmed by the monitoring system through the console 220, and when transmitting log data in the event information, authentication, integrity, and confidentiality ( Privacy is preferably maintained.

The authentication is to enable the identification of the sending and receiving party, and the integrity is to make sure that the delivered message is delivered in its original form without being altered by a third party.

In this case, if the integrity is not achieved, hackers can insert a false packet onto the data or data head by using packet spoofing technique, and the receiver misuses the original original message.

In addition, confidentiality must be maintained so that data transmitted through the integrated security network card can be reached without being infringed by a third party on the way to the destination.

On the other hand, the network driver operating on the data link layer (Date link layer) for the processing of the transmitted and received data, the access control rules and network operation unit 160 according to the authentication and impossibility of the user or accessor by the SPU function unit 190 Encryption and algorithm are packetized and transmitted through the protocol of the other party's integrated security network card.

4 is a flowchart illustrating a process of acquiring an authentication key at the time of data transmission and reception according to the present invention. As shown in FIG. 4, preparation of transmission of communication data by mutual communication between individual PCs and network servers constituting an intranet is performed. If made, the encryption of the data (step S101) is performed by driving the individual operating system (RTOS) and the security program through the network operating unit 160 of the integrated security network card 100 SPU function unit 190 mounted on the individual PC If it is determined that the data can be received (step S103), the SPU function unit 190 again decrypts the encrypted data (step S104) to determine the corresponding data through a protocol such as TCP / IP of the receiver integrated security network card. The SPU function unit 190 transmits the transmission information of the data stored in the central memory unit 180 to the event console (S106). System) and to allow for real-time monitoring of the transmission, reception history.

At this time, if the SPU function unit is not mounted on the receiving side network card NIC in step S101, the transmitting side integrated security network card NIC selectively transmits data to the receiver's IP (step S102). This can be done.

In addition, when the reception authentication is not performed from the network operation unit 160 of the SPU function unit 190 in the step S103 of determining the possible recipient, the server authentication key for the unique IP by the security program through the program driver 170. Is requested (step S107) and decryption of step S104 is performed simultaneously with obtaining the authentication key (step S108).

If the authentication key acquisition of the corresponding IP fails in step S108, access control information of the network server or another PC of the corresponding IP is transmitted to an event console (step S109), and access blocking IP information by real-time monitoring is performed. And the intrusion detection of the hacker is made.

Finally, Figure 5 is a flow chart showing the process of performing the individual intrusion prevention function of the integrated security network card according to the present invention, as shown in the network security method by the integrated security network card of the present invention is an individual PC constituting an intranet And each integrated security network card installed in the network server is connected to the event console (event console) individually to receive the data to apply the policy (IP, Port, etc.) setting information of the console (step S200) and receive each integrated security The communication information check including the individual IP or port for the SPU function unit of the network card is performed (step S201), and the reception of data to be communicated (step S202) is performed.

At this time, the data reception is determined by the SPU function of each integrated security network card (step S203) to determine whether or not the receiver can be received by comparing the received information including the IP or the port (step S203). If it is determined that the data is transmitted to the upper layer (step S207), the header and the transmission / reception information of the transmitted data are converted into log data (step S209) and stored.

If the IP information or port information of the user that does not match the policy setting information of the console is detected in the reception information comparison step (S203) and the receiver determination step (S206) by the SPU function unit, data reception is blocked. The data information is encrypted (step S204), and the data information is transmitted to the console (steps S205 and S208).

As described above, the network security system using the integrated security network card and the network security method thereof according to the present invention satisfy the network card standard specification, which is a network connection component between individual computers or between a server and a personal computer, and is a software application program. The SPU function unit is mounted so that the individual network security system is driven by the SPU function unit so that data transmission / reception information between individual PCs or servers, including log data of the network connection IP analyzed by the SPU function unit, is displayed in the event console. By transmitting to the PC, all information generated on the network is automatically transmitted without load on individual PC system and network system, so that it can monitor the abnormal state of PC and external intrusion of hacker in real time.

In addition, the network security system and the network security method according to the present invention integrated security network card to encrypt and decrypt the data transmitted and received from each PC by the network operating unit of the SPU function mounted on the integrated security network card (NIC) By doing so, it has the advantage of improving the processing speed of network transmission and reception data and establishing a perfect integrated security environment of personal PC.

Claims (8)

When the preparation of the transmission of communication data by the integrated security network card between the individual PCs constituting the intranet or between the individual PCs and the network server (S100) is made, the individual operating system through the network operation unit of the integrated security network card SPU function mounted on the individual PC Step (S101) in which data is encrypted by driving the RTOS and the security program; If it is determined that the data can be received by the SPU function of the integrated security network card (S103), the SPU function performs decryption of the encrypted data again (S104) and the corresponding data through a protocol such as TCP / IP of the receiver integrated security network card. Step (S105) to allow the transmission of the; Transmitting the transmission information of the data stored in the central memory unit to an event console to enable real-time monitoring of the corresponding transmission and reception details (S106); Network security method by the integrated security network card, characterized in that consisting of. According to claim 1, If the SPU function is not mounted on the receiving network card (NIC) in the step of encrypting the data (S101), the transmitting side integrated security network card (NIC) to selectively encrypt data The network security method according to the integrated security network card, characterized in that it further comprises the step (S102) for the transmission to the corresponding IP of the receiver. The server authentication key for the unique IP is set by the security program through the program driver when the reception authentication is not performed from the network operation unit of the SPU function in the reception receiver determination process of the reception receiver determination step (S103). Request (S107) and an authentication key acquisition step (S108) for performing decryption; If the corresponding IP authentication key acquisition fails in the authentication key acquisition step (S108), access control information of a network server or another PC of the corresponding IP is transmitted to an event console to block access IP information and hackers by real-time monitoring. Intrusion detection of the network security method by the integrated security network card, characterized in that it further comprises the step (S109). Each integrated security network card installed in each PC and network server configuring an intranet is connected to an event console individually to apply data (S200) to apply policy (IP, Port, etc.) setting information of the console. Receiving the communication information including the individual IP or port for the SPU function of each integrated security network card (S201) is received and receiving the data to be communicated (S202), At this time, the data reception is determined by the SPU function of each integrated security network card (S206) by comparison of the received information including IP or Port (S203), and it is determined that the reception is possible. When the corresponding data is transmitted to the upper layer (S207) and the header and the transmission, reception information of the transmitted data is converted into log data and stored (S209), If the IP information or port information of the user that does not match the policy setting information of the console is detected in the reception information comparison step (S203) and the receiver determination step (S206) by the SPU function unit, data reception is blocked. (S204) and the data information is encrypted to transmit the data information to the console (S205, S208), Network security method by the integrated security network card, characterized in that consisting of. A PCI interface unit 110 that can be mounted inside an individual PC or a network server configuring an intranet; A line connection unit 120 for connecting an external communication line separated from the router or hub; LAN chip 130 for determining the data transmission rate when transmitting and receiving data; The data storage unit 140 temporarily storing the data collected through the PCI interface unit 110, the program logic unit 150 to determine the physical address by the transmission signal, the network operation unit 160 for performing individual security functions And an SPU function unit (190) comprising a program driver (170) for performing a booting system and a central memory unit (180) as a storage device. According to claim 5, The network operator 160 is equipped with a real-time operating system (RTOS; Real-time Operating System) of the individual network connection to perform individual security functions according to various encryption of the transmission and reception data and the basic protocol of data transmission and reception Network security system with an integrated security network card, characterized in that it is designed to support a network connection by TCP / IP. According to claim 5, The program drive unit 170 is a security that performs the function of copying on the individual PC and the network server by the main application is mounted to operate the individual security program on the flash ROM (Rom ROM) by driving the application program A network security system with an integrated security network card, characterized in that the program is executed. The method of claim 5, wherein the central memory unit 180 is equipped with 32MB of SDRAM, the operation of the security program and the security program according to the independent real-time operating system (RTOS) through the program driver 170 and the network operator 160 A network security system according to an integrated security network card, characterized in that data transmission and reception information including a log message of a program interface and an intranet configuration PCs are driven.