KR20030016500A - Policy-based Network Security System and Method for Security and Security Policy - Google Patents

Abstract

PURPOSE: A policy based network security system and a method for security and security policy decision using the same are provided to make an agent on each necessary position of the network decide security policy, to select a proper mechanism for traffics by distributing the decided security policy, and to decide the policy information by ordering an operation method by the mechanism. CONSTITUTION: A cyber intrusion detection system(30) includes a policy client function part(302) receiving a signal from a cyber patrol control system(20), a packet collection function part(301), an intrusion detection function part(305), a policy cache(303), and a system management function part(304). A cyber terror confrontation system(40) includes the policy client function part(402) receiving confrontation policy against the intrusion of the harmful intrusion the signal from the cyber patrol control system(20), the policy operation function part(401) performing confrontation against the intrusion of the harmful intrusion, the policy cache(403) storing the confrontation policy, and the system management function part(404). The cyber patrol control system comprises a policy management tool(21), a processing part(22) and a transfer part(23).

Description

Policy-based Network Security System and Method for Security and Security Policy}

The present invention provides a network security system for establishing comprehensive security in response to hacking by establishing a security policy at a network level, a method for determining security and security policy using the same, and a program for realizing the method. The present invention relates to a recording medium which can be used.

In the conventional network system, services were provided as independent networks according to the characteristics of the service, and the number of connected systems was limited, and the speed was not so high that malicious users invaded and damaged the network equipment.

The advancement of technology has made the Internet faster and globalized to attract more users, and foreign information agencies have been heavily dependent on computers and networks for information processing, distribution and storage activities. As cyber terror threats from military organizations, terrorists, criminals, and dissatisfaction groups are on the rise, security measures for each system are becoming more important.

However, since the existing security protection technology is limited to hosts, many limitations are exposed in reality to cope with the rapidly increasing cyber crimes. In other words, the existing security protection technology can not cope with the large-scale attack (hacking) through the entire network, it can only cope with the geographically limited portion.

Therefore, in order to supplement the weaknesses of the existing host-based intrusion detection and response-oriented security prevention technology, the development of new security technology from the perspective of network-wide monitoring and proactive prevention through the network-level large-scale attack can be countered. This is necessary.

The present invention has been proposed in order to meet the above demands, and has an agent at each required point of the network, and the agent determines a security policy based on the information transmitted from the network, and determines the determined security policy. A policy-based network security system for determining policy control information by instructing distribution to select an appropriate mechanism for the corresponding traffic and instructing a method according to the mechanism, a method for determining security and security policy using the same, and the method An object of the present invention is to provide a computer-readable recording medium having recorded thereon a program for realizing this.

1 illustrates one embodiment of a policy-based network security system in accordance with the present invention.

2 is an embodiment configuration of a policy-based network security system according to the present invention.

Figure 3a is a flow diagram of an embodiment of the operation of the cyber intrusion detection system according to the present invention.

Figure 3b is a flow diagram of an embodiment of the operation of the cyber terrorism response system according to the present invention.

Figure 3c is a flow diagram of an embodiment of the operation of the cyber patrol control system according to the present invention.

* Explanation of symbols for the main parts of the drawings

10: internet 20: cyber sequential control system

21: Policy management tool 22: Processing unit

23: delivery unit 30: cyber intrusion detection system

40: cyber terrorism response system 221: cyber patrol server function

222: policy server function unit 223: policy decision function unit

224: policy management function 225: policy storage function

226: system management function unit 231: security delivery layer function unit

232: network connection unit 301: packet collection function

302: policy client function unit 303: policy cache

304: system management function unit 305: intrusion detection function unit

401: policy execution function unit 402: policy client function unit

403: Policy Cache 404: System Management Function

In accordance with an aspect of the present invention, there is provided a policy-based network security system, comprising: cyber intrusion detection means for detecting a cyber intrusion by detecting traffic entering through an access point of the Internet; Cyber terrorism countermeasures for dynamically responding to cyber intrusions by executing a predetermined security policy on the traffic detected by the cyber intrusion detection means; And cyber patrol control means for distributing to the cyber intrusion detecting means and the cyber terror countermeasure means to establish the security policy and to implement the established security policy.

On the other hand, the method of the present invention, the policy-based network security method, the first step of detecting all the packets flowing into the access point of the network to determine whether the harmful traffic according to the security policy; A second step of notifying the cyber terrorism countermeasure system to perform a security policy and preparing a detection report if the traffic is harmful as a result of the determination in the first step; And a third step of proceeding to the first step if the traffic is not harmful as a result of the determination of the first step.

In addition, another method of the present invention, the security policy decision method of the policy-based network security system, comprising: a first step of collecting security policy data from a policy management tool or administrator of another cyber patrol control system; A second step of generating a new policy by converting the collected data into a security policy; Updating the existing security policy data with the generated security policy; A fourth step of storing the updated security policy data; And a fifth step of notifying the cyber terror detection system, the cyber terror response system, and the cyber intrusion detection system, and distributing the updated policy data to other cyber patrol systems.

In addition, the method of the present invention may further include a sixth step of determining a security policy by receiving harmful traffic data transmitted from the cyber terrorism response system.

On the other hand, the present invention, a network security system having a processor, a first function for detecting whether the traffic is in accordance with the security policy by detecting all packets flowing into the access point of the network; A second function of notifying the cyber terrorism countermeasure system to perform a security policy and generating a detection report if the traffic is harmful as a result of the determination of the first function; And a computer-readable recording medium having recorded thereon a program for realizing a third function proceeding to the first function if the traffic is not harmful traffic as a result of the determination of the first function.

The present invention also provides a network security system including a processor, comprising: a first function of collecting security policy data from a policy management tool or an administrator of another cyber patrol control system; A second function of generating a new policy by converting the collected data into a security policy; A third function of updating existing security policy data with the generated security policy; A fourth function of storing the updated security policy data; And a computer readable record recording a program for realizing a fifth function of notifying the cyber terror detection system, the cyber terror response system, and the cyber intrusion detection system and distributing the updated policy data to other cyber patrol systems. Provide the medium.

The present invention also provides a computer-readable recording medium having recorded thereon a program for realizing a sixth function of determining a security policy by receiving harmful traffic data transmitted from the cyber terrorism response system.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an embodiment of a policy-based network security system according to the present invention.

As shown in FIG. 1, the policy-based network security system according to the present invention includes a cyber intrusion detection system 30 for monitoring the incoming traffic installed at an access point between the Internet and detecting a cyber intrusion of harmful traffic. Receiving a policy from the cyber patrol control system 20 to perform a security policy for the harmful traffic to establish a cyber terrorism response system 40 for responding to harmful traffic cyber terror, and a security policy for harmful traffic, And a cyber patrol control system 20 for distributing the established security policy.

Next, the operation of the policy-based network security system according to the present invention will be described in detail with reference to FIGS. 2 to 5.

2 is a block diagram of an embodiment of a policy-based network security system according to the present invention.

As shown in FIG. 2, the policy-based network security system includes a cyber intrusion detection system 30, a cyber terror response system 40, and a cyber patrol control system 20.

The cyber intrusion detection system 30 is connected to the cyber patrol control system 20, the policy client function unit 302 receiving the signal of the cyber patrol control system, and a packet for detecting whether the traffic flowing into the network is harmful. The packet collection function unit 301 for collecting the packet, the intrusion detection function unit 305 for determining the harmfulness of the packet, the policy cache 303 for storing the operation policy, and recording the operation of the cyber intrusion detection system 30 System management function 304 to manage the operation of the.

In addition, the cyber terrorism response system 40 responds to the intrusion of harmful traffic, the policy client function unit 402 to receive the response policy for responding to the intrusion of harmful traffic from the cyber patrol control system 20. The policy execution function 401, a policy cache 403 for storing a response policy for intrusion of harmful traffic, a response action for responding to intrusion of harmful traffic, and for managing the cyber terrorism response system. System management function unit 404 is included.

In addition, the cyber patrol control system 20 is composed of a policy management tool 21, the processing unit 22, and the delivery unit 23, which will be described in more detail as follows.

First, the policy management tool 21 provides a function for users to quickly or easily enter or change the security policy on the cyber patrol control device.

The processor 22 includes a cyber patrol server function 221, a policy server function 222, a policy decision function 223, a policy management function 224, a policy storage function 225, and a system. It consists of a management function unit 226.

The processing unit 22 will be described in more detail as follows.

The cyber patrol server function unit 221 controls and manages the cyber intrusion detection system 30, and receives intrusion detection information sent from the cyber intrusion detection system 30.

The policy server function unit 222 distributes the established security policy to the cyber intrusion detection system 30 and the cyber terror response system 40, and also distributes the security policy to other cyber patrol control systems.

The policy decision function unit 223 is responsible for creating a new policy with information collected by the cyber intrusion detection system 30 and information input by an administrator.

The policy management function unit 224 maintains, stores, and newly registers the policies in the policy storage function unit 225 such as discarding the existing policy or registering a new policy with the data transmitted from the policy management tool 21. It is responsible for the function, and according to the management of the policy management function unit 224, the policies are stored in the policy storage function unit 225, the system management function unit 226 is the overall management of the cyber patrol control system 20 In charge of.

On the other hand, the transmission unit 23 is composed of a security transmission layer function unit 231 and a network connection unit 232, the security transmission layer function unit 231 performs a function for transmitting a policy securely when distributing the policy, The network connection unit 232 is responsible for connecting to the Internet 10.

3A is a flowchart illustrating an operation of a cyber intrusion detection system according to the present invention.

As shown in FIG. 3A, the operation process of the cyber intrusion system according to the present invention monitors firstly input traffic (301). The policy data is searched (302) to determine whether the traffic is harmful (303).

As a result of the determination, if the traffic is harmful, the cyber terrorism response system 40 is notified of this (304), and a detection report is prepared (305).

As a result of the determination, if the traffic is not harmful, the process proceeds to step 301 of monitoring the traffic.

That is, the cyber intrusion detection system monitors the traffic of the Internet access point (301), searches for policy data (302), and then determines whether the data entering the access point is harmful traffic based on the searched data (303), If it is determined that the traffic is harmful, the cyber terror response system is notified (304), and a detection report is prepared and recorded (305). If it is determined that the data is not harmful traffic, the process proceeds to a traffic monitoring process 301.

3B is a flowchart illustrating an operation of the cyber terrorism response system according to the present invention.

As shown in FIG. 3B, the operation process of the cyber terrorism response system first receives harmful traffic from the cyber intrusion detection system 30, and determines whether the harmful traffic exists in the policy cache (311).

As a result of the determination, if the harmful traffic exists in the policy cache, a security policy is executed (312), and a performance report is prepared (314).

As a result of the determination, if the harmful traffic does not exist in the policy cache, it is notified to the cyber patrol control system (313), and a performance report for this is prepared (314).

That is, the operation process of the cyber terrorism response system according to the present invention, when it is determined that the harmful traffic in the determination of the cyber intrusion detection system 30 (303), the cyber terrorism response system 40 in the cyber intrusion detection system Searching for a policy cache by receiving the detection information delivered in (30) (401), if the detection information is harmful traffic present in the policy cache, and performs a security policy for the security policy (312), security A policy performance report is prepared (314). However, if not in the policy cache it notifies the cyber patrol control system 20 (313).

3C is a flowchart illustrating an operation of the cyber patrol control system according to the present invention.

As shown in FIG. 3C, the operation of the cyber patrol control system according to the present invention first collects a policy (321) and establishes a policy according to the collected policy (322). Then, the policy data is updated (323), and the policy is distributed according to the updated policy data (324).

In addition, a policy is also established for the harmful traffic notified from the cyber terrorism response system 40 (322), the policy data is updated (323), and the policy is distributed (324).

The operation process of the cyber patrol control system will be described in more detail as follows.

Collect policy data input from other cyber patrol control systems and administrators (321), convert the collected policy data to establish a policy (322), generate and update policy data with the established policy (323) In step 324, the updated policy is notified to the cyber terror intrusion detection system 30 and the cyber terror response system 40, and distributed to other cyber patrol systems.

As described above, the method of the present invention may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be apparent to those of ordinary knowledge.

As described above, the present invention enables to collectively establish a cyber intrusion response policy of a network and a network, that is, a wide area network, rather than a cyber intrusion response of a single system or a local network, thereby detecting and responding to cyber terrorism. It has the effect of preventing terrorism.

In addition, the present invention is equipped with a policy management tool in the cyber patrol control device, the user can create a policy appropriately, can distribute the policy to the entire network in a short time, there is an effect that can effectively establish a security policy.

Claims (12)

In a policy-based network security system, Cyber intrusion detection means installed at an access point of the Internet for detecting a cyber intrusion by detecting traffic entering through the access point; Cyber terrorism countermeasures for dynamically responding to cyber intrusions by executing a predetermined security policy on the traffic detected by the cyber intrusion detection means; And Cyber patrol control means for establishing the security policy and distributing it to the cyber intrusion detection means and the cyber terror countermeasure means to enforce the established security policy. Policy-based network security system comprising a. The method of claim 1, The cyber intrusion detection means, Policy reception means connected to the cyber patrol control means to receive a security policy of the cyber patrol control means; Security policy storage means for storing a security policy for traffic received by the policy reception means; Packet collecting means for collecting a packet to detect whether harmful traffic flowing into the Internet is harmful; Intrusion detection means for determining whether the collected packet is harmful; And System management means for recording the operation of the cyber intrusion detection means and managing the operation Network security system comprising a. The method of claim 1, The cyber terrorism countermeasures, Policy reception means for receiving a security policy for coping with cyber intrusion from the cyber patrol control means; Security policy storage means for storing a security policy for cyber intrusion received from the policy reception means; Security policy execution means for executing the security policy; And System management means for managing the operation record of the security policy and the operation of the terrorism countermeasure Network security system comprising a. The method of claim 1, The cyber patrol control means, Network access means for internet access; Security policy delivery means for securely transmitting and receiving security policies; Cyber patrol receiving means for managing the cyber patrol control means and receiving intrusion detection information transmitted from the cyber intrusion detecting means; Security policy distribution means for distributing the security policy established by the cyber patrol control means to other cyber patrol control means, the cyber intrusion detection means, and the cyber terror countermeasure means; Security policy generation means for generating a new security policy with information collected by the cyber intrusion detection means and information input by an administrator; Security policy changing means for an administrator to quickly or easily input or change a security policy into the cyber patrol control system; Security policy management means for discarding an existing security policy or registering a new policy with data inputted to said security policy management means; Security policy storage means for storing policy data by management of the security policy management means; And System management means for managing the cyber patrol control means Network security system comprising a. In the policy-based network security method, A first step of detecting all packets flowing into the access point of the network and determining whether the traffic is harmful traffic according to a security policy; A second step of notifying the cyber terrorism countermeasure system to perform a security policy and preparing a detection report if the traffic is harmful as a result of the determination in the first step; And A third step of proceeding to the first step if the traffic is not harmful as a result of the determination of the first step Network security method comprising a. The method of claim 5, The first step is, A fourth step of monitoring traffic of an access point of the network; And A fifth step of retrieving policy data of the traffic; Policy-based security system control method comprising a. The method according to claim 5 or 6, The second step, A sixth step of determining whether there is a security policy for the harmful traffic by searching for the policy cache of the cyber terrorism response system based on the harmful traffic information transmitted in the second step; A seventh step of executing the security policy and preparing a performance report if a security policy exists as a result of the determination of the sixth step; And An eighth step of notifying the cyber patrol control system if there is no security policy as a result of the determination of the sixth step Network security method comprising a. In the security policy determination method of policy-based network security system, A first step of collecting security policy data from a policy management tool or an administrator of another cyber patrol control system; A second step of generating a new policy by converting the collected data into a security policy; Updating the existing security policy data with the generated security policy; A fourth step of storing the updated security policy data; And A fifth step of notifying the cyber terror detection system, the cyber terror response system, and the cyber intrusion detection system, and distributing the updated policy data to other cyber patrol systems Network security policy determination method comprising a. The method of claim 8, The sixth step of determining the security policy by receiving the harmful traffic data transmitted from the cyber terrorism response system Network security policy determination method further comprising. In a network security system with a processor, A first function of detecting all packets flowing into the access point of the network to determine whether the traffic is harmful traffic according to a security policy; A second function of notifying the cyber terrorism countermeasure system to perform a security policy and generating a detection report if the traffic is harmful as a result of the determination of the first function; And A third function that proceeds to the first function if it is not harmful traffic as a result of the determination of the first function A computer-readable recording medium having recorded thereon a program for realizing this. In a network security system with a processor, A first function of collecting security policy data from a policy management tool or an administrator of another cyber patrol control system; A second function of generating a new policy by converting the collected data into a security policy; A third function of updating existing security policy data with the generated security policy; A fourth function of storing the updated security policy data; And A fifth function of notifying the cyber terror detection system, the cyber terror response system, and the cyber intrusion detection system and distributing the updated policy data to other cyber patrol systems A computer-readable recording medium having recorded thereon a program for realizing this. The method of claim 11, Sixth function of determining the security policy by receiving the harmful traffic data transmitted from the cyber terrorism response system A computer-readable recording medium that records a program for further realization.