KR20030057929A - Public network and private network combination security system and method thereof - Google Patents

Abstract

PURPOSE: An internal/external network integrated security system and method thereof are provided to control every traffic generated on a network and actively cope with a security violation event by adding a network detecting function and performing an independent log policy. CONSTITUTION: A firewall system(100) improves a performance of a security system by recording only a violated matter among functions such as a packet filter, a NAT(Network Address Translation) and a VPN(Virtual Private Network) as log information. An NIDS(Network Intrusion Detection System)(200) actively copes with a violated matter by detecting a traffic generated on an internal network. The NIDS collects and analyzes packets, then records only a violated matter as log information. A network log managing system(300) records log information on a traffic used in an internal network and a traffic from the internal network to an external network or from the external network to the internal network, and improves a performance and safety of a security system by collecting packets through an interface. A Log1 is a database storing violation log information in the firewall system(100). Log2 is a database storing detection(violation) log information received from the NIDS(200). Log3 is a database storing log information of a normally passed traffic in the firewall system(100) and every network traffic generated in the internal network. Interface1 is exclusively used for the external network. Interface2 is exclusively used for the internal network and communication. Interface3 is exclusively used for the NIDS. Interface4 is exclusively used for a network log.

Description

Internal and external network integrated security system and method {PUBLIC NETWORK AND PRIVATE NETWORK COMBINATION SECURITY SYSTEM AND METHOD THEREOF}

The present invention relates to a security system and method, and in particular, based on a firewall and a network intrusion detection system (hereinafter referred to as NIDS) to provide not only an external network security function but also an internal network security function. The present invention relates to an internal and external network integrated security system and method.

A firewall used in a computer system refers to a system for protecting important information and resources of an internal network connected to an external network, such as the Internet, from illegal intrusion through an external network. The firewall system provides powerful access control to protect the internal network from the outside. The firewall system is configured to allow and deny special services or hosts by applying specific rules. If the network traffic matches the allowed pattern, the service or connection is allowed, and it does not consider what packets it contains.

The existing firewalls can be divided into surrogate connection and packet blocking. The surrogate access method also applies a policy based on the user's information and the destination's information in a manner of directly blocking the user's access at the point where traffic is concentrated and acting as a substitute for the destination. This method has low performance because it blocks all connections and directly acts on its own, as well as the policy checking speed to be applied.

On the other hand, the packet blocking method compares all packets coming and going between two networks at the traffic concentration point and performs blocking and traversal. In this case, there is no need to run a separate program on the firewall system. Since there are many performance advantages over the surrogate connection because it does not block, most traffic is handled by the packet-blocking method, and the surrogate connection is applied only to some special communication methods.

However, such a packet blocking firewall system is also advantageous in terms of performance compared to the surrogate connection method, but does not allow perfect processing of rapidly increasing Internet traffic. This is due to the delay in the process of comparing all incoming packets with the policy that has been set individually, and it can be said that over 80% of the performance degradation of the packet blocking firewall system is due to the delay in determining the policy. .

As such, the firewall can control only the traffic from the internal network to the external network or the external network to the internal network, and it is practically impossible to control the traffic occurring in the internal network, and the main engine including the log function (that is, Network log management system) causes performance degradation.

IDS, on the other hand, is a security device that informs administrators of intrusion attempts in real time through the process of comparing traffic packets to the system and hacking databases. Has a difference.

The IDS performs the functions of traffic control, real time monitoring and intrusion detection, intrusion prevention, intrusion analysis and reporting. In general, the IDS is located between the router and the firewall, so it can detect intrusions into the firewall or the internal network.

These IDSs are classified into network-based IDS (NIDS) and host-based IDS (HIDS), and the difference is physical location. The NIDS generally analyzes all packets of traffic that are located under the firewall in the network tree and attempts to access the entire customer's system.The HIDS analyzes only those packets that are installed on the server to be secured and processed by the server. .

The higher the number of systems, the more economical it is, and because it does not use the resources of the system to reduce the load of the server, while the traffic has a disadvantage that acts as a load factor for the entire network. Since the HIDS is installed in the server, the network load can be reduced, and since the HIDS can be installed only in the server to be secured, the smaller the size of the system, the lower the cost. However, because it utilizes the resources of the server, it can act as a load factor, and since the product per server must be installed, the cost increases proportionally as the size of the system increases.

As already explained, the firewall and IDS have different advantages and disadvantages, but they have been configured only independently, and therefore, there is a tendency that security hole problems occur frequently as well as an increase in installation cost.

Accordingly, the present invention has been made to solve the above problems, and aims at maximizing security functions and performances by compensating for the disadvantages of existing security systems that cannot be actively responded to.

Another object of the present invention is to integrate a network detection function with an existing security system and to perform an independent log policy to actively respond to a security breach as well as to control all traffic occurring in the network.

1 is a schematic block diagram of an internal and external network integrated security system according to the present invention.

2 is a view for explaining the internal and external network integrated security method according to the present invention.

※ Explanation of code about main part of drawing ※

100: firewall system 200: network intrusion detection system

300: network log management system Log1: policy violation log

Log2: Security violation log Log3: Log all traffic

The security system according to the present invention mainly comprises a firewall system, a network intrusion detection system, and a network log management system, and the log information of all the traffic information of the internal network and the traffic information determined to be suitable for the security policy in the firewall system It is stored by the log management system, and the firewall and NIDS integrated system can efficiently operate the firewall and NIDS integrated system by independently storing the log information that delays the processing time.

The firewall system and the network intrusion detection system may record only the policy violation log or the security violation log and the network log management system records all collected logs to improve security performance and safety.

1 is a schematic block diagram of an internal and external network integrated security system according to the present invention. The security system includes a firewall system 100, a network intrusion detection system 200 (NIDS), and a network log management system 300. (Log_system).

The firewall system 100 records only the violations among functions such as packet filter, NAT (Automatic Address Translation), VPN (Virtual Private Network) as log information, and the like. Improve performance

The network intrusion detection system 200 detects the traffic occurring on the internal network and actively responds to the violations, is processed in a packet collection analysis response step, and records only the violations as log information.

The network log management system 300 records log information on internal usage traffic in the internal network and traffic from the internal network to the external network and the external network to the internal network. It collects and records the packets collected by each existing function through a separate interface to further improve the performance and safety of the security system.

Log1 is a database where violation log information in the firewall system 100 is stored, Log2 is a database where detection (violation) log information from the NIDS 200 is stored, and Log3 is a traffic that is normally passed through the firewall system 100. And all network traffic log information generated in the internal network are stored by the network log management system 200.

Interface 1 is for external network, Interface 2 is for internal and communication, Interface 3 is for NIDS only, and Interface 4 is for network logs only.

Each of the network interfaces 1, 2, 3, and 4 is used to interface with internal and external networks, and is named the Institute of Electrical (IEC) named Carrier Sense Multiple Access with Collision Detection (CSMA / CD) access method and Physical layer specifications. and Electronics Engineers) are designed to meet standard 802.3. However, one of ordinary skill in the art will appreciate that a network interface designed to operate with other media access techniques or standards may be used in the present invention.

Referring now to Figure 2, which is a diagram illustrating a method for integrated internal and external network security according to the present invention will be described the operation of the internal and external network integrated security system.

A. External Network => Internal Network, Internal Network => External Network

1) Firewall system (100)

a. External network => internal network

The packet flowing into Interface1 at the point where the security system is located according to the present invention performs packet filter, VPN, and NAT functions according to the security policy of the firewall system to determine whether to allow and reject the packet to the internal system. In this case, if all log recordings for conditions that are allowed and rejected (blocked) are performed as in the prior art, packet processing performance is deteriorated. Therefore, log records are left only for rejected conditions, and allow packets are processed by a separate log system. Turn it over.

b. Internal network => external network

A packet filter, a VPN, and a NAT function are performed according to the security policy of the firewall system for the packet flowing into the interface 2 at the point where the security system according to the present invention is located. In this case, if all log records for the conditions allowed and rejected (blocking) are performed, packet processing performance is degraded. Therefore, log records are recorded only for the rejection conditions, and allow packets are processed by a separate log system and passed to Interface 1.

B. Internal network => internal network, internal network => external network, external network => internal network

2) network intrusion detection system (200)

This security system interface3 collects and analyzes all network packets in the internal network to proactively respond to violations and log them. The interface 4 is used exclusively for the network detection system.

3) Network log management system 200

This security system interface4 collects all network packets of internal network and manages them by log. In the present system, the network log management system 200 stores the traffic information and the log information of all traffic information of the internal network determined to be suitable for the security policy in the firewall system 100, and the system 200 In the integrated security system of the firewall system and the NIDS, the firewall and the NIDS integrated system can be efficiently operated by independently storing the log information with the lowest processing time. For reference, the system 200 may be driven by separate hardware to further improve performance, and the firewall system 100 and the NIDS 200 may also be driven by separate hardware to improve performance. Interface 4 is dedicated to network packet collection and integrates the log function in the firewall system and the network intrusion detection system.

As explained above. The security system according to the present invention incorporates a network detection function into an existing security system in order to design a method for maximizing security functions and performances by securing the shortcomings of the existing security system, and all generated on the network due to an independent log policy. It controls the traffic and proactively responds to security violations, and there is a separate remote management and system management module to check the system performance and status so that the system can operate under the best conditions.

According to the present invention, it is possible to maximize the security function and performance by securing the shortcomings of the existing security system that was not active response on the network.

In addition, since the firewall system and the network intrusion detection system operate separate log systems without performing all log records for the conditions that are allowed and denied, the packet processing performance does not decrease, so the security system can be operated under the best conditions. Make sure

Claims (4)

A firewall system that detects traffic from the external network to the internal network or the internal network to the external network and stores only the policy violation log as the first log DB; A network intrusion detection system for detecting a traffic occurring on an internal network and storing only a security violation log as a second log DB; And Internal and external network integrated security system comprising an interface means for interfacing with an internal network, an external network. The internal / external network integrated security system of claim 1, further comprising a network log management system configured to store and manage logs of traffic suitable for the security policy of the firewall system and logs of all traffic generated in the internal network. Determining, by the firewall system, whether there is a policy violation against them through packet collection and analysis, wherein only the policy violation log is stored in the first log database; The network intrusion detection system includes a step of determining whether a security violation against them through packet collection and analysis, wherein only the security violation log is stored in the second log database. The method according to claim 3, further comprising the step of the network log management system storing and managing traffic logs suitable for the security policy of the firewall system and all network traffic logs generated in the internal network. .