KR20030060306A - Using object module, active customized firewall - Google Patents

Abstract

PURPOSE: A manager customized dynamic firewall using an object module is provided to enable a manager to express a desired security policy precisely and intentionally by using the object module and defining the relationship between the modules, and to meet a specific situation fast and voluntarily by using an operation object module. CONSTITUTION: A tag(4) is formed by capping a capsule(3) to a packet coming in a firewall computer. If the packet passes the specific object module after the operation module, the tag carries out a specific operation. The processed packet capped by the capsule flows by following a policy object module fixed by the intention of the manager. Each policy object has a result, and the packet flows to different object according to the result. Thus, a different security policy is fixed to each packet.

Description

Administrator dynamic dynamic firewall using object module {Using object module, active customized firewall}

The present invention relates to a security system for enhancing the security of a computer network, and more specifically, to an administrator-customized on a firewall computer located between a non-secure Internet and a secure intranet. It is about a dynamically settable method.

In general, a firewall computer uses the same method as shown in FIG. Typically, for example, the packet filtering method is used to check whether or not the information of the packet violates the security policy to determine access or to filter the data at the application layer. There is a way to check the integrity and determine the entry and exit of packets. As such, the existing method has a limitation in creating a security policy that the administrator wants to use by only checking whether it is in violation of the established policy and controlling access and only using the same security policy for incoming packets. There is a problem in that it is unable to respond quickly and proactively because it is taking a proper way.

The present invention is to solve the above problems to make each security policy as a policy object module and to design the overall security policy by defining a relationship between the object modules, depending on the result after passing through each object module As the object module to be changed is different, it removes the limitation in expressing the security policy that the administrator thinks, and sets the operation object module 6 according to the result of the object module so that it can operate itself when it is placed in a specific situation, and responds quickly and actively. The purpose is to.

In order to achieve the above object, the present invention is characterized in that detailed policies and actions are made into object modules, define relationships between object modules, complete the overall security policy, and specify actions to proactively deal with them.

1 is a conceptual diagram showing how a security policy of a general firewall is applied;

2 is a structural diagram of an encapsulated (or processed) packet.

3 is a conceptual diagram illustrating a method of applying a security policy of an object module

4 is a diagram for defining object modules and defining relationships

<Description of the symbols for the main parts of the drawings>

1: Security Policy 2: Packet

3: capsule 4: tag

5: policy object module 6: action object module

When described in detail by the accompanying drawings as follows.

2 is a structural diagram showing the processing of a packet. A packet 4 is formed by encapsulating a packet entering a firewall computer 3. This tag is used to indicate the object module through which a packet has been passed, and to allow a specific action when a packet passing through a specific object module comes in from the operation module.

The encapsulated processed packet then flows along the policy object module set as the administrator intended, as in FIG. Each policy object module 5 has a result and, according to the result, the packet flows to another object module so that a different security policy can be specified for each packet.

The processed packet coming in through the policy object module 5 performs an action if there is a designated action object module. After passing through all the object modules, only the packets to be passed back to their pre-processing appearance.

Through this, it is possible to become an active type of firewall system, not just control.

Next, as the administrator sets the security policy with the object module, the administrator checks the security policy to be set as' the packet from 192.168.3.2 is checked for data problems' or '129.37.34.4 to 211.155. Based on the table in Figure 4, setting up and defining an object module is based on the time, originating address, and reception of the firewall computer. The object module is set by grasping the flow of the policy object module 5 or the operation object module 6 by systematically arranging the address, the service corresponding to the packet, the operation to be performed, and the result of performing the object module. So administrators can express their desired security policies as intended.

As described above, the present invention can express the security policy desired by the administrator in a detailed and intended manner by using the object module and define the relationship between the modules to establish the security policy. Be able to respond quickly and actively to specific situations.

Claims (2)

In a computer firewall, a network security method using an object module in which different security policies are applied to each packet according to the result, and then connected to an action. 2. The method of claim 1, wherein configuring and defining an object module is a structure consisting of a time entered into a firewall computer, a source address, a destination address, a service corresponding to a packet, an operation to be performed, and a result of performing an object module.