KR20030094921A - System and method for Security Information Management and Vulnerability Analysis - Google Patents

Abstract

PURPOSE: A system and a method for managing security information and analyzing fragility are provided to maximize the customer satisfaction by collecting and concentratedly managing the security related information, offering the latest security information to a user, and offering the discriminated security information organically related to a user system. CONSTITUTION: A member information database(10-1) stores the member information. A member information manager(10-2) receives the membership registration by receiving the member information through a web page and recording it to the member information database, and manages the member information database. A security information database(10-3) stores the security related information of each computer program. A security information searcher(10-4) enables the user to select the computer program, searches the security related information for a selected computer program from the security information database, and generates and offers it as a web page form. A web server(19) operates an Internet homepage, and enables the user to use a service offered from the member information manager and the security information searcher.

Description

System and method for Security Information Management and Vulnerability Analysis}

The present invention relates to a security information retrieval and vulnerability analysis system and method thereof, and in particular, to collect and centralize security-related information and provide the information to users through the Internet, thereby allowing users to identify vulnerabilities and security problems inherent in their computer systems. It is to make it easy to know and to provide a systematic security service by managing the security history of the systems operated by users.

Today, the Internet is moving away from the technical concept of a huge network and becoming a place of life that connects individuals and individuals, individuals and organizations, organizations and organizations across all aspects of everyday life. As a result, the number of social activities of organizations and individuals through the Internet has increased, and the dependence on the Internet has gradually increased, and the importance of information flowing on the Internet has also increased.

In particular, various types of personal information are transmitted on the Internet due to the activation of e-commerce. When a computer system used for this is exposed to hacking or a virus, personal information and privacy information may be leaked and abused. Because of the risks, the introduction of security solutions to prevent them is increasing rapidly.

In this regard, various hacking information and tools are easily available on the Internet, and security information and related tools to prevent hacking are also available, but in practice, a computer network that is properly secured using such information is extremely rare. It's bad. The existing security solutions such as firewalls, intrusion detection systems, and vulnerability detection systems or information security consulting are conducted by individually checking and analyzing the vulnerabilities of hosts. There was a problem that did not match.

In addition, general server administrators always feel the need for security, but they often fail to realize their expertise or interest in security, but security is necessary, and as security technology changes continuously, care must be taken constantly. Because it is part. In particular, even if you are interested in security, you often don't know where to get the information and how to apply it. For this reason, there will be a great need for a systematic explanation of security and a tool for easily obtaining the security information that one wants.

Accordingly, the present invention has been proposed to solve the above problems, and collects and centralizes security related information and provides the latest security information to the user through the Internet, as well as organically related and differentiated security with user systems. The purpose is to provide a system and method for maximizing customer satisfaction by providing only information.

In order to achieve the above object, the security information management system according to the present invention, a member information database for storing member information; A member information manager which receives member information through a web page for service subscription, records the member information in the member information database, receives member registration, and manages the member information database; A security information database storing security related information for each computer program; A security information retrieval unit for allowing a member to select a specific computer program and for retrieving security related information about the selected computer program from the security information database and generating and providing it in the form of a web page; And a web server operating an internet home page to interface with each user's computer through an internet network so that the users can use the services provided by the member information management unit and the security information retrieval unit. do.

In addition, the vulnerability analysis system according to the present invention, a member information database for storing member information; A member information manager which receives member information through a web page for service subscription, records the member information in the member information database, receives member registration, and manages the member information database; A history information database for storing information on security process history for each member; A history information management unit which receives information about a security process history performed by a member host through a web page for history information input from a member, records the information in the history information database, and manages the history information database; A security information database for storing security related information including security vulnerabilities and computer solutions for each computer program; According to the member's request, the history information of the member's host is inquired through the history information manager, and the security vulnerability of the member's host is extracted by referring to the security information database according to the inquired history information, and then, Security history analysis unit to generate and provide in the form; And a web server for interfacing the users to use the services provided by the member information management unit, the history information management unit, and the security history analysis unit by operating an Internet home page and accessing each user's computer through the Internet network. It is characterized by including.

The security information management system and the vulnerability analysis system may be more preferably implemented by integrating with each other.

1 is a schematic diagram of a service according to the present invention;

2 is a configuration diagram of a first embodiment according to the present invention;

3 is an embodiment of a configuration item of a security information database;

4 is an embodiment of an input web page for searching security information;

5 is an embodiment of a web page for security information output;

6 is a configuration diagram of a second embodiment according to the present invention;

7 illustrates an embodiment of a web page for inputting and outputting host information;

8 is an embodiment of a web page for inputting and outputting history information;

9 is one embodiment of a vulnerability and solution extraction process,

10 to 13 is an embodiment of a web page for providing a vulnerability and a solution,

14 is a configuration diagram of a third embodiment according to the present invention;

15 is an embodiment of a configuration of a security information database;

16 to 17 are detailed embodiments of the table configuration items of the security information DB.

18 is a flowchart illustrating a security information management and vulnerability analysis method.

* Explanation of symbols for main parts of the drawings

10: security information management system

20: Vulnerability Analysis System

30: Security Information Management and Vulnerability Analysis System

10-1, 20-1, 30-1: Member Information Database

10-2, 20-2, 30-2: Member Information Management Department

10-3, 20-3, 30-3: security information database

10-4: security information search unit 20-4: security history analysis unit

20-5: history information database 20-6: history information management

19, 29, 39: Web server 60: Internet network

70: user host

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, an overview of a service according to the present invention will be described with reference to FIG. 1.

A user (member) who wants to use the security information management service is provided with a security service by accessing a web server through the Internet.The security information database collects systematically by collecting security information related to various operating systems (OS) and applications. Are stored / managed. The member security manager applies for service subscription and is provided with security-related information (vulnerabilities, security advisories, technical documents, etc.) transmitted by the web server using the security information database. Of course, the operator-side administrator (system administrator) that provides the security service according to the present invention can also retrieve the security information.

On the other hand, the member-side security manager who wants to use the vulnerability analysis service requests the system administrator to join the service, and the system administrator registers the member (company or individual) customer information on the web server as a member. On the other hand, the member-side security manager accesses the web server and registers the department manager of the company and the host administrator of the company, so that the user of the company can use the service individually. Then, each user of the company inputs the history information of the host managed by the company into the web server, and the web server refers to the security information database based on the history information entered by the users to create a web page about the vulnerability and its solution. Create it and pass it to the user. Of course, a security administrator or a system administrator can also view user-specific security information.

2, a preferred embodiment of the security information management system 10 according to the present invention will be described in detail.

The member information management unit 10-2 and the security information retrieval unit 10-4 are components interworking with the web server 19, and may be preferably implemented through a computer program installed in the web server 19. Depending on the size of the load provided by the service provided in a separate computer system can be configured to work with the web server 19, of course. Each database 10-1, 10-3 is embodied in a digital storage medium interworking with the web server 19. Preferably, the security information management service according to the present invention is provided through a specific Internet homepage (Internet site), and the web server 19 connects to the host 70 of each user through the Internet network 60.

The member information database 10-1 is a component for storing various member information and is managed by the member information management unit 10-2. The member information management unit 10-2 provides a web page for service subscription to a user who wants to register as a member, receives information necessary for member registration from the user, records the entered member information in the member information database 10-1, Complete the registration. In terms of business, membership can be made directly to the system administrator offline, as well as input by the system administrator separately.

The security information database 10-3 is a component that stores various security-related information for each computer program. Security information related to various operating systems and applications is collected and systematically stored / managed. Program information and patch information For example, vulnerability information, how to resolve vulnerabilities, how to identify vulnerabilities, and security documentation. Such security related information may be input from time to time by the system administrator.

Referring to FIG. 3, the embodiment of the items constituting the security information database 10-3 will be described in more detail. Program information (program related information, program version information, executable program information for each operating system, company information, etc.) , Patch information (patch related information, patch information contained in a patch cluster, patches that need to be patched like the current patch, patches that are meaningless because of the current patch, patches that conflict with the current patch, etc.), vulnerabilities Information, information on resolving vulnerabilities, information on vulnerability verification methods, mapping information (mapping information on program and vulnerability resolution methods, mapping information on vulnerability resolution and patch information, mapping information on vulnerability information and vulnerability resolution methods, etc.) ) And the like.

The security information search unit 10-4 may select a specific computer program from a member who wants a security search (for example, when a member accesses a homepage and clicks a security information search item) as shown in FIG. 4. Send the page to ask the member what computer program they are interested in. In the example of FIG. 4, the member has entered that he wants to know the security related information when using the BIND 9.x version in version 7 of the "Solaris" operating system.

Then, the security information retrieval unit 10-4 stores security information about the computer program selected by the member (for example, a problem when using the BIND 9.x version in version 7 of the "Solaris" operating system). -3) is generated in the form of a web page as shown in the example shown in FIG. 5 and provided to the host 70. This web page may include information about whether the selected program has a security vulnerability, information about how to fix it, patch information, and related literature.

In addition, a member may be provided with a service related to a specific computer program as described above, but of course, the member may also be exposed to security-related matters related to various computer programs published on a bulletin board according to an information providing procedure on a general homepage. In other words, the homepage may include web pages that perform various additional functions. For example, various search screens such as the security advisory search page or the incident note search page and bulletin board / data room are provided so that general users can easily access the security information. You can do that.

In the above-described embodiment, security related information is provided by accessing the homepage that provides the service and inputting a specific computer program if the member desires. However, computer related technology is rapidly changing, and thus related to various computer systems of the member. There is a great need to provide security services systematically and continuously.

FIG. 6 illustrates an embodiment of a vulnerability analysis system 20 capable of providing such a service, and includes a member information database 20-1, a member information management unit 20-2, and a security information database 20-3. , And the functions of the web server 29 are the same as those of the corresponding components 10-1, 10-2, 10-3, 19 of the security information management system 10 described above.

The history information database 20-5 is a component that stores information about a security process history for each member. Since this embodiment is to continuously and systematically provide a suitable security service according to the current situation of each member side host and the history of security measures in the meantime, the history information includes the state information of the member side host and the past. Security-related history information.

That is, the history information management unit 20-6 transmits the history information input web page to the member side host 70 as shown in FIG. 7 to register the member side host 70 information to receive the history information database ( 20-5) and record. 7 shows an example of inputting basic information of the host (host name, type, location, other description, operating system and version, etc.) and computer program information installed in the host by selecting the "Host history registration" item. have.

In FIG. 6, a host accessing a web server using a service and a host to analyze a vulnerability through historical information are shown as the same computer system, but a computer system using a service accessing a web server and using a vulnerability is shown in FIG. 6. It is obvious that the computer systems to be analyzed can be different. That is, the member can access the web server using any computer system and use the vulnerability analysis service, and the host, which is the subject of the history information management, is the web server, database server, DNS of the member operated / managed It can be a server, a mail server, and so on. This is because it is necessary to know only the current operation state or history information of the analysis target computer system in order to receive the vulnerability analysis service according to the present invention.

In addition, FIG. 8 illustrates an embodiment of a web page for selecting a host and a specific computer program and registering a security history thereof. The list of vulnerabilities that have been solved and the list of vulnerabilities to be solved are shown. Such member-specific history information is stored and managed in the history information database 20-5, and the member can inquire at any time.

Meanwhile, the security history analysis unit 20-4 inquires the history information of the member host 70 through the history information management unit 20-6 and provides it in the form of a web page according to the member's request, or the inquired history. According to the information, the security vulnerability of the member-side host 70 extracted with reference to the security information database 20-3 and a solution thereof are generated and provided in the form of a web page.

9, an embodiment of extracting a security vulnerability of the member-side host 70 and a solution thereof will be described in detail.

If there is a vulnerability analysis request of the host through the web server 29 from the user host 70 (S21), the security history analysis unit 20-4 is the member side host 70 through the history information database 20-5 Inquiry of computer program information installed in (S22), and read the vulnerability information about each computer program inquired from the security information database (20-3) (S23). In addition, the security history analysis unit 20-4 inquires the vulnerability information that has been addressed and resolved among the security histories of the corresponding host stored in the history information database 20-5 (S24), and inquired in step S23. By excluding the resolved item queried in step S24 from the vulnerability information, the vulnerability currently contained in the host 70 is extracted (S25).

Then, the security history analysis unit 20-4 inquires from the security information database 20-3 the solution information that can solve the currently extracted vulnerability (S26), generates a web page form, and then the web server 29 It delivers to the member host 70 through (S27, S28). 10 to 13 illustrate examples of web page forms generated in step S27. An example of such a web page may be arbitrarily configured and detailed description thereof will be omitted.

Although the security information management system 10 and the vulnerability analysis system 20 described above may be implemented respectively, in consideration of the similarity of services, the security information management system 10 and the vulnerability analysis system 20 may be integrated and implemented as in the embodiment shown in FIG. 14. In this case, each service can be provided in one homepage, and the user can access both the homepage and receive both services.

At this time, the member information database 30-1, the member information management unit 30-2, the security information database 30-3, and the web server 39 are shown in FIGS. 2 and 6 regardless of the reference numerals. A component that performs the same function as the component. However, the fact that a plurality of components may be configured to interwork with each other for a specific reason such as service load is within the obvious scope in the art.

Meanwhile, in order to efficiently provide security information management and vulnerability analysis services as described above, a security information database that stores, manages, and maintains various security information plays an important role.

Preferably, a program information area for inputting, storing, modifying, inquiring, and deleting codes of various operating systems (OSs) and applications, and inputting, storing, modifying version information of operating systems and applications, Version information area that can be searched and deleted, vulnerability information area that can input, save, modify, search and delete various vulnerability information of OS and application, solution information for various vulnerability information can be entered, stored, modified, search and delete Possible solution information area, patch information area for inputting, storing, modifying, querying, and deleting patch information of an operating system and an application, and mapping an operating system and an application to corresponding solution information among the above solution informations. A first mapping area, a second for mapping each vulnerability information with corresponding solution information among the solution information It may be configured to include a mapping area, and a third mapping area for mapping each solution information with the patch information corresponding to one of the patch information.

FIG. 15 illustrates a correlation between tables generated and maintained by each component. Tables maintained by each component are shown in Table 1 below.

Table name Retention area Prg Program Information Area Prg_Ver Version Information Area Vulner Vulnerability Information Area Solve Solution Information Area Patch Patch information area Map_Prg_Solve First mapping region Map_Vulner_Solve 2nd mapping area Map_Solve_Patch 3rd mapping area

Thus, examples of the preferable items constituting each table are shown in FIGS. 16 and 17. The meaning of each item is described in the "Remarks" column, and will not be described again.

A method of performing security information management and vulnerability analysis through the security information database structure configured as described above will be described with reference to FIG. 18.

First of all, it is possible to input, save, modify, search and delete various operating system (OS) and application programs, code, related information, version information, vulnerability information, solution information, and patch information. Collect (information collecting step: S91).

For each information collected in the information collection step, solution information corresponding to each operating system and application program, solution information corresponding to each vulnerability information, and patch information corresponding to each solution information are mapped to each other (mapping step: S92). ).

Then, according to the mapping relationship made in the mapping step, vulnerability information about a specific operating system or application, solution information and patch information for solving the vulnerability are extracted (vulnerability analysis step: S93).

Steps S91 to S93 are procedures performed by a security information database and a database management system (not shown), and the information extracted in step S93 is delivered to members in the form of a web page through the system according to the present invention. Can be.

Now, a specific embodiment of the vulnerability analysis will be described using "Solaris in.fingerd information disclosure vulnerability" as an example.

This vulnerability is used to detect system account information using the finger daemon. It is applicable to Solaris 2.5, 2.5x86, 2.6, 2.6x86, 7, 7x86, 8, 8x86, and is provided by SUN for each operating system (OS). There is a patch. At this time, code information of Solaris 2.5, 2.5x86, 2.6, 2.6x86, 7, 7x86, 8, and 8x86 is stored in the Prg table and the Prg_Ver table, respectively.

The description of the Solaris in.fingerd information disclosure vulnerability is stored in a single record in the vulner table. As a solution, the information that SUN provides different patches for each operating system is stored in eight records in the Solve table. In addition, detailed information of each patch is stored as eight records in the Patch table.

At this point, you need a mapping table that connects this information. The map_prg_solve, map_vulner_solve, and map_solve_patch tables play this role. In other words, the Solaris in.fingerd information disclosure vulnerability information (Solve) and the information that there is a patch provided by SUN to resolve it (Solve) are stored in map_vulner_solve as 8 records, and these solutions are stored in Solaris 2.5, 2.5x86, Information corresponding to 2.6, 2.6x86, 7, 7x86, 8, and 8x86 is managed as 8 records in map_prg_solve. Also, linking detailed patch information and solution information is managed as 8 records in map_solve_patch.

If the solution is not a patch but a configuration change that is applied equally across all operating systems, the patch table and map_solve_patch table have no content, the solve table is kept in one record, and the map_prg_solve table The information is kept in eight records.

In other words, the program can be specified in the Prg and Prg_Ver tables. Vulnerability solution information related to this program can be selected using the Map_Prg_Solve table. Using the selected solution information, the patch information or vulnerability information necessary for resolution can be retrieved. . In addition, since each correlation is processed using mapping information, not only 1: 1 information but also relationship expression of 1: n, n: 1, n: n is possible. In addition, mapping information can be used to infer related programs and vulnerability information from the patch table, and it can be inferred from the vulnerability information which program has the corresponding vulnerability and how it can be solved.

According to the present invention, it is possible to systematically manage the security history of the user system, it is also possible to provide customized security information, integrated security that cannot be provided by individual security solutions (firewall, intrusion detection system, vulnerability screening system, etc.) You can implement a service. Therefore, each company or individual can be provided with improved and organically related security services, thereby improving the business efficiency and security capabilities of the company.

Claims (5)

A member information database storing member information; A member information manager which receives member information through a web page for service subscription, records the member information in the member information database, receives member registration, and manages the member information database; A security information database storing security related information for each computer program; A security information retrieval unit for allowing a member to select a specific computer program and for retrieving security related information about the selected computer program from the security information database and generating and providing it in the form of a web page; And It is characterized in that it comprises a web server for interfacing the user to use the services provided by the member information management unit and the security information retrieval unit by connecting to each user's computer through the Internet network by operating the Internet home page Security Information Management System. A member information database storing member information; A member information manager which receives member information through a web page for service subscription, records the member information in the member information database, receives member registration, and manages the member information database; A history information database for storing information on security process history for each member; A history information management unit which receives information about a security process history performed by a member host through a web page for history information input from a member, records the information in the history information database, and manages the history information database; A security information database for storing security related information including security vulnerabilities and computer solutions for each computer program; At the request of the member, the history information of the member host is queried through the history information management unit and generated and provided in the form of a web page, or the security vulnerability of the member host is referred to by referring to the security information database according to the inquiry history information. A security history analysis unit that extracts and solves them and generates and provides them in the form of a web page; And By operating the Internet home page and connecting to each user's computer through the Internet network, a web server that interfaces the user to use the services provided by the member information management unit, history information management unit, and security history analysis unit Vulnerability analysis system comprising a. A security information retrieval and vulnerability analysis system comprising both the security information management system of claim 1 and the vulnerability analysis system of claim 2, wherein each service is provided in the Internet homepage. A program information area for inputting, storing, modifying, retrieving, and deleting codes of various operating systems (OSs) and application programs; A version information area for inputting, storing, modifying, inquiring, and deleting version information of the operating system and an application program; A vulnerability information area for inputting, storing, modifying, inquiring, and deleting various vulnerability information of the operating system and applications; A solution information area for inputting, storing, modifying, inquiring, and deleting solution information about the various vulnerability information; A patch information area for inputting, storing, modifying, querying, and deleting patch information of the operating system and an application program; A first mapping area for mapping the operating system and an application program with corresponding solution information among the solution information; A second mapping area for mapping the vulnerability information with solution information corresponding to one of the solution information; And And a third mapping area for mapping the solution information to the patch information corresponding to the patch information, wherein the solution information includes security information management and vulnerability analysis data. Collecting information by inputting, storing, modifying, inquiring and deleting various operating systems (OS) and applications, code and related items, version information, vulnerability information, solution information, and patch information Information collecting step; A mapping step of mapping solution information corresponding to each operating system and an application program, solution information corresponding to each vulnerability information, and patch information corresponding to each solution information with respect to the information collected in the information collection step; And Security information management and vulnerability analysis method comprising a vulnerability analysis step of extracting vulnerability information for a specific operating system or application, solution information and patch information to solve the vulnerability according to the mapping relationship made in the mapping step .