KR20030096582A - Apparatus and method for blocking harmful internet site - Google Patents

Abstract

PURPOSE: A device and a method for intercepting a harmful Internet site are provided to intercept the harmful site from all Internet lines without a management device for a subscriber of a harmful site interception service. CONSTITUTION: A subscriber terminal(10) receives an Internet service. A DSLAM(Digital Subscriber Line Access Multiplexer)(20) sends a signal to a fast backbone line by using a multiplex technology as receiving an access signal from the subscriber terminal. An NAS(Network Access Server)(30) connects the subscriber to the Internet network by receiving the signal of the DSLAM and manages traffic. A certification server(40) certifies the access of the subscriber and selects the subscriber for the harmful site interception service. A switching part(50) connects the subscriber subscribing for the harmful site interception service to the Internet network and manages the traffic. An interception server(60) intercepts the access to the harmful site from the subscriber connecting to the switching part by keeping a list of the harmful site.

Description

Apparatus and method for blocking harmful internet site}

The present invention relates to an apparatus and method for blocking harmful sites of the Internet, and more particularly, to classify service usage by classifying harmful site blocking service subscribers among Internet service subscribers into a specific domain and performing L2TP (Layer 2). The present invention relates to a harmful site blocking device and a method for blocking harmful sites using a tunneling protocol (Funneling Protocol) function.

Recently, due to the rapid expansion of the Internet, various services are provided on the Internet.

Most of these Internet services are open and accessible to anyone.

However, there are sites that provide useful information for living on the Internet service, but there are sites that are likely to cause psychological stimulation and confusion of values of growing teenagers such as pornography sites and suicide sites.

These services are one of the side effects of the development of the Internet, adversely affecting the emotions of adolescents.

Therefore, the existing harmful site blocking connects subscribers to a specific NAS (Network Access Server) using the Asynchronous Transfer Mode (ATM) connection function connected to the Internet subscribers so that the subscribers connected to the NAS receive the harmful site blocking service as a whole.

However, the above method has to install a separate NAS for subscribers to the harmful site blocking service, there is a problem that you can not use both the normal Internet service and harmful site blocking service in one Internet line.

The present invention, in order to solve the above-mentioned problems, it is an object to block harmful sites on all Internet lines without a separate management device for harmful site blocking service subscribers.

1 is a block diagram of a harmful site blocking apparatus according to the present invention.

2 is a general Internet service providing flowchart.

3 is a flowchart for providing a harmful site blocking service according to the present invention.

To this end, the present invention, when the Internet service subscriber attempts to access the NAS receives a connection signal from the Digital Subscriber Line Access Multiplexer (DSLAM) to allocate a Point-to-Point Protocol (PPP) and Internet Protocol (IP) to the subscriber terminal; An authentication server for authenticating the subscriber; A switching unit for authenticating a harmful site blocking service subscriber among subscribers and allocating PPP and IP to a terminal of the harmful site blocking service subscriber; And a blocking server that holds a list of harmful sites and blocks a subscriber connected to the switching site from accessing the harmful site. When the IP is assigned and the subscriber is a harmful site blocking service subscriber, the authentication server delivers the IP address and subscriber information for the switching unit to the NAS, and the NAS forms an L2TP tunnel to the switching unit and delivers the subscriber information.

And a first step of authenticating the subscriber in the authentication server when the Internet service subscriber accesses the NAS; A second step of, if the subscriber performs the authentication process by the authentication server and the subscriber is a harmful site blocking service subscriber, delivering the IP address and subscriber information to the NAS to the NAS; A third step in which the NAS forms an L2TP tunnel to the switching unit and transmits the harmful site blocking service subscriber information using the formed L2TP tunnel to authenticate the subscriber; A fourth step of allocating PPP and IP from the switching unit to the harmful site blocking service subscriber station in case of a valid subscriber as a result of authentication of the switching unit; And a fifth process of monitoring the Internet traffic of the harmful site blocking service subscriber through the switching unit in the blocking server, and transmitting the traffic of the subscriber accessing the harmful site.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a harmful site blocking apparatus according to the present invention, which receives a connection signal of a subscriber terminal 10 and a subscriber terminal 10 provided with an Internet service, and sends a signal to a high-speed backbone line using a multiplexing technique. DSLAM 20, NAS 30 that connects subscribers to the Internet network and manages traffic by receiving signals from DSLAM 20, authentication server 40 for authenticating subscribers' access and selecting harmful site blocking service subscribers, subscribers The subscriber connected to the switching unit 50 is connected to the switching unit 50 by certifying the subscriber who subscribed to the harmful site blocking service, connecting the subscriber to the Internet network, and managing the traffic, and the list of harmful sites. And a blocking server 60 for blocking access to the server.

The authentication server 40 exists to provide the Internet service using the NAS 30, and the subscriber can use the Internet service after receiving the connection authentication through the authentication server 40.

That is, a general Internet service subscriber attempts to access the Internet through the subscriber terminal 10, as shown in FIG. 2, and when connected to the NAS 30 through the DSLAM 20 (S120), the NAS 30 ) Transmits the subscriber information to the authentication server 40 for authentication of the subscriber to perform authentication for access (S130), and if the authentication server 40 is authenticated (S140), assigns the PPP and IP to the subscriber. Access to the Internet network (S150).

However, subscribers to the harmful site blocking service among the Internet service subscribers use a specific domain to be separated from the authentication server 40.

For example, when using a user @ children, when a subscriber with such a domain is connected, the authentication server 40 analyzes the domain and determines that the subscriber is a harmful site blocking service subscriber by @children, The IP address and the related information for the switching unit 50 which performs the actual management of the blocking service subscriber is transmitted to the NAS 30.

The NAS 30 then uses this information to form an L2TP tunnel with the switching unit 50 and deliver the subscriber's ID and password.

L2TP is one of the technologies that enables secure companies to access their corporate servers while keeping their security on the network for employees on the move or on-premises connected to corporate tasks.

In this case, the switching unit 50 performs the L2TP Network Server (LNS) function of the L2TP, and the NAS 30 performs the L2TP Access Concentrator (LAC) function of the L2TP.

That is, when the switching unit 50 generates a virtual interface for PPP, the NAS 30 completes the PPP through this virtual interface.

After receiving the subscriber information, the switching unit 50 authenticates the subscriber and, if the subscriber is a registered valid subscriber, directly assigns the PPP and IP to the subscriber station 10 and directly manages the traffic of the subscriber. The switching unit 50 having such a function may be a router or a switch.

Here, the NAS 30 serving as a LAC performs a function of directly connecting subscriber connection traffic to the switching unit 50, and does not directly perform an IP routing function to the subscriber terminal 10.

Therefore, the Internet traffic transmitted from the subscriber terminal 10 to the switching unit 50 is always monitored by the blocking server 60 having the harmful site blocking list, and if the subscriber traffic accesses the harmful site, The server 60 causes the switching unit 50 to block access to the site of the subscriber.

Figure 3 shows a method for blocking a harmful site according to the present invention by such a configuration.

When the subscriber attempts to access the Internet and connects to the NAS 30 through the DSLAM 20 (S220), the NAS 30 requests the subscriber authentication to the authentication server 40 (S230).

If the authentication server 40 determines that the subscriber is a harmful site blocking service subscriber by performing the authentication process, the subscriber needs to be authenticated by the switching unit 50 that performs the actual management of the harmful site blocking service subscriber. Transfer to 30 (S240).

Then, the NAS 30 forms an L2TP tunnel to the switching unit 50 (S250) and transmits subscriber information using the formed L2TP tunnel to request subscriber authentication (S260).

The switching unit 50 performs authentication on the requested subscriber, and when the authentication result is a valid subscriber, allocates the PPP and IP directly to the subscriber station 10 (S270).

This means that the traffic of the harmful site blocking service subscriber is separated from the NAS 30 to the switching unit 50 so as to perform traffic management and control directly in the switching unit 50.

That is, the switching unit 50 analyzes the traffic of subscribers requesting access to the harmful site by the blocking server 60, and blocks the traffic transmission to the Internet for the subscriber who attempts to access the harmful site. The subscriber is notified that the requested site is not accessible.

As described above, according to the present invention, it is possible to provide a general Internet service and to provide services such as blocking harmful sites by different access IDs and passwords on the same Internet access line.

In addition, it is possible to block by managing a variety of harmful site blocking by grade or item separately.

In addition, since the present invention may enable other types of blocking services through connection with another blocking system only by access ID, various types of services may be deployed to meet the needs of subscribers.

Claims (6)

A NAS that receives an access signal from the DSLAM and allocates PPP and IP to the subscriber station when an Internet service subscriber attempts to access the service; An authentication server for authenticating the subscriber; A switching unit for authenticating a harmful site blocking service subscriber among the subscribers and allocating PPP and IP to a terminal of the harmful site blocking service subscriber; And And a blocking server which holds a list of harmful sites and blocks subscribers connected to the switching unit from accessing harmful sites. As a result of authentication at the authentication server, if the subscriber is a general Internet service subscriber, the NAS allocates PPP and IP to the subscriber terminal. If the subscriber is a harmful site blocking service subscriber, the authentication server provides IP address and subscriber information for the switching unit. Transfer to the NAS, And the NAS forms an L2TP tunnel to the switching unit and transmits the subscriber information. The method of claim 1, The harmful site blocking service subscribers can use the separate specific domain to allow the authentication server to determine that the harmful site blocking service subscribers. The method of claim 1, The harmful site blocking device of the Internet, characterized in that the switching unit is a router. The method of claim 1, The harmful site blocking device of the Internet, characterized in that the switch is a switch. NAS for managing traffic of Internet service subscribers received from DSLAM; An authentication server for authenticating the subscriber; A switching unit for authenticating a harmful site blocking service subscriber among the subscribers and managing traffic of the harmful site blocking service subscriber; And a blocking server that holds a list of harmful sites and blocks a subscriber connected to the switching unit from accessing the harmful site. A first step of authenticating a subscriber in the authentication server when an internet service subscriber accesses the NAS; A second step of performing, by the authentication server, an authentication process and transmitting the IP address and subscriber information for the switching unit to the NAS when the subscriber is a harmful site blocking service subscriber; A third step in which the NAS forms an L2TP tunnel to the switching unit and transmits the harmful site blocking service subscriber information using the formed L2TP tunnel to authenticate the subscriber; A fourth step of allocating PPP and IP to the harmful site blocking service subscriber station by the switching unit when the subscriber is a valid subscriber as a result of the authentication of the switching unit; And The blocking server monitors the Internet traffic of the harmful site blocking service subscriber through the switching unit, and the traffic transmission of the subscriber accessing the harmful site includes the fifth step of blocking the switching unit. How to block harmful sites. The method of claim 5, The harmful site blocking service subscriber information includes a separate specific domain to enable the authentication server to determine that the harmful site blocking service subscriber.