KR200354505Y1 - Apparatus for isolating and relaying with integration function - Google Patents

Abstract

Connected to a plurality of terminal devices through a network, connected to a central server via the Internet, to download a security target to be applied to the terminal devices from the central server to store in a security target database and to set a security target to allow or block Security target setting module; Disclosed is a blocking and relay apparatus having an integrated function including an access module for extracting information on a security target set by a security target setting module from a security target database to block or allow access to a security target by a terminal device.

Description

Apparatus for isolating and relaying with integration function

The present invention relates to a blocking and relay device having an integrated function. More specifically, the user can easily set or allow access to various security targets such as a harmful site or a recommended site. The present invention relates to a blocking and relay device having a DHCP function for automatically assigning an IP address to a connected computer system while blocking a network and having an integrated function as a VPN client.

Firewalls can be said to prevent and isolate network security incidents or threats from further escalation. This is an active defense measure that prevents illegal traffic from outside and only permits authorized or authorized traffic, especially to protect the internal network of an organization.

Building a firewall system provides many benefits to the site by enhancing the security of the host.

In other words, firewalls can reduce the risk to hosts on a subnet by enhancing security for the network and filtering insecure services by default.

In addition, access to the host system can be controlled. For example, when you want to connect from an external network to a host on your internal network, you can block unwanted access. Thus, sites can block access from outside, except in special cases such as mail servers or NIS.

It can also be practically economical in that you can install a firewall on any host, as opposed to distributing most modified and additional security software across multiple hosts.

However, there is a problem in that a separate manpower is required to install and operate such a firewall because a network administrator with expertise is required.

In addition, the existing firewall system has only a unique function, there is a problem that a separate system is required to block spam or viruses.

Moreover, when using ADSL or cable lines, many computer systems connected to the internal network must install a separate device having the function to use the Internet.

Accordingly, the present invention is presented to solve such a conventional problem, and an object of the present invention is to block and relay having an integrated function that can easily set a security target to allow or block access from a computer system. To provide a device.

Another object of the present invention is to provide a blocking and relaying device having a spam mail or virus blocking function, a DHCP function, and an integrated function of a VPN client / server.

Other objects and features of the present invention will be more clearly understood through the embodiments described below.

1 is a block diagram illustrating a network configuration to which a blocking and relaying device having an integrated function according to the present invention is applied.

Figure 2 is a functional block diagram functionally showing the configuration of the blocking and relay device of the present invention.

3 is an explanatory diagram showing a function of a VPN client of a blocking and relaying device of the present invention.

4 is a screen displayed when adding a security target in the central server.

5 is a high-layer screen displayed when a user accesses a blocking and relay device having an integrated function to set a security target.

6 is a lower layer screen displayed when a user accesses a blocking and relay device having an integrated function to set a security target.

7 is a screen showing a security target currently registered in the central server.

According to an aspect of the present invention, connected to a plurality of terminal devices through a network, and connected to a central server for grouping, storing and periodically updating the security target, and downloads the security target to be applied to the terminal devices from the central server A security target setting module configured to set a security target to be stored in a security target database and to allow or block access from a terminal device; Disclosed is a blocking and relay apparatus having an integrated function including an access module for extracting information on a security target set by a security target setting module from a security target database to block or allow access to a security target by a terminal device.

Preferably, the apparatus further includes a security policy setting module configured to set a security policy for blocking and allowing access from the terminal device to store the set security policy in a security policy database.

In addition, the security targets are classified into a hierarchical structure for each group, and the access permission or blocking setting is collectively made at the upper layer or individually at the lower layer.

Preferably, the electronic device may further include a mail filtering module which downloads mail blocking information from a central server and stores the mail blocking information in a mail blocking information database and blocks a specific mail from mail information received based on the mail blocking information.

The apparatus may further include a virus filtering module that downloads virus information from a central server, stores the virus information in a virus information database, and blocks information including a virus from a packet received based on the virus information.

Furthermore, the server may further include an IP management module that receives a public IP network block from a central server and assigns individual IP addresses within the public IP network block to connected computer systems.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a network configuration to which a blocking and relaying device having an integrated function according to the present invention is applied.

Each of the user computer systems 100 and 100a is connected to a local area network (LAN) and connected to each other through hubs 110 and 110a, and through modem devices 300 and 300a such as a router, an ADSL modem or a cable modem. Is connected to the Internet 350.

Along such a path, user computer systems 100 and 100a are connected to a central server 400 which is also connected to the Internet 350.

The blocking and relay devices 200 and 200a of the present invention are connected between the hubs 110 and 110a and the modem devices 300 and 300a to allow or block access to objects accessed by the user computer system.

Figure 2 is a functional block diagram functionally showing the configuration of the interruption and relay apparatus of the present invention.

The security target setting module 210 downloads a security target to be applied to the user computer systems 100 and 100a from the central server 400, stores the security target in the security target database 215, and sets a security target to allow or block. In addition, if necessary, the security target that can not be provided from the central server 400 may be set by itself, and the security targets individually set as such are fed back to the central server 400 and provided to other blocking and relay devices for overall quality. Can improve. This may be equally applied to the setting of virus blocking information or mail blocking information described later.

The security target may include a messenger program, a P2P program, an adult / harmful site, or a game, and may be set as an allowable or blocked object individually or at a time. It is also possible to set the time allowed or blocked.

The access module 230 extracts information about the security target set by the security target setting module 210 from the security target database 215 to block or allow the user computer system 100 or 100a to access the security target. Play a role.

In addition, the security policy setting module 220 allows the user computer systems 100 and 100a to set a security policy for blocking and allowing access, and stores the set security policy in the security policy database 225.

Optionally, the mail filtering module 240 downloads the mail blocking information from the central server 400 and stores the mail blocking information in the mail blocking information database 245, and blocks the specific mail from the received mail information based on the stored mail blocking information. Play a role.

Also, optionally, the virus filtering module 250 downloads the virus information from the central server 400 and stores the virus information in the virus information database 255, and blocks the information including the virus from the received packet based on the stored virus information. It performs the function.

Hereinafter, the function of the blocking and relay device having an integrated function according to the present invention. For convenience of explanation, a description will be given of a network connected to a rear end of a blocking and relay device having an integrated function of the present invention, and it is assumed that the related setting is made by a network administrator.

As described above, the security target setting module 210 downloads the security target to be applied to the user computer systems 100 and 100a from the central server 400 and stores the security target in the security target database 215 and allows or blocks the security target. Set it.

Referring to FIG. 5, the network administrator accesses through an IP address of the blocking and relay devices 200 and 200a having an integrated function through a browser and sets a security target.

The security targets downloaded from the central server 400 to the blocking and relay apparatuses 200 and 200a having an integrated function are classified by groups, so that the setting of permission or blocking is convenient. That is, as shown, it is classified into messenger, P2P, game, and home trading, and each group includes specific security targets in a subdirectory.

As shown in FIG. 5, the granting or blocking of access can be collectively controlled for each security target group, and the time for which the connection is blocked or allowed can be freely set.

In addition, referring to FIG. 6, specific security targets 'next messenger', 'seitaki', 'buddy buddy', and 'nate on', etc. included in the messenger group to be secured are listed, and individually allow or block access Can be.

As described above, since the security targets are provided in a hierarchical structure and the security targets and conditions are set through the web browser, the network administrator can overcome the difficulties of the conventional firewall configuration.

The security targets and conditions set as described above are stored in the security target database 215, and when a connection is made by a user in the network, the access module 230 may allow or block the access with reference thereto.

Of course, the access module 230 is set by the security policy setting module 220, it is natural to apply the security policy stored in the security policy database 225 basically.

The central server 400 periodically adds a security target and transmits it to the blocking and relay devices having respective integrated functions. 4, a method of adding a security target in the central server 400 is shown.

You can register additional security target by entering IP filter and port filter, and you can select the name of the security target to be added and the group to be included.

Therefore, each network administrator connected to the blocking and relay devices 200 and 200a having an integrated function does not have to worry about the update of the security target at all, and when the updated security target is downloaded from the central server 400, do.

7 is a screen showing a security target currently registered in the central server 400. The security target includes the group, name, IP filter information and port to be filtered, site name and registration date.

Meanwhile, the mail filtering module 240 downloads the mail blocking information from the central server 400 and stores the mail blocking information in the mail blocking information database 245, and blocks the specific mail from the received mail information based on the stored mail blocking information. The central server 400 updates the mail blocking information from time to time by using the mail policy management menu shown in FIG. 5, and uses the sending account, the receiving account, the sending section, the receiving section, keywords, and wildcards on the web browsing screen. Can be set to

In addition, the virus filtering module 250 downloads the virus information from the central server 400 and stores the virus information in the virus information database 255, and blocks the information including the virus from the packet received based on the stored virus information. Similarly, the central server 400 periodically updates the virus information using the virus policy management menu shown in FIG. 5.

The IP management module 260 of the blocking and relay device having an integrated function of the present invention performs a Dynamic Host Configuration Protocol (DHCP) function to receive a public IP network block from the central server 400 using an ADSL or a cable line. An IP address is assigned to the connected computer systems 100 and 100a within the corresponding network block.

As shown in Figure 3, for this purpose, the central server 400 is connected to the VPN server through the VPN tunnel via the blocking and relay devices 200, 200a and the Internet 350, each having an integrated function Issue a network block.

In the above described the center of the preferred embodiment of the present invention, various changes or modifications can be made to those skilled in the art of course.

For example, it is possible to add a function to search or search log information or to generate statistics, as well as to manage mail accounts. In addition, by using the Quality of Service (QoS) feature, you can limit and guarantee the usage of the service as desired, limiting HTTP connections to 1Mbps, fully opening FPT connections, and limiting P2P connections to 512Kbps. have.

Therefore, the scope of the present invention should not be limited to the above embodiment but should be determined by the claims described below.

As described above, the present invention has various advantages.

First, there is an advantage that can easily easily set the security target through the user-friendly web browsing environment to overcome the stereotype that the existing firewall is difficult to set.

In particular, the system can be managed by a general engineer without the need for an expert network administrator.

In addition, there is an advantage that the security targets such as harmful sites and mail blocking information and virus information can be periodically downloaded and updated from the central server without the user having to directly update.

In addition, the firewall, anti-spam, antivirus and VPN functions can be solved in one integrated device, reducing the investment cost for the user.

Claims (6)

It is connected to a plurality of terminal devices through a network, and connected to a central server for storing, periodically updating, grouping security targets, A security object setting module configured to download a security object to be applied to the terminal devices from the central server, store the security object in a security object database, and set a security object to allow or block access from the terminal device; And an access module for extracting information about a security target set by the security target setting module from the security target database to block or allow access to the security target by the terminal device. Blocking and repeater. The blocking and having integrated function of claim 1, further comprising a security policy setting module configured to set a security policy for blocking and allowing access from the terminal device and storing the set security policy in a security policy database. Repeater. The integrated function according to claim 1 or 2, wherein the security targets are classified into a hierarchical structure for each group so that access permission or blocking can be set collectively at an upper layer or individually at a lower layer. Blocking and relay having a. The mail filtering module of claim 1 or 2, further comprising: a mail filtering module which downloads mail blocking information from the central server, stores the mail blocking information in a mail blocking information database, and blocks a specific mail from mail information received based on the mail blocking information. Blocking and relaying device having an integrated function, characterized in that it comprises a. The apparatus of claim 1 or 2, further comprising a virus filtering module which downloads virus information from the central server and stores the virus information in a virus information database, and blocks information including a virus from a packet received based on the virus information. Blocking and relay device with an integrated function, characterized in that. According to claim 1 or 2, characterized in that it further comprises an IP management module for assigning a separate IP address in the public IP network block to the computer system that is issued a public IP network block from the central server; Disconnect and repeater with integrated function.