KR20040051435A - Network security service system including a classifier based on blacklist - Google Patents

Abstract

PURPOSE: A system for a network security service including a classifier based on a blacklist is provided to promptly confront an intrusion of an attacking packet by detecting the attacking packet from a specified site before intruding into a service provider network. CONSTITUTION: A blacklist table(300) records the danger information for the near sites. The classifier(302) classifies the packets intruding from the near sites based on the danger information of the site registered to the blacklist table by installing to an entering point of the service provider network. The classifier switches the data processing paths in order to transmit the classified packet through the preset data processing path depending on the danger of the site from a parallel/serial connection path between the classifier and a confronting device(306), and the connection path to the confronting device not passing the classifier. An analyzer(304) discriminates the attacking packet by analyzing the packet entered from the classifier. The confronting device blocks the packet judged as the attacking packet or warns the detection of the attacking packet.

Description

NETWORK SECURITY SERVICE SYSTEM INCLUDING A CLASSIFIER BASED ON BLACKLIST}

The present invention relates to a network security service system, and more particularly, to a network security service system for a plurality of customer sites including a blacklist based classifier installed at an entry point of a public network.

Recently, due to the explosive growth of the Internet, the exposure of security holes and the occurrence of security incidents are increasing rapidly due to structural weaknesses of TCP / IP. As a result, research and development on intrusion detection systems and network security systems such as firewalls and antiviruses have been activated, and various products that support interworking among them are also being released. The conventional intrusion detection system or antivirus system has a function of searching for packets entering the enterprise network or virus packets for intrusion, and the conventional firewall also detects packets entering the enterprise network. By inspecting, it functions to selectively accept packets.

However, global network security at the Internet level becomes impossible in the current network security concept of protecting each network for each enterprise by installing the network security systems as described above. This is because the attack packet safely passes through the public network until it reaches the inlet of the final destination network. Accordingly, there is a problem of waste of resources and deterioration of reliability in the intermediate transport and public networks carrying the attack packet.

On the other hand, companies are outsourcing their network security management to service providers in order to solve problems such as the burden of purchasing equipment and the difficulty of adopting the latest technology. Among service providers for security management of the corporate network, ISPs (Internet Service Providers) are rapidly emerging due to the advantage of using a delivery network. The security management service of the ISP takes a method of managing the devices installed in the customer network like the existing network security control service.

FIG. 1 illustrates an example of a conventional general network security service. Referring to FIG. 1, two service provider ISPs are provided until an intrusion packet arrives at a customer site 2 (106) from a customer site 1 (100) of origin. An example of passing through network A 102 and ISP network B 104 is shown. That is, as shown in FIG. 1, when an attack packet starts from one customer site 1 (100) and enters another customer site 2 (106), the attack packet is installed at the customer site 2 (106). Detected by an intrusion detection system. This results in waiting for the attack packet to reach destination customer site 2 106 and then delaying the response to the attack packet by detecting and responding.

This late search method not only makes intrusions detected early, but also makes it difficult to respond quickly. In addition, the attacker's packets pass through the service provider's network, thereby increasing the load on the service provider's network. In particular, this problem becomes more serious in the case of an attack that disables the destination system by sending a large number of packets, and the fact that the attacker's packet passes through the service provider's network has a problem of lowering the reliability of the service provider's network. .

Accordingly, an object of the present invention is to provide a network security system that is installed at the entry point of the service provider network to detect the attack packet from a specific site before entering the service provider network to enable rapid response to the attack packet intrusion. have.

In order to achieve the above object, the present invention provides a network security service system for a plurality of customer sites, comprising: a blacklist table that records risk information on adjacent sites; Installed at the entry point of the service provider network and classifies packets entering from neighboring sites based on the risk information of the sites registered in the blacklist table, and the classified packets are serial / parallel connection paths of the analyzer and the counterpart, A classifier for switching to a plurality of data processing paths so as to be transmitted to a destination customer site through a preset data processing path according to the risk of the corresponding site among the connection paths to the counterpart not passing through the analyzer; An analyzer for analyzing the packet entering from the classifier to determine whether the packet is an attack packet against a customer site; And a counterpart that blocks access to a packet determined to be an attack packet according to a packet analysis result of the analyzer or alerts an operator of detection of an attack packet.

1 is a diagram illustrating an example of a conventional network security service;

2 is a diagram illustrating an example of a network security service according to an embodiment of the present invention;

3 is a block diagram of a network security service system according to an embodiment of the present invention;

4 is a diagram illustrating a network security service network according to an embodiment of the present invention;

5 is a block diagram of a network security service system according to an embodiment of the present invention;

6 is a data flow diagram within a classifier in accordance with an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail the operation of the preferred embodiment according to the present invention.

FIG. 2 illustrates an example of a network security service according to an embodiment of the present invention. In the present invention, a network security system is installed at an inlet of an ISP network A 102 adjacent to a customer site 1 (100). Intrusion detection is performed so that intrusion packets generated at the customer site 1 (100) can be blocked before entering the ISP network A (102).

The structure of the network utilizing the system provided by the present invention is as follows. 4 shows an example of providing a packet forwarding service and a network security service to adjacent customer sites in a service provider network having a plurality of routers or switches.

In service provider providing services to customer sites, the system is placed at an access point where the customer site connects to the service provider's network. The blacklist, which is one of the components of the system, quantitatively indicates the level of risk according to the number of times the attack packet is released, the intensity of the attack, the damage degree of the attack, and the like. For example, [Table A] shows an example of creating a blacklist by dividing the level of risk for each site's IP address.

TABLE A

site Risk 211.115.217. * Prize 129.254.129. * Ha 203.245.15. * medium 165.132.120. * Prize

The blacklist may be maintained independently by the system, but additionally, intrusion detection information may be obtained and managed from the outside. It is necessary to obtain additional intrusion detection information from the outside in order to grasp the result and the impact of the attack targeting the remote site. For example, several systems may exchange intrusion detection information with each other to inform each other of high-risk sites, and there is a separate central blacklist manager 402, which provides a central blacklist manager 402 for the rest of the systems. It may also take the form of mediating the exchange of information. 4 shows an example of a central blacklist manager 402. In this example, the blacklist of the system 400 additionally obtains information about the number of times the attack packet is released from the central blacklist manager 402 for each site, the intensity of the attack, the damage degree of the attack, and the like.

As shown in FIG. 3, which is a block diagram of a network security service system according to an embodiment of the present invention, another component of the present system, the analyzer 304, analyzes a packet's Mac header, IP header, TCP or UDP header. Detect and detect, and discriminate whether the intrusion by comparing the packet and the intrusion pattern. Also, the analyzer 304 may have a function of analyzing a plurality of consecutive packets or packets of a repeated type together. For example, the intrusion pattern as in Example 1) below cannot analyze the intrusion by analyzing only one packet and must analyze a plurality of consecutive packets.

Example 1) For two packets with the same IP Identification, the sum of the IP length and the IP fragmentation offset of the previous packet with the MF flag of '1' is equal to the MF flag. If it is smaller than the IP fragmentation offset of the current packet which is 0 ', it is determined as a tear drop.

In addition, in example 2) below, packets of repeated types must be analyzed together.

Example 2) If the ICMP type is '8' and more than 20 ICMP packets are received for the same address as the destination address for 2 seconds, it is determined as 'a denial of service attack using smurf'.

The corresponder 306 may include a blocker for selectively passing packets. In this case, some packets are discarded by not passing through the blocker. That is, packets that are determined to be attack packets are blocked at the entrance of the service provider's network. The corresponder 306 may include an alarm for notifying the manager of the packet information. The alerter cannot be determined to be an attack packet, but is used to inform the administrator of packets that need attention. In this case, the manager may centrally manage several systems as shown in FIG. 4, and the central manager 402 of FIG. 4 receives and processes alarms sent from various systems distributed in a service provider network.

As mentioned above, the data flow classified according to the classifier is divided into three parts. Data flows belonging to the high risk first range pass through only the responder 306. This is to block packets released from high-risk sites without the need for analysis. Or, even if not blocked, to inform the administrator unconditionally about the packets emitted from such sites.

Data flows belonging to a second range with a lower risk than the first range pass sequentially through the analyzer 304 and the counterpart 306. This is for immediate response after analysis. The problem with sequentially passing through the analyzer 304 and the counterpart 306 is that the data processing speed of the analyzer 304 is generally too slow so that there is a risk that subsequent packets will be lost while analyzing one packet. Is there. In order to solve such a problem, a technique such as a high speed processing for increasing the speed of the analyzer 304 is required, and at the same time, a large capacity buffer is mounted in front of the analyzer 304 to adjust the speed.

5 is a diagram for sequentially passing through the analyzer 304 and the counterpart 306 after passing through the buffer 310 to adjust the data processing speed.

Data flows belonging to a third range with a lower risk than the second range pass through the analyzer 304 and the counterpart 306 in parallel by passing through a copier 308 that copies packets. Passing through the analyzer 304 herein does not mean that the packets are passed through the analyzer 304 to another place, but only processed by the analyzer 304. All packets belonging to the data flow passing in parallel with the analyzer 304 and the corresponder 306 are analyzed but not an immediate response. Based on the analysis result, the manager instructs the responder 306 how to respond when a similar kind of packet comes back later. The problem with this method of processing the data flow is that even if the administrator quickly reflects the analysis result in the counterpart 306, the analyzed packet has already entered the service provider network. On the other hand, the advantage of this data flow method is that there is no time delay due to packet analysis.

In addition, a data flow having no risk belonging to a range lower than the third range may be transmitted without passing through the analyzer 304 or the counterpart 306 at all. This is because no packet analysis or response is required for packets emitted from fully trusted sites. The processing for this data flow is not shown in FIGS. 3 and 5.

The classifier 302 may be implemented in various ways. However, the classifier 302 connects an input interface of incoming packets and data flows classified according to the classifier 302, but changes the connection relationship when the blacklist 300 is changed. You can do it. 6 shows an example in which the input interface for the sites as in the example of [Table A] is connected with three data flows respectively.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

As described above, in the present invention, in providing a network security service for a plurality of customer sites, the attack packet is implemented by implementing a network security system at an entry point of a service provider network where each adjacent site accesses the service provider network. By detecting the attacker before entering the service provider network, it is possible not only to detect an intrusion of an attack packet at an early stage, but also to enable an early response to the intrusion.

It also reduces the load on the service provider network by preventing the attacker's packet from passing through the service provider's network, and protects the service provider's network by blocking the attack packet from passing through the service provider's network. In addition to doing so, there is an advantage to improve the reliability of the service provider network to customers. In addition, through the network security system implemented at the entry point of the service provider network, when an attacker attacks multiple destination sites, it is possible to realize an effect such as detecting intrusion at multiple destination sites at low cost.

Claims (9)

In a network security service system for multiple customer sites, A blacklist table that records risk information for adjacent sites; Installed at the entry point of the service provider network and classifies packets entering from neighboring sites based on the risk information of the sites registered in the blacklist table, and the classified packets are serial / parallel connection paths of the analyzer and the counterpart, A classifier for switching to a plurality of data processing paths so as to be transmitted through a preset data processing path according to a risk of a corresponding site among the connection paths to the counterpart not passing through the analyzer; An analyzer which analyzes the packet entering from the classifier and determines whether it is an attack packet; And a counterpart that blocks a packet determined to be an attack packet according to a packet analysis result of the analyzer, or alerts the detection of an attack packet. The method of claim 1, The classifier is configured to switch packets from a site belonging to a risk first range among the sites registered in the blacklist table to a data processing path configured to pass only a counterpart, and the risk is lower than the first range. Packets coming from sites within two ranges are switched to a data processing path configured to pass serially through the analyzer and counterpart, and packets from sites belonging to a third range with lower risk are parallel to the analyzer and counterpart. And a switching connection to a data processing path configured to pass through the network. The method of claim 2, And the classifier switches a packet entering a site having a risk lower than the third range into a data processing path configured to be directly connected to the analyzer without a counterpart. The method of claim 2, In a data processing path in which the analyzer and the counterpart are connected in parallel, the incoming packet is copied through the copier, and then passed through the counterpart to be analyzed in parallel at the analyzer. The method of claim 1, The analyzer includes a buffer for temporarily storing subsequent packets to prevent loss of subsequent packets while analyzing one input packet and a buffer for preventing a delay in data processing speed due to packet analysis. Security service system. The method of claim 5, The analyzer separates and detects a MAC header, an IP header, and a TCP / UDP header of a packet, and determines whether an attack packet is made by comparing the pattern of the attack packet with respect to each packet. . The method of claim 6, The analyzer, the network security service system, characterized in that for analyzing the plurality of packets in a row or repeated packets to enter for the determination of the attack packet. The method of claim 1, The blacklist table is a network security service system, characterized in that the memory for recording risk information for each site according to the number of attack packets for each site connected to the network, the intensity of the attack, the degree of damage of the attack. The method of claim 8, The classifier may change and set a switching connection to a preset data processing path for packets entering from each site when the risk of each site registered in the blacklist is changed to correspond to the risk change. Security service system.