KR20040075613A - System for managing security policy in a wired and wireless integrated environment - Google Patents

Abstract

PURPOSE: A system and method for managing a security policy in a wired/wireless integrated environment are provided to easily transfer a security policy to a user even under a complicated security policy structure by easily recognizing the position of the user. CONSTITUTION: A central policy server(100) manages local policy servers(110-130). Each of local policy servers(110-130) manages user terminals(140-160) connected through a wired/wireless communication network. The local policy servers(110-130) can be selected on the basis of an area or on the basis of a department, policy and user class. The central policy server(100) does not directly process a security policy for the user terminals(140-160) but the local policy servers(110-130) connected through a communication network process the security policy process the security policy for the user terminals(140-160). Thus, the load of the central policy server(100) can be reduced.

Description

System for managing security policy in a wired and wireless integrated environment

The present invention relates to a security policy management system and method in a wired / wireless integrated environment, and more particularly, to a security policy management system and method for transmitting a security policy determined by an administrator to a user connected to a wired or wireless communication network. .

The rapid dissemination of the Internet and the development of network technologies have had a positive effect of ensuring information sharing and mobility. However, this has a negative aspect of information leakage by illegal hacking. Therefore, network security is one of the first considerations when companies connect to the Internet. This security problem is often at odds with the use of the Internet. As a result, companies need a clear distinction between the information they need to protect and the information they want to disclose to the outside world.

In the field of network, security policy aims to protect the information assets from unauthorized leakage, destruction and illegal changes through the computer network. Security policy and a series of security activities are based on Integrity, Confidentiality, Identification & Authentication, Access Control, Non-Repudiation, Audit and Accountability for Information Assets. (Audibility & Accountability), Reliability & Availability requirements.

In order to satisfy the above requirements, security management is based on computerized central management in order to maintain consistency and confidentiality. In addition, all resources (human resources / information resources) are classified and managed according to security level, and in principle, access from outside to inside is restricted. In addition, security is separately strengthened for the process control system part, and log management is performed for all systems in which the user is present. In addition, information inquiry from the inside to the outside is allowed without restriction, but the leakage of information is controlled and the user ID is maintained in principle.

As such, the security policy prevents indiscriminate leakage of information and is a basic policy for free information distribution on the network. Currently, the security policy for each network is established by the management authority of the network and a centralized security policy is applied to enhance security. However, as the size of the network grows, centralized security management increases the load on the server excessively, resulting in a decrease in server performance. In addition, since security management is performed by a specific server, it is difficult to establish and execute a flexible security policy.

The technical problem to be achieved by the present invention is to provide a security policy management system and method in a wired / wireless integrated environment that is capable of establishing and executing a flexible security policy while at the same time balancing the load on the security management server.

1 is a configuration diagram showing the configuration of an embodiment of a security policy management system in a wired / wireless integrated environment according to the present invention;

2 is a diagram illustrating a configuration of a network operation center (NOC);

3 is a view showing a detailed configuration of a regional center (RC),

4 is a flowchart illustrating a registration process of a wired user in the security policy management system shown in FIG. 1;

5 is a flowchart illustrating a process of transmitting a security policy determined by an administrator to a wired user in the security policy management system illustrated in FIG. 1;

6 is a flowchart illustrating a registration process of a wireless user in the security policy management system shown in FIG. 1;

FIG. 7 is a flowchart illustrating a process of registering a new local policy server when a wireless user who has registered in the security policy management system shown in FIG. 1 moves to another region;

8 is a flowchart illustrating a process of transmitting a security policy determined by an administrator to a wireless user in the security policy management system illustrated in FIG. 1;

FIG. 9 is a diagram illustrating a device identification method using an FQDN method for transmitting a security policy in the security policy management system shown in FIG. 1;

FIG. 10 is a diagram illustrating a process in which an administrator (admin @ nitz) delivers a security policy to user B (B@taejon.nitz) by applying the FQDN scheme in the security policy management system shown in FIG. 1.

In order to achieve the above technical problem, a security policy management system in a wired / wireless integrated environment according to the present invention includes a central policy server and a central policy server for executing a security policy determined by a network administrator and holding information of a network user. Security policy in a network consisting of a plurality of local policy server connected to transfer the information of the user grouped by a predetermined criterion and the security policy for the grouped user received from the central policy server to the user through a wired or wireless communication network. In the managing system, the central policy server responds to the inquiry message for the user ID input from the administrator terminal, the response message containing the location of the user terminal corresponding to the user ID identified from the user information held Provided to the administrator terminal, The administrator terminal obtains the security policy and information of the user terminal corresponding to the user ID from the local policy server to which the user terminal identified from the response message belongs, and applies the obtained security policy to the user ID. Apply a security policy to a user terminal, wherein the local policy server is represented by a local server identifier comprising a name of the local policy server, a server delimiter, and a name of the central policy server, and the administrator terminal and the user terminal. Are each represented by a terminal identifier, a terminal identifier, a name of the local server, a server separator, and a name of the central policy server.

Preferably, the server identifier is '.', The local server identifier is composed of 'name of the local policy server. Name of the central policy server', the terminal identifier is '@', the terminal identifier is 'terminal' Name @ name of local policy server.name of central policy server.

Security policy management method in a wired / wireless integrated environment according to the present invention for achieving the above technical problem, the central policy server and the central policy server for executing the security policy determined by the network administrator and holds the information of the network user In the network system comprising a plurality of local policy server connected to the user to transfer the information of the user grouped by a predetermined criterion and the security policy for the grouped user received from the central policy server to the user through a wired or wireless communication network A security policy management method, comprising: transmitting, by an administrator terminal, a query message for a user ID to the central policy server; Providing, by the central policy server, a response message including the location of the user terminal corresponding to the user ID identified from the user information held by the central policy server to the manager terminal; Identifying, by the administrator terminal, the local policy server to which the user terminal belongs from the response message; Obtaining, by the administrator terminal, information of a user terminal corresponding to a security policy and the user ID from the identified local policy server; And applying, by the administrator terminal, the security policy to the user terminal corresponding to the user ID by applying the obtained security policy, wherein the local policy server is a name of the local policy server, a server delimiter, and the Represented by a local server identifier composed of a name of the central policy server, the administrator terminal and the user terminal is composed of a terminal name, a terminal identifier, the name of the local server, a server separator, and the name of the central policy server, respectively. It is represented by a terminal identifier.

Preferably, the server identifier is '.', The local server identifier is composed of 'name of the local policy server. Name of the central policy server', the terminal identifier is '@', the terminal identifier is 'terminal' Name @ name of local policy server.name of central policy server.

Thus, by applying the FQDN method to the transmission mechanism for delivering the central policy to the user regardless of the user's communication environment, the user's location can be easily identified. Can be.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of a security policy management system and method in a wired and wireless integrated environment according to the present invention.

1 is a block diagram showing the configuration of an embodiment of a security policy management system in a wired / wireless integrated environment according to the present invention.

Referring to FIG. 1, a security policy management system in a wired / wireless integrated environment according to the present invention includes a central policy server 100, a plurality of local policy servers 110, 120, and 130, and a plurality of user terminals 140, 150, and the like. 160).

The central policy server 100 manages a plurality of local policy servers 110, 120, and 130. Each regional policy server 110, 120, 130 manages user terminals 140, 150, 160 connected through a wired or wireless communication network. Here, the regional policy servers 110, 120, and 130 may be selected based on the region, and may be selected by various criteria such as by department, policy, and user layer. The security policy management system according to the present invention does not directly process the security policy for the user terminals 140, 150, and 160 from the central policy server 100 when setting the security policy, and is connected to the local policy server 110 through a communication network. , 120, 130). Therefore, the load of the central policy server 100 can be reduced.

2 illustrates a configuration of a network operation center (NOC). The administrator determines all security policies within the Network Operation Center (NOC) 200 and the determined security policies are executed by the central policy server 220. The NOC 200 is composed of a central security policy database 210 and a central policy server 220. The central security policy database 210 stores a comprehensive policy file 230 and a user information file 240. The comprehensive policy file 230 stores local policy information 232, group policy information 234, and user hierarchy policy information 236. Each of these policy information (232, 234, 236) can be combined by priority, and is transmitted to each local policy server by the central policy server 220. The policy file contents of the central policy server 220 may have various forms by an administrator.

The user information file 240 stores information 242 and 244 about wired and wireless users in all regions that the central policy server 220 is in charge of. Wireless users should be shared differently with wired users. Since wireless users can move between regions, all local policy servers must share wireless user information. The wireless user information shared by the local policy server enables the wireless user to log in to the local policy server in charge of the area in which the local policy server is located.

3 shows a detailed configuration of a regional center (RC). RC 300 is composed of a regional security policy database 310 and a regional policy server 320. The regional policy database 310 stores a comprehensive policy file 330 and a user information file 340. The comprehensive policy file 330 stores regional policy information 332, group policy information 334, and user hierarchy policy information 336 received from the central policy server. Each of these policy information 332, 334, 336 can be combined by priority, and is transmitted to each user by the local policy server 320. The user information file 340 stores information 342 and 344 about wired and wireless users in the area in which the regional policy server 320 is in charge.

4 is a flowchart illustrating a registration process of a wired user in the security policy management system illustrated in FIG. 1.

Referring to FIG. 4, the wired user 140 first registers user information with the local policy server 110 (S400). The regional policy server 110 transmits the wired user information desired to be registered to the central policy server 100 which is its upper server (S410). The central policy server 100 determines whether the user is a legitimate user based on the received user information (S420), and if it is determined that the user is a legitimate user, transmits a registration acceptance message to the local policy server 110 (S430). On the contrary, if it is determined that the user is not a legitimate user, the registration rejection message is transmitted to the local policy server 110 (S440). The local policy server 110 performs the registration and rejection of the user according to the response message received from the central policy server 100 (S450).

FIG. 5 is a flowchart illustrating a process of transmitting a security policy determined by an administrator to a wired user in the security policy management system illustrated in FIG. 1.

Referring to FIG. 5, the administrator selects all local policy servers 110, 120, and 130 and transmits a security policy to local policy servers 110, 120, and 130 (S500). Each local policy server (110, 120, 130) transfers the security policy received from the central policy server 100 to all registered users through the registration process shown in Figure 4 (S510). At this time, the user who logs off will deliver the security policy when the user logs in later. After delivery of the security policy, each of the local policy servers 110, 120, and 130 prepares statistics for the user to whom the security policy is delivered and transmits the statistics to the central policy server 100 (S520). Here, the recording method for the local policy servers 110, 120, and 130 and the wired / wireless user is performed by a fully qualified domain name (FQDN) method.

Hereinafter, with reference to FIGS. 6 to 8, a registration process and a post-regional processing process when a wireless user or a mobile network user moves a region will be described. In the case of mobile network, local policy server plays a role similar to FA (Foreign Agent) and central policy server plays a role similar to HA (Home Agent). Since the security policy transmission of the mobile network user is similar to the wireless user, only the wireless user is referred to here.

6 is a flowchart illustrating a registration process of a wireless user in the security policy management system shown in FIG. 1.

Referring to FIG. 6, the wireless user 140 first registers user information with the local policy server 110 (S600). The local policy server 110 transmits the wireless user information to be registered to the central policy server 100 which is its upper server (S610). The central policy server 100 determines whether the user is a legitimate user based on the received user information (S420), and if it is determined that the user is a legitimate user, transmits a registration acceptance message to the regional policy server 110 requesting registration, and requests registration. The received user information is transmitted to the remaining local policy servers 120 and 130 except for the local policy server 110 (S630). On the contrary, if it is determined that the user is not a legitimate user, the registration rejection message is transmitted to the local policy server 110 (S640). The regional policy server 110 performs the registration and rejection of the user according to the response message received from the central policy server 100 (S650). The wireless user applies the security policy according to the policy file received from the registered local policy server 110 (S660).

FIG. 7 is a flowchart illustrating a process of registering a new local policy server when a wireless user who has registered in the security policy management system shown in FIG. 1 moves to another region.

Referring to FIG. 7, a wireless user who moves a region accesses a central policy server 100 and receives a list of regional policy servers (S700). Next, one local policy server is selected from the received local server list (S710). The local policy server is selected by the following method.

A. A method for selecting a local policy server as its own local policy server if the wireless user is located within a specific IP block.

B. On the wireless user side, the local policy server with the smallest hop count among local policy servers is selected as its local policy server.

C. How to select local policy server that has the least round trip time among local policy servers as wireless policy.

D. How to select local policy server selected by wireless user as its local policy server.

The wireless user logs in to the determined local policy server (eg, 130) and receives a security policy (S720). At this time, since the security policy may already be downloaded to the wireless user, it is preferable to check the version before receiving the security policy. The local policy server 130 logged in by the wireless user transmits the location information of the corresponding user to the central policy server 100 (S730). The administrator of the central policy server 100 may transmit the information on the security policy to the wireless user by the received location information of the user. When the wireless user logs off, the local policy server 130 notifies the central policy server 100 of the log off fact. At this time, the location information for the wireless user is not changed.

8 is a flowchart illustrating a process of transmitting a security policy determined by an administrator to a wireless user in the security policy management system illustrated in FIG. 1.

The administrator may transmit a security policy to a specific user or all users managed by the regional policy servers 110, 120, and 130 through the central policy server 100. The administrator transmits a security policy to a specific wireless user of a specific local policy server 120 through the following process. First, the administrator searches for a log record of the wireless user (S800) and then selects a log policy for the wireless user (S810). The central policy server 100 transmits a security policy to the regional policy server 120 in charge of the area where the wireless user is located based on the ID of the wireless user (S820). The local policy server 120 checks whether the corresponding wireless user is logged in (S830). The local policy server 120 transmits the received security policy to the wireless user in the login state (S840). If the wireless user is logged off, the security policy is transmitted only to the local policy server 120, and if a certain period of time passes, the local policy server 120 deletes the received security policy (S850).

FIG. 9 is a diagram illustrating a device identification method using an FQDN method for transmitting a security policy in the security policy management system shown in FIG. 1. FQDN is used in Domain Name Server (DNS), and it adds dot to domain name to express the end of domain name to query.

Referring to FIG. 9, the central policy server 100, the local policy servers 110, 120, 130, and the user terminals 140, 150, and 160 constituting the security policy management system are connected in a tree structure. In the system of such a tree structure, the central policy server 100 existing at the top level is set as the root, and the local policy servers 110, 120, and 130 existing at the next level are set as the first level. Sub-regional policy server (not shown) existing in the level can be set to the second level. As such, the purpose of expressing the structure of the system by the FQDN method is to determine the location of the user and read the response message received by the queryer querying the central policy server 100 for a specific user's ID. To obtain.

In this case, a device name can be given to each server, which corresponds to a host name. For example, if the name of the central policy server 100 is 'nitz' and the names of the local policy servers 110, 120, and 130 are 'seoul', 'taejon', and 'taegu', respectively, each local policy server ( 110, 120, 130) are expressed as 'seoul.nitz', 'taejon.nitz', and 'taegu.nitz'. The user terminal includes the name of the server to which the user belongs, and is expressed as 'user ID + @ + server name'. For example, if the user ID connected to the local policy server 110 represented by 'seoul.nitz' is 'a', the corresponding user terminal 140 is represented by 'a@seoul.nitz'.

The queryer can query the central policy server 100, which is the top root server, and includes the user ID information in the query contents. At this time, the central policy server 100 detects the location of the user terminal 140 corresponding to the user ID in the central security policy database 210 and transmits a response message to which the FQDN method is applied to the local policy server 110. . On the other hand, query and response messages are transmitted and received through the secure channel.

FIG. 10 is a diagram illustrating a process in which an administrator (admin @ nitz) delivers a security policy to user B (B@taejon.nitz) by applying the FQDN scheme in the security policy management system shown in FIG. 1. All query and response messages are assumed to be secure.

Referring to FIG. 10, the manager transmits a query message for the ID of user B to the central policy server 100 (S1000). The central policy server 100 grasps the location of the ID of the user B from the central security policy database, and provides the administrator with a response message to which the FQDN method is applied (S1010). The administrator can determine the local policy server 120 to which user B belongs from the user B's ID. The administrator queries the local policy server 120 for the security policy for the user B to pass through the local policy server 120 and the information of the user B (S1020). The local policy server 120 responds to the administrator of his security policy and user B information (S1030). The administrator applies the security policy provided from the local policy server 120 and delivers the security policy to the user B (S1040).

Although the preferred embodiments of the present invention have been shown and described above, the present invention is not limited to the specific preferred embodiments described above, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the claims. Various modifications can be made by those skilled in the art, and such changes are within the scope of the claims.

According to the security policy management system and method according to the present invention, the FQDN method is applied to a transmission mechanism for delivering a central policy to a user regardless of the user's communication environment under a complex security policy structure consisting of a central policy server and a local policy server. By easily identifying the location of the user, even a complex security policy structure can be easily delivered to the user.

Claims (6)

A central policy server that executes a security policy determined by a network administrator and holds information of a network user; information of users grouped by a predetermined criterion connected to the central policy server and the grouped users received from the central policy server In the system for managing the security policy in a network consisting of a plurality of local policy server for transmitting the security policy for the user through a wired or wireless communication network, The central policy server provides a response message including the location of the user terminal corresponding to the user ID identified from the user information in response to the query message for the user ID received from the administrator terminal. The manager terminal obtains a security policy and information of a user terminal corresponding to the user ID from the local policy server to which the user terminal identified from the response message belongs, and applies the obtained security policy to the user ID. Apply security policy to the corresponding user terminal, The regional policy server is represented by a local server identifier consisting of a name of the regional policy server, a server delimiter, and a name of the central policy server, and the administrator terminal and the user terminal are respectively a terminal name, a terminal identifier, and the region. A security policy management system in a wired / wireless integrated environment, characterized by a terminal identifier composed of a server name, a server delimiter, and a name of the central policy server. The method of claim 1, The server separator is '.', And the local server identifier is configured as 'name of the local policy server. Name of the central policy server' security policy management system in a wired / wireless integrated environment. The method of claim 1, The terminal identifier is '@', and the terminal identifier is configured as 'the name of the terminal @ the name of the regional policy server, the name of the central policy server' security policy management system in a wired / wireless integrated environment. A central policy server that executes a security policy determined by a network administrator and holds information of a network user and information of users grouped by a predetermined criterion connected to the central policy server and the grouped users received from the central policy server In the security policy management method in a network system consisting of a plurality of local policy server for delivering a security policy to the user through a wired or wireless communication network, Transmitting, by an administrator terminal, a query message about a user ID to the central policy server; Providing, by the central policy server, a response message including the location of the user terminal corresponding to the user ID identified from the user information held by the central policy server to the manager terminal; Identifying, by the administrator terminal, the local policy server to which the user terminal belongs from the response message; Obtaining, by the administrator terminal, information of a user terminal corresponding to a security policy and the user ID from the identified local policy server; And And applying, by the administrator terminal, the security policy to a user terminal corresponding to the user ID by applying the obtained security policy. The regional policy server is represented by a local server identifier consisting of a name of the regional policy server, a server delimiter, and a name of the central policy server, and the administrator terminal and the user terminal are respectively a terminal name, a terminal identifier, and the region. And a terminal identifier composed of a server name, a server delimiter, and a name of the central policy server. The method of claim 3, wherein The server separator is '.', And the local server identifier is configured as 'the name of the local policy server, the name of the central policy server' security policy management method in a wired / wireless integrated environment. The method of claim 4, wherein The terminal identifier is '@', and the terminal identifier is 'name of terminal @ name of local policy server. Name of central policy server'.