KR20050002348A - System for securing of intranet and method thereof - Google Patents

Abstract

PURPOSE: A system and a method for fundamentally blocking data maliciously connected to an intranet through the Internet are provided to fundamentally block hacking and prevent virus infection by transmitting the data to the intranet, after removing an IP(Internet Protocol) address of the data transmitted to the intranet from the Internet and judging validity of the data. CONSTITUTION: An external server(101) connected to the Internet(107) through an external Ethernet port(103) removes an IP header of the encrypted IP data transmitted from the Internet and transmits the data to a switch(105). A memory(106) stores the encrypted data transmitted from the external server through the switch. An internal server(102) judges the validity of the data by fetching the data stored in the memory through the switch and transmits only the validated data to the intranet(108) through an internal Ethernet port(104).

Description

Intranet security system and method

The present invention relates to an intranet security system and method, and more particularly, to a technology that can fundamentally block data that malicious access to an intranet through the Internet.

Since the late 1980s, the Internet technology has been rapidly developed and grown with the US National Science Foundation Network (NSFNET) as the core, and established its position as the basic technology of the data network. Even now, the growth rate of the Internet system is not declining, but rather its growth and development is accelerating.

Internet technology has enabled networks (interconnections) between networks, thus making computers and digital communication devices around the world interconnectable. In other words, the Internet serves as the basis of a global data network, and the number of traffic (traffic) and access nodes (computers and routes) is still increasing beyond the exponential function. In addition, with the recent spread of Internet technology, the Internet has been functioning as an industrial base and a living base.

The Internet, an open data network, is built and operated based on IP technology. On the other hand, in networks such as private networks for businesses, closed private networks have been established without access to the Internet or restricting access by filtering.

Against this backdrop, it has become common to build private networks using IP technologies used on the Internet, based on advances in security technologies. This is called an intranet.

In general, since an intranet is provided for sharing information in-house or for a specific target area, facility information or sharing information of an intranet should be secured from an external user (Internet).

For the above reasons, a security device for an intranet has been proposed, but in the case of the conventional security device, since the data transmitted to the intranet is monitored inside the intranet to determine the harmfulness, it is possible to detect the intrusion after the intrusion has already been performed. There are technical limitations.

Accordingly, the present invention has been made to solve the above-described problems, and by removing the IP address of the data transmitted to the intranet from the Internet to the intranet to remove hacking, and determine the validity of the data It is an object of the present invention to provide an intranet security system and method that can fundamentally prevent an intranet from being infected with a virus.

1 is a block diagram of an intranet security system according to an embodiment of the present invention.

2 and 3 is a signal flow diagram illustrating an intranet security method according to an embodiment of the present invention.

4 is a diagram for explaining the hierarchical structure of the external server 101 shown in FIG.

FIG. 5 is a diagram for describing a process of operating a plurality of virtual servers 402 in the expansion server based module 403 of FIG. 4.

FIG. 6 is a diagram for explaining the hierarchical structure of the internal server 102 shown in FIG.

FIG. 7 is a view for explaining an interlocking process between the expansion engine based module 501 and the plurality of expansion engines 502 of FIG. 6.

Intranet security system of the present invention for achieving the above object is connected to the Internet through an external Ethernet port, after removing the IP header of the encrypted IP data transmitted from the Internet, and transmits the IP header removed data to the switch An external server; A memory for storing encrypted data transmitted from an external server through the switch; And an internal server fetching data stored in the memory through the switch to determine validity of the data and transmitting only valid data to the intranet through an internal Ethernet port.

In the intranet security method for achieving the above object, if predetermined IP data is transmitted from an external user terminal through the Internet, the external server removes the IP header of the IP data, and then temporarily stores the data from which the IP header is removed in a memory. A first process of doing; A second process of fetching data stored in the memory to an internal server connected to an intranet when data storage in the memory is finished; A third process of performing authentication on the external user; A fourth step of, if the authentication is successful, determining the validity of the data and transmitting the determined data to a predetermined server of the intranet; And a fifth process of transmitting a response transmitted from a predetermined server of the intranet to the terminal of the external use.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

In an intranet security system according to an embodiment of the present invention, as shown in FIG. 1, an intranet security system 100 is constructed between the Internet 107 and an intranet 108, and an intranet 108 via the Internet 107. Block access to) at source.

Intranet security system 100 is external server 101 connected to external Internet 107 via external Ethernet port 103, internal intranet 108 via internal Ethernet port 104, as shown in FIG. And a switch 105 for setting a signal path between the internal server 102, the memory 106, and the external server 101 or the memory 106 and the internal server 102 connected to each other.

Hereinafter, the detailed configuration of the intranet security system 100 will be described in more detail.

The external Ethernet port 103 of the intranet security system 100 serves to connect the external server 101 with the external Internet. Communication data sent from the Internet 107 to the internal intranet 108 or vice versa all communication data from the intranet 108 to the Internet 107 is passed through the external Ethernet port 103. Ethernet port 103 has an Internet Protocol (IP) address and a domain name system (DNS) name, which is open to all computers on the Internet 107.

The external server 101 is connected to the external Ethernet port 103 and serves to receive data of all encrypted external users transmitted from the Internet 107 via the external Ethernet port 103. After receiving the encrypted packet of the external user, the external server 101 removes the IP header including the destination IP, and transmits only the encrypted data to the switch 105. Here, since the IP header is removed, it is impossible for a hacker to find out the IP information and network structure of various user PCs and servers existing in the internal intranet 108.

The switch 105 is made of a semiconductor switch and communicates with the memory 106. Preferably, the switch 105 uses an exclusive approach so that the external server 101 and the internal server 102 cannot connect to the switch 105 at the same time. That is, only one of the external server 101 or the internal server 102 may be connected to the switch 105 at a specific time, and it is impossible for two servers to simultaneously connect to the switch 105. When data transmitted from the Internet 107 is transmitted to the intranet 108, the encrypted data transmitted from the external server 101 with the IP header removed is temporarily stored in the memory 106 and the memory 106. After the data has been loaded, the switch 105 disconnects from the external server 101 and connects to the internal server 102. At this time, the data exchange between the switch 105 and the memory 106 uses an out of band (non-band) protocol such as a small computer system interface (SCSI) or the like, rather than Transmission Control Protocol / Internet Protocol (TCP / IP). It also logically blocks attacks using vulnerabilities in TCP / IP.

The internal server 102 has an authentication function and has a function of decrypting encrypted data and converting it into general data. It also has a function of determining which of the various servers existing in the intranet 108 should communicate the communication data to. When the switch 105 disconnects the external server 101 and transmits an encrypted packet temporarily stored in the memory 106 to the internal server 102 by connecting to the internal server 102, the internal server 102 is disconnected. After the encrypted data is decrypted and converted into general data, the server transmits the data to a specific server that will process the corresponding data among the servers in the intranet 108 through the internal Ethernet port 104. Since the switch 105 connects the external server 101 and the internal server 102 using an exclusive approach, it is impossible to illegally invade the internal intranet 108 from the outside. In addition, the internal server 102 has an authentication function for determining whether an external user may access before data transmission, and authenticates the user before data transmission.

Next, the operation of the intrusion prevention system for the intranet will be described with reference to the signal flow diagrams shown in FIGS. 2 and 3.

As shown in FIG. 2, when an external user on the Internet 107 requests communication with the internal server 102, an encryption session between the external user terminal and the external server 101 is initialized (S201), and the external user The terminal transmits the transaction for the encrypted session to the external server 101 (S202). As a result, the external server 101 is in a state capable of receiving a packet transmitted from the external user terminal.

After the external server 101 receives the packet from the external user terminal (S203), the external server 101 removes the header of the TCP / IP from the contents of the packet (S204), and then connects to the switch 105. You will be asked. At this time, since the packet is removed from the external server 101, it is impossible for an external hacker to directly transmit the packet to a specific server in the intranet 108.

Accordingly, if the switch 105 is in the state of being connected with the internal server 102, the switch 105 waits until the connection with the internal server 102 is finished, and then disconnects from the internal server 102 and connects with the external server 101 (S206). The encrypted data transmitted from the external server 101 is stored in the memory 106 (S207).

If not connected to the internal server 102, the exclusive connection method of the switch 105 may be used to directly connect with the external server 101 to store encrypted data transmitted from the external server 101 in the memory 106. .

When the storage of the data in the memory 106 is completed, the switch 105 terminates the connection with the external server 101 (S208) and simultaneously connects to the internal server 102 (S209), and the data stored in the memory 106. Fetch to the internal server 102 (S210), and then decrypt the transmitted data (S211).

After decrypting the data, the internal server 102 creates an encrypted communication session with the external user for authentication of the external user (S301). Preferably, the encrypted communication session is for preventing the external user's authentication information from being exposed to the outside.

Subsequently, the internal server 102 generates an encrypted login screen and transmits the encrypted login screen to the external user terminal through the switch 105 (S302).

When the external user inputs information necessary for various authentications, such as his ID, password, or public key infrastructure (PKI) certificate, on the encrypted login screen (S304), the authentication information is stored in the external server 101 and the switch 105. Via S, it is transmitted to the internal server 102 (S305).

The internal server 102 receiving the authentication information of the external user checks whether the authentication information of the user is correct and authenticates the user (S306). In this case, the authentication of the user may be performed by the internal server 102 itself, or may use a Remote Authentication Dial-In User Service (RADIUS), a Lightweight Directory Access Protocol (LDAP) server, or the like located in the intranet.

If the authentication of the external user is successful, the internal server 102 performs a virus or worm scan and a URL (Uniform Resource Locator) on the data decrypted in step S211. If the check result is normal, determine which intranet server to transmit to based on the rules set in the internal server 102 (S307).

When data is transmitted to a specific server in the intranet (S308), the specific server in the intranet receiving the data determines a response (S309), and transmits the response to the internal server 102 (S310).

Subsequently, the internal server 102 encrypts the transmitted response (S311) and transmits it to the remote user terminal (S312), thereby terminating all data transmission / reception processes.

The hierarchical structure of the external server 101 configured in the intranet security system of the present invention is as shown in FIG.

In FIG. 4, hardware and firmware 400 are identical to the basic structure shown in FIG. 1. The server base 401 includes an operating system used by an external server and an expansion server based module 403 on top of the operating system. In this case, the expansion server-based module 403 is a structure on which the external server 101 is based, and features distinguishing from the internal server 102 are implemented by the above structure.

The expansion server-based module 403 allows a plurality of virtual servers 402 to be configured on the upper side. The virtual server 402 may operate a desired virtual server as an external server operator. In the virtual server 402 layer, various servers such as SSL, DB, FTP, and Web may be used for each application.

The reason for using a virtual server without using a real server is to design an intrusion prevention structure. When a real server is located on an external server, it is possible to take advantage of a variety of bugs and patches of the real server itself. Because it is possible to invade, only the virtual server should be operated on the external server. And based on the expansion server-based module 403 has a feature that can be extended to operate multiple virtual servers.

The principle that the expansion server base module 403 of the external server 101 has scalability with respect to a plurality of virtual servers will be described with reference to FIG. 5.

If there is a request from an external user on the Internet 107 (601), the external request (601) is first sent to the expansion server based module 403. The expansion server based module 403 operates on the external server 101 and plays a role of scheduling and load balancing. The expansion server based module 403 receiving the packet received by the external request 601 first checks the destination address and the port number of the packet. The expansion server based module 403 is provided with a table containing information of the virtual servers running on the expansion server based module, and if the destination address and the port number of the various virtual servers are operated on the virtual server 402. When matching with the service, the packet is transmitted to the matched virtual server 402 using an internal scheduling algorithm.

The generated connection is recorded in the hash table of the extension server-based module 403. The destination address and port number of the original packet originally sent from the Internet 107 are rewritten to an address that matches the selected virtual server 402. This process is called scheduling and packet rewriting (602).

The virtual server 402 processes 603 the external request sent from the expansion server based module 403 after scheduling and packet rewriting 602 and sends a response back to the expansion server based module 403. When the response is returned, the expansion server based module rewrites the source address and the port number in the packet originally received from the Internet 107. This is called response rewrite 604. The packet whose response rewrite 604 is completed is returned back to an external user of the Internet 107. This process is called responding to an external request (605). When the connection is terminated or timed out, the information of the hash table in the expansion server based module 403 is deleted.

The expansion server based module 403 allows the external user to connect with the desired server by changing the destination address and port number regardless of the number of virtual servers 402 through scheduling and packet rewriting 602. Load balancing prevents bottlenecks in packets when multiple virtual servers are operated.

The hierarchical structure of the internal server 101 configured in the intranet security system of the present invention is as shown in FIG.

The hardware and firmware illustrated in FIG. 6 are the same as those of FIGS. 1 and 4 as 400, and the server-based 500 uses the expansion engine-based module 501. The extension engine-based module can be equipped with various engines that perform data encryption / decryption, authentication function, update and inspection of worms and viruses, and these various engines form the expansion engine 502 layer.

The extension engine 502 layer includes an engine for decrypting the patched encrypted data, an engine for checking viruses, worms and URLs for the decrypted data, an engine for encrypting data to be transmitted to the external server, and the Internet. It is preferable to include an engine that performs authentication for an external user connected through.

The expansion engine-based module 501 has a structure that can operate a plurality of expansion engines by matching the input / output type, and this easy scalability can prepare for the emergence of a new virus or worm and expand the network or a new service in the future. It makes it possible to mount additional dragon engines.

The expansion engine-based module 501 of the external server 101 will be described with reference to FIG. 7 in association with the plurality of expansion engines 502.

The operation of the expansion engine 502 proceeds in the order of expansion engine registration, expansion engine operation, and expansion engine deletion.

If a specific expansion engine is added to the plurality of expansion engines 502 on the expansion engine base module 501 as necessary, the expansion engine is added to the expansion engine table 706 located in the expansion engine base module 501. The ID of the command, the command input / output format, the command parameter format and the number of parameters, the format of the command processing result, and the number of parameters of the processing result are recorded.

When the packet transmitted from the Internet 107 to the internal server 102, the command interpreter 703 in the extension engine-based module 501 transmits a message to the expansion engine whose ID is registered on the expansion engine table 706. (701). This message includes information indicating that the packet is received and whether the packet is processed or not. The engine which has determined that the operation of the corresponding engine is necessary among the corresponding expansion engines having received the message sends a message back to the command interpreter 703 indicating that the engine is ready for operation.

The instruction interpreter 703 receives the message that the expansion engine is ready for operation, inspects the received packet, and processes the received packet according to various instructions and data input / output formats recorded in the expansion engine table 706. The processed message is transmitted to the expansion engine again, and when the operation of the expansion engine is finished, the processing response 702 is transmitted to the expansion engine based module 501 again. The transmitted process response 702 is analyzed by the result analyzer 705 to determine whether the result is an error, retransmission or reprocessing, whether to record the result of the processing in the extension engine table, and the like. If there is no abnormality in the normal processing result, the processing result is not recorded in the expansion engine table 706, but in the case of an error or when another expansion engine needs to use the processing result again, the processing result is recorded in the expansion engine. When a plurality of expansion engines 502 operate, the scheduler 704 schedules the processing of messages because bottlenecks, processing delays, etc. of messages transmitted to the expansion engine may occur. The scheduler is also responsible for scheduling the operation of expansion engines that perform periodic or aperiodic operations, such as check engines and update engines.

Various expansion engines operating in the expansion engine 502 exchange all message transmissions with the expansion engine based module, so that the individual expansion engines operate independently.

According to the present invention as described above, it is possible to fundamentally block the hacking on the intranet attempted on the Internet, to block the use of illegal resources, and to infect the server by warming and biasing viruses. Can be prevented.

On the other hand, the present invention is not limited only to the above-described embodiments, it can be carried out by modifying and modifying within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (15)

An external server connected to the Internet through an external Ethernet port to remove an IP header of encrypted IP data transmitted from the Internet, and then transmit the data from which the IP header has been removed to a switch; A memory for storing encrypted data transmitted from an external server through the switch; And And an internal server for fetching data stored in the memory through the switch to determine validity of the data and transmitting only valid data to the intranet through an internal Ethernet port. The method of claim 1, The switch, Upon request of the external server, the external server is connected to the external server to receive encrypted data from the external server, and stores the encrypted data in the memory. When the data storage in the memory is completed, the external server is connected to the internal server to store the encrypted data. Intranet security system that allows data to be fetched to the internal server. The method of claim 2, The switch, Intranet security system characterized by an exclusive access method. The method of claim 1, The external server, An extension server based module for installing a plurality of virtual servers on top of an operating system is installed, and a virtual server layer including a plurality of virtual servers is installed on the extension server based module. The method of claim 1, The internal server, An extension engine based module for installing a plurality of engines installed above the operating system, and an expansion engine layer including a plurality of engines is installed above the expansion engine based module. The method of claim 5, wherein The expansion engine layer, An engine for decrypting the patched encrypted data, an engine for checking viruses, worms, and URLs for the decrypted data, an engine for encrypting data to be transmitted to the external server, and an external user connected through the Internet. Intranet security system, characterized in that it comprises an engine for performing authentication. The method of claim 6, The internal server, After generating an encrypted communication session with the terminal of the external user, the encrypted login screen is transmitted to the external user terminal through the encrypted communication session, and using the authentication information input from the external user terminal to the external user terminal Intranet security system, characterized in that for performing authentication. The method of claim 1, The internal server, An intranet security system, characterized in that a worm and a virus test are performed on the data, and a URL test is performed to determine that the data whose test result is normal is valid data. The method of claim 1, The Ethernet port is Intranet security system characterized by having an IP (Internet Protocol) address and a domain name system (DNS) name. The method of claim 1, The switch and the memory communicate using a protocol other than a band domain. A first step of, when the predetermined IP data is transmitted from the external user terminal through the Internet, after the external server removes the IP header of the IP data, temporarily storing the data from which the IP header has been removed in a memory; A second process of fetching data stored in the memory to an internal server connected to an intranet when data storage in the memory is finished; A third process of performing authentication on the external user; A fourth step of, if the authentication is successful, determining the validity of the data and transmitting the determined data to a predetermined server of the intranet; And And a fifth process of transmitting a response transmitted from a predetermined server of the intranet to the terminal of the external use. The method of claim 11, In the second process, And the data stored in the memory is encrypted data. The method of claim 11, Between the second process and the third process, the intranet security method further comprising the step of generating an encrypted communication session between the internal server and the external user terminal. The method of claim 13, The third process, A first step of transmitting an encrypted login screen through the encrypted communication session to the external user terminal; And A second step of authenticating the external user using the authentication information when the authentication information input by the external user with respect to the encrypted login screen is transmitted to the internal server through the encrypted communication session; Intranet security method, characterized in that configured to include The method of claim 10, In the fourth process, The determination of the validity of the data includes a warm and virus check on the data, a URL check, and the data having a normal check result as the valid data.