KR20050051269A - System and method for intercepting service port attack on internet - Google Patents

Abstract

The present invention extracts an aggressive packet transmitted from a specific subscriber station for the purpose of paralyzing a specific service port on the Internet by using a MAC (Media Access Control) number assigned as a unique number for the subscriber station to block the Internet access of the packet. To prevent attacks on specific service ports.

Description

System and method for intercepting service port attack on internet}

The present invention relates to an Internet security method, and more particularly, by extracting an aggressive packet transmitted for the purpose of paralyzing a specific service port on the Internet by using a MAC (Media Access Control) number to block the Internet connection of the packet. The present invention relates to a technology that can fundamentally block an attack on a service port.

In recent years, attacks on the Internet have been commonly attacked using well-known service ports (http: 80, DNS inverse query: 1434, etc.). Since the service port is generally used, it is difficult to effectively block the attack.

The existing countermeasures against such attacks have been proposed to reduce the effects of the attack by limiting the bandwidth to a specific service port. However, these methods can be expected to have some effect on the attack. It is difficult to see it as a fundamental countermeasure because it must be blocked.

Accordingly, the present invention has been made to solve the above-described problems, and from the specific subscriber terminal for the purpose of paralyzing a specific service port on the Internet using a MAC (Media Access Control) number assigned to the subscriber terminal unique number. It aims to block an attack on a specific service port by extracting the transmitted aggressive packet and blocking the Internet connection of the packet.

In the service port attack blocking system on the Internet according to the present invention for realizing the above object, a network for discarding an attacking packet to a specific service port of the packet transmitted from the subscriber terminal, and transmits only the packet without attacking to the Internet. Access means; Extract the MAC number and the service port number from the packet transmitted from the network access means, count the number of packets transmitted from a specific MAC number to a specific service port number, calculate the number of packets transmitted per unit time, and transmit the unit time. And a packet monitoring unit for judging the packet as an aggressive packet and transmitting the determination result to the network access means when the number of packets exceeded the reference value.

The method for blocking a service port attack on the Internet according to the present invention includes a first step of extracting a MAC address and a service port number from a packet transmitted from a subscriber station; A second step of determining an aggressiveness of a packet transmitted from the MAC address and the service port number to a specific service port number at a specific MAC address; And if the aggression is confirmed from the packet, discarding the packet to block transmission to the Internet, and if the aggression is not confirmed from the packet, transmitting the packet to the Internet.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

The service port attack blocking system on the Internet according to an embodiment of the present invention includes a DSLAM 12, a NAS 14, an authentication system 16, and a packet monitoring unit 18, as shown in FIG. .

Referring to Figure 1, the function of the main components of the service port attack blocking system on the Internet according to an embodiment of the present invention will be described in detail.

In the DSLAM (Digital Subscriber Line Access Multiplexer) 12, a plurality of subscriber stations 10 may be connected, and multiplexing may be performed on the subscriber stations so that each subscriber station may be connected to the Internet 200 through the NAS 14. It is a multiplexing device.

The NAS (Natwork Access System) 14 performs authentication with the subscriber station 10 requesting access to the Internet by interworking with the authentication system 16, and then assigns an IP address to the subscriber station 10 which has been successfully authenticated. Enable the subscriber station 10 to use the Internet service, and in conjunction with the packet monitoring unit 18 to check whether the packet transmitted from the subscriber station 10 has aggression to a specific service port, the packet is a specific service port If it is determined that the attacking packet of the packet performs the function of blocking the Internet access of the packet.

The authentication system 16 is provided with a service profile for a subscriber. When authentication is requested for a specific subscriber from the NAS 14, authentication information (for example, ID, password, MAC address, etc.) transmitted from the subscriber is included in the service profile. Inquiring, if the authentication information has been stored in the service profile, notifying the NAS 14 of the authentication result "success" for the subscriber, and if the authentication information is not stored in the service profile, the subscriber to the NAS 14; Performs a function of notifying the authentication result of "failure".

The packet monitoring unit 18 extracts MAC address and service port information from the packet transmitted through the NAS 14, and checks whether the packet is aggressive based on the extracted MAC address and service port information. If the packet is confirmed to be offensive to a particular service port, the packet is discarded to block transmission to the Internet 20.

As illustrated in FIG. 2, the packet monitoring unit 18 copies a packet transmitted from the NAS 14 to a memory (not shown), and copies the packet to the MAC number extraction unit 182 and the service port extraction unit 183. A control unit 181 for loading into the; A MAC number extractor (182) for extracting a MAC address from a source address (6 bytes) of the MAC address areas of the MAC layer, which is two layers in the packet; A service port number extractor 183 for extracting a service port number from a destination port (2 bytes) of a 4 layer TCP (Transmission Control Protocol) layer in the packet; On the basis of the output of the MAC number extractor 182 and the service port number extractor 183, the number of packets transmitted from a specific MAC number to a specific service port number is set to set the number of packets per reference unit time (PD), A reference value setting unit 184 for setting the number of packets per reference unit time PD by subtracting the number of packets determined to be aggressive packets from the aggressive determination unit 185 from a specific MAC number to a specific service port number. ); And counting the number of packets transmitted from the specific MAC number to the specific service port number based on the outputs of the MAC number extractor 182 and the service port number extractor 183 to calculate the number of packets per unit time (P). And an aggression determination unit 185 that determines whether or not the packet is aggressive based on a comparison result of the number of packets per unit time P and the reference number of packets per unit time PD provided by the reference setting unit 184. . The number of packets per reference unit time PD in the reference value setting unit 184 is transmitted from a specific MAC number to a specific service port number based on the output of the MAC number extractor 182 and the service port number extractor 183. After counting the number of normal packets to be received, it is a value set by applying an allowable range, for example, 150% to the number of packets.

Next, a method for blocking service port attacks on the Internet according to an embodiment of the present invention will be described in detail with reference to the flowchart shown in FIG. 3.

When the packet transmitted from the authenticated subscriber station 10 is delivered to the NAS 14 through the DSLAM 12, the NAS 14 delivers the packet to the packet monitoring unit 18 (S2).

The control unit 181 of the packet monitoring unit 18 copies the packet to a memory (not shown), and then loads the packet into the MAC number extracting unit 182 and the service port number extracting unit 183, and the MAC number. The extractor 182 extracts the MAC address from the source address (6 bytes) of the MAC address areas of the two-layer MAC layer, and the service port number extractor 183 extracts the destination port 2 of the TCP layer four layers. Byte) to extract the service port number (S4). As is known, the service port number means a number that distinguishes a service type, such as 80 for HTTP, 20 for FTP, 23 for TELET, and 1434 for DHCP reverse query number. It is defined.

Subsequently, the aggressiveness determination unit 185 of the packet monitoring unit 18 counts the number of packets transmitted from the MAC address to a specific service port number, extracts the packet number P per unit time, and then extracts the packet per unit time. Aggressiveness is determined by comparing the number with the number of packets per reference unit time PD provided by the reference setting unit 184 (S6).

As a result of the determination, if the packet number P per unit time is larger than the reference number PD packet per unit time (Yes in S8), the packet is determined to be an aggressive packet and the NAS 14 is notified that the packet is an aggressive packet. Accordingly, the NAS 14 discards the packet and blocks the packet from being transmitted to the Internet 20 (S10).

However, if the packet count P per unit time is less than or equal to the standard packet count PD per unit time (No in S8), the packet is determined to be a normal packet and the NAS 14 is notified of the determination result. Thus, the NAS 14 transmits the packet to the Internet 20, so that the packet can be transmitted to the destination IP address (S12).

According to the method for blocking a service port attack on the Internet as shown in FIG. 3, when a packet transmitted from a specific MAC number to a specific service port number exceeds the number of packets per reference unit time, the packet transmitted to the service port number is blocked and the service port is blocked. Can be blocked from attacking on the Internet. In addition, when a packet transmitted from a specific MAC number to a specific service port number falls below the number of packets per reference unit time, the packet can be normally transmitted to the service port number.

As a result, packets transmitted from the malicious MAC number to the specific service port number are selectively blocked, and packets transmitted from the well-known MAC number to the service port number are normally transmitted through the Internet.

According to the present invention as described above, it is possible to effectively block the attack using a specific service port in the Internet access terminal, has the effect of preventing hacking inherently, thereby improving the reliability of the communication network Has

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

1 is a block diagram of a service port attack blocking system on the Internet according to an embodiment of the present invention.

2 is a detailed configuration diagram of the packet monitoring unit 18 shown in FIG.

3 is a flowchart for explaining a service port attack blocking method on the Internet according to an embodiment of the present invention.

Claims (8)

Network access means for discarding an attacking packet to a specific service port among the packets transmitted from the subscriber station and transmitting only the non-attacking packet to the Internet; Extract the MAC number and the service port number from the packet transmitted from the network access means, count the number of packets transmitted from a specific MAC number to a specific service port number, calculate the number of packets transmitted per unit time, and transmit the unit time. And a packet monitoring unit for judging the packet as an aggressive packet and transmitting the determination result to the network access means when the number of packets exceeded the reference value. The method of claim 1, The packet monitoring unit MAC number extracting means for extracting a MAC address from a source address in a MAC address region of a two-layer MAC layer from a packet transmitted from the network access means; Service port number extracting means for extracting a service port number from a packet transmitted from said network access means at a destination port of a 4 layer TCP layer; Based on the output of the MAC number extraction means and the service port number extraction means, the packet per reference unit time for setting the number of packets per reference unit time (PD) by counting the number of normal packets transmitted from a specific MAC number to a specific service port number Reference value setting means for setting the number PD; And After counting the number of packets transmitted from a specific MAC number to a specific service port number based on the output of the MAC number extracting means and the service port number extracting means, the number of packets per unit time is calculated, and the number of packets per unit time is calculated. And aggression determination means for determining whether the corresponding packet is aggressive based on a comparison result of (P) and the number of packets per reference unit time (PD) provided by the reference setting means. . The method of claim 2, wherein the reference value setting means Based on the output of the MAC number extracting means and the service port number extracting means, the number of normal packets transmitted from a specific MAC number to a specific service port number is counted, and then a reference unit is applied by applying an allowable range to the number of packets. A service port attack blocking system on the Internet, characterized by setting the number of packets per hour (PD).   The normal packet counted by the reference value setting means comprises: The service port attack blocking system on the Internet, characterized in that the packet is not determined to be an aggressive packet in the aggressive determination means. Extracting a MAC address and a service port number from a packet transmitted from a subscriber station; A second step of determining an aggressiveness of a packet transmitted from the MAC address and the service port number to a specific service port number at a specific MAC address; And If aggression is identified from the packet, the packet is discarded to block transmission to the Internet; if the aggression is not confirmed from the packet, a third process of transmitting the packet to the Internet is provided. How to block port attacks. The method of claim 5, wherein the second process On the basis of the MAC address and the service port number extracted in the first process, the number of normal packets transmitted from a specific MAC number to a specific service port is calculated to calculate the number of packets per reference unit time (PD) to determine the number of packets per reference unit time ( Setting up a PD); After calculating the number of packets per unit time P by counting the number of normal packets transmitted from a specific MAC number to a specific service port based on the MAC address and the service port number extracted in the first step, the number of packets per unit time And a second step of determining whether the corresponding packet is aggressive based on the comparison result of the reference packet number per PD. The method of claim 6, wherein the PD number of packets per unit time is And a predetermined range of allowable values is added to a result value of the number of normal packets transmitted from the specific MAC number to a specific service port number. 8. The method of claim 7, wherein the normal packet is A method for preventing a service port attack on the Internet, wherein the packet transmitted from the subscriber station is an unverified packet.