KR20060001946A - Method for detecting non-approval roundabout route on network and system therefor - Google Patents

Abstract

The present invention automatically detects the presence and installation of a network access device that is not recognized by the network administrator or an illegal network administrator, thereby preventing unauthorized network attack or leakage of information by an insider. And a system, the management system on a network comprising: a first step of inspecting a list of devices in an original network; A second step of identifying a device providing a connection path with another network among the devices checked in the first step; A third step of classifying the devices providing the connection path checked in the second process as authorized devices, and storing a snapshot of a list of authorized devices and a configuration; And a fourth process of periodically examining the equipment of the network, comparing the snapshot with the snapshot, and notifying administrators of additions and changes.

Network, unauthorized, bypass, search, detect, route

Description

METHODE FOR DETECTING NON-APPROVAL ROUNDABOUT ROUTE ON NETWORK AND SYSTEM THEREFOR}

1 is a flowchart illustrating a method for detecting unauthorized bypass paths on a network according to the present invention;

2 is a block diagram of a transport packet according to the present invention;

3 is a block diagram of an unauthorized bypass path detection system on a network according to a first embodiment of the present invention;

4 is a block diagram of an unauthorized bypass path detection system on a network according to a second embodiment of the present invention;

5 is a detailed block diagram of a network search system according to the present invention;

6 is a detailed block diagram of the central management system according to the present invention.

<Explanation of symbols for the main parts of the drawings>

10: response server 20: network (external network)

30: modem 51, 52: network (internal network)

71,72: Gateway 80: Network Search System

90: management system

The present invention automatically detects the presence and installation of a network access device that is not recognized by the network administrator or an illegal network administrator, thereby preventing unauthorized network attack or leakage of information by an insider. And to the system.

Network management system (NMS) that can monitor the configuration change management of the components in the network, equipment failure management, network equipment performance management, or equipment status due to the technological development of the network. System) technology is generalized.

However, the NMS technology provides various intelligent services but cannot detect network configuration changes due to illegal equipment introduction or installation.

In other words, since NMS technology is based on setting and monitoring the equipment included in the management area, it is difficult to find illegal and intentional installation and operation of the equipment.

In other words, with the popularization of wireless LAN or xDSL technology, convenience and ease of connection to the external Internet are increased, allowing users to arbitrarily connect an external network path.

However, when there are numerous branches in a network distributed environment, it was difficult for the central administrator to recognize the details of network change at each branch.

As a result, the connection between the external and internal network paths could be exploited as an external leakage path of the insider's main information, and it was difficult for the central manager to confirm the existence of the damage.

In addition, the illegally installed network path may be exploited by outside attackers as an intrusion path of the internal network, and the risk of accessing the system through the bypass path may be much higher because it does not pass through the existing security shield.

The present invention was devised to solve the above problems, and an object of the present invention is to automatically detect the existence and installation of a network connection device that is not recognized by a network administrator or an illegal person on a network, thereby preventing internal network attacks or insiders from outside. The present invention provides a method and system for detecting unauthorized bypass paths on a network so as to prevent information leakage by the network.

In order to achieve the above object, the present invention provides a management system on a network, comprising: a first process of inspecting a list of devices in an initial network; A second step of identifying a device providing a connection path with another network among the devices checked in the first step; A third step of classifying the devices providing the connection path checked in the second process as authorized devices, and storing a snapshot of a list of authorized devices and a configuration; And a fourth process of periodically examining the equipment of the network, comparing the snapshot with the snapshot, and notifying administrators of additions and changes.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a method for detecting an unauthorized bypass path on a network according to the present invention.

As shown, the unauthorized bypass path detection method on the network according to the present invention, the first step (S10) of examining the list of devices in the first network, and the other network of the devices checked in the first step (S10) The second process (S20) for distinguishing between the equipment providing the connection path and the device providing the connection path checked in the second process (S20) is classified by the network administrator as an authorized device, the list of authorized devices and And a third step (S30) of storing a snapshot of the configuration, and a fourth step (S40) of periodically examining the equipment of the network, comparing the snapshot with the snapshot, and notifying administrators of additions and changes. do.

More specifically, the first step (S10) comprises the steps of monitoring the packets in the network to create a list of equipment (S11), sending a packet in the network to create a list of responding equipment (S12), And storing the result generated by the above steps S11 and S12 (S13).

The second step (S20) is a step (S21) of sending a packet for checking the connection path to the list of devices created in the first step (S10), and analyzes the response packet according to the packet transmission and connected to the equipment characteristics Identifying the path (S22), and storing the characteristic value and the connection path value of the equipment (S3).

The third process (S30) is a step (S31) of checking whether the administrator is authorized for the result of the second process (S20), and storing a snapshot of the equipment authorized by the manager (S32) It consists of.

The fourth process S40 is performed by comparing the snapshot which is a result of the third process S30 by performing the first process S10 and the second process S20, and the result of the comparison is changed. If there is a content is configured to notify the manager (S42).

According to the present invention, the network connection equipment is divided into the following methods in order to separate equipment connected to the external network from among the various equipment in the network.

First, set up a responsive host in the external network.

Second, an Internet Control Message Protocol (ICMP) response request packet as shown in FIG. 2 is created.

Here, the Destination Address is set to a responsive host IP address existing in the external network.

For Source Address, set the ** detector's IP address.

Set ICMP TYPE and Code to 8 and 0 corresponding to Echo Request, respectively.

In ICMP Message, set the IP address and MAC address of the device to be checked as data values.

The packet is sent to the inspection target system by setting the address of the Ethernet frame destination as the inspection target MAC address.

Third, check the ICMP response message to distinguish equipment connected to other networks.

Here, the equipment that does not respond to the ICMP message is recorded as a system that does not have a bypass path.

If the reply ICMP message is not an echo reply message, the error type and code are stored.

If an echo reply message is returned in an ICMP echo request, the response message is analyzed.

If the source MAC address of the Ethernet packet of the response packet and the MAC address of the IP address recorded in the ICMP message match, the device with the corresponding IP and MAC address is classified as a device having a path that provides a connection to the external network. Record and store the TTL value of the response message connected to the external network and the characteristics of the other equipment.

If the source MAC address of the Ethernet packet of the response packet and the MAC address of the IP address recorded in the ICMP message do not match, the corresponding IP device recorded in the ICMP message is recorded as a non-routable device.

3 is a block diagram of an unauthorized bypass path detection system on a network according to a first embodiment of the present invention.

As shown, the unauthorized bypass path detection system on the network of the present invention includes a response server 10 connected to the external network 20, a plurality of general equipment connected to the internal networks 51 and 52, and the external network 20. And a gateway 71 and 72 connecting between the internal network 51 and 52 and a network search system 80 connected to the networks 51 and 52.

According to this configuration, each network search system 80 connected to the internal network (51, 52) after setting the response server 10 in the external network 20, ICMP response request packet as shown in FIG. Make

The Destination Address is set as the IP address of the response server 10, and the Source Address is set as the IP address of the network search system 80 connected to the internal networks 51 and 52.

After setting 8 and 0 corresponding to Echo Request for ICMP TYPE and Code, respectively, set IP address and MAC address of the device to be checked, that is, general equipment, in ICMP message.

The network retrieval system 80 sends the packet to the inspection target system by setting the address of the Ethernet frame destination as the MAC address of the inspection target.

The ICMP response message for the sent packet is identified to distinguish equipment connected to the external network 20.

Here, the equipment that does not respond to the ICMP message is recorded as a system that does not have a bypass path. If the reply ICMP message is not an echo reply message, the error type and code are stored. If an echo reply message is returned in an ICMP echo request, the response message is analyzed.

If the MAC address of the source MAC of the Ethernet frame and the IP address recorded in the ICMP message match, the device with the IP and MAC address recorded in the ICMP message is classified as having a path that provides a connection to the external network. .

The TTL value of the response message connected to the external network and the characteristics of the other equipment are recorded and stored, and the change is recognized by the administrator.

4 is a block diagram of an unauthorized bypass path detection system on a network according to a second embodiment of the present invention.

As shown, the unauthorized bypass path detection system on the network of the present invention includes a response server 10 connected to an external network 20, a plurality of network search systems 80 connected to the network 20, and the external network ( 20, a management system 90 connected thereto.

The network retrieval system 80, as shown in Figure 5, the diagnostic packet generator 81 for performing packet transmission (step S21 of Figure 1) to check the connection path, and monitors the packets in the network of the equipment list Packet monitor 82 which performs creation (step S11 of FIG. 1), response packet analyzer 83 which analyzes the response packet of the packet which the said diagnostic packet generator 81 generated, and sends the packet in a network, A network equipment finder 84 for creating a list (step S12 of FIG. 1), and a data input / output processor 85 for storing a result (step S13 of FIG. 1) and a device characteristic value and a connection path value (S23). do.

Also, the management system 90 includes a DB analyzer 91 for analyzing a database DB, a search system communication module 92, an administrator event generator 93, and a data input / output device as shown in FIG. (94).

Here, after performing the first and second processes of FIG. 1, the DB analyzer 91 is responsible for comparing the snapsets of the snapsets and the comparisons (S41) of the third steps.

The search system communication module 92 and the data input / output 94 play a role of storing the result storage (S13) of FIG. 1, the device characteristic value and the connection path value (S23).

The manager event generator 93 performs a role of confirming whether the administrator is authorized for the result of FIG. 1 (S31) and notifying the manager of the change (S42).

As prepared above, the present invention is useful for automatically detecting the existence and installation of a network access device that is not recognized by the network administrator or the network administrator, thereby preventing external network attacks or information leakage by insiders. Invention.

Claims (9)

In the management system on the network, Inspecting a list of devices in the original network; A second step of identifying a device providing a connection path with another network among the devices checked in the first step; A third step of classifying the devices providing the connection path checked in the second process as authorized devices, and storing a snapshot of a list of authorized devices and a configuration; And And a fourth step of periodically examining the network equipment, comparing the snapshot with the snapshot, and notifying the administrator of the additions and changes. The method of claim 1, The first process includes the steps of monitoring a packet in a network and creating a device list; Sending a packet in the network to create a list of responding devices; And And storing the result produced by the above steps. The method of claim 1, The second step may include sending a packet for checking a connection path to the list of devices created in the first step; Analyzing a response packet according to the packet transmission to identify equipment characteristics and a connection path; And And storing the characteristic value and the connection path value of the device. The method of claim 1, The third step may include: checking whether an administrator is authorized for the result of the second step; And And storing a snapshot of the device authorized by the administrator. The method of claim 1, The fourth process includes performing a first process and a second process and comparing the snapshot with a snapshot resulting from the third process; And notifying the administrator of any changed contents as a result of the comparison. In the management system on the network, A response server connected to an external network; General equipment connected to the internal network, A gateway connecting between the external network and the internal network; And And an unauthorized bypass path detection system on the network, comprising a network search system connected to the network. The method of claim 6, And a network retrieval system and a management system further connected to the external network. The method according to claim 6 and 7, The network retrieval system includes a diagnostic packet generator that performs packet sending to check a connection path, a packet monitor that monitors packets in a network, and prepares a list of devices, and analyzes response packets of packets generated by the diagnostic packet generator. A bypass packet analyzer, a network device finder for sending a packet in the network to create a list of response devices, and a data input / output processor for storing result and device characteristic values and connection path values. Route detection system. The method of claim 7, wherein The management system performs a first step and a second step, and then a DB analyzer performing a comparison with the snap step of the third step; And the administrator event generator for notifying the administrator of the result of the authorization and the change of the result.

Images