KR20060035680A - Security method for imaginary in-line network - Google Patents

Abstract

The present invention is a system for analyzing the network packet to determine whether the security policy is appropriate or intrusion, the control of the terminal existing on the network segment or the same VLAN without the installation of physical in-line structure To respond by modulating the MAC address request response of the required terminals to the MAC address of the security device, allowing the communication contents of the terminals to pass through the security device, and then determining the conformance of the security policy to perform access control. The inline network security method of the configuration, the configuration, the first process (S100) for determining whether a specific device is subject to the application of the virtual path setting, and the specific device is virtual through the first process (S100) If it is determined that the path is suitable for the target setting step (S200) of setting a virtual path of the application target device, and the set of the virtual path A third step (S300) of checking whether the traffic conforms to the security policy, a fourth step (S400) of checking whether the traffic of the virtual path is harmful traffic, and a fifth step of separating the system of the virtual path from the network It is to include (S500).

Virtual, inline, network, security

Description

Security method for Imaginary in-line network

1 is a block diagram of a conventional network security device,

2 is a configuration diagram of a virtual inline network security device to which the present invention is applied;

3 is a control flowchart of a virtual inline network security method according to the present invention;

4 is a control flowchart illustrating in detail the first process of FIG. 3;

5 is a control flowchart illustrating a second process of FIG. 3 in detail;

6 is a control flowchart illustrating a third process of FIG. 3 in detail;

7 is a control flowchart illustrating a fourth process of FIG. 3 in detail;

8 is a flowchart illustrating a fifth process of FIG. 3 in detail.

<Description of Symbols for Major Parts of Drawings>

100: first internal network 200: second internal network

16, 26, 35: Inline 40: Backbone switch

50: inline firewall 60: router

The present invention relates to a system for analyzing the network packet, such as firewall and intrusion prevention system in the network to determine whether the security policy is appropriate and intrusion, and more specifically, physically Without installing the in-line structure, by modifying the MAC address request response of the terminals that need to be controlled among the terminals existing on the network segment or the same VLAN to the MAC address of the security equipment, the communication contents of the terminals are changed. The present invention relates to a virtual inline network security method that allows access control to be performed after determining whether a security policy is met after passing through a security device.

Network security equipment such as intrusion prevention system or intrusion prevention system as described above is divided into router mode and bridge mode according to the type of installation configuration.

In the router mode, the IP address band of the network interface card to which the packet is input and the IP address band of the network interface card to which the packet is output are different from each other.

If the equipment is installed on an existing network, this involves changing the existing network IP address type.

Unlike the router mode, the bridge mode uses the same network address band as the IP bands of the card of the input network interface and the card of the output network interface. Likewise, there is no need to change the network IP, and simply insert the equipment by physically switching the network line.

On the other hand, the general network security equipment is in the form of an in-line configuration in which the security equipment is installed in the middle by disconnecting the pre-installed network line regardless of the router mode or the bridge mode.

In the conventional network security equipment installation, both router mode and bridge mode are configured in-line, so the physical in-line structure is used during installation. In this case, it was inevitable that the network was stopped, the speed delay after installation after normal communication flow, and when the installation equipment failed, the communication of other networks would be lost.

As a result, such an in-line configuration has an advantage of increasing security by being able to see all the packets passing through the network. However, due to the in-line configuration, a speed delay phenomenon occurs simultaneously to all terminals. In the event of a failure, communication of the entire network is lost.

Such a conventional system will be described with reference to FIG.

As shown in the drawing, the conventional network security device includes a first L2 switch in order to restrict communication from the first terminal 11 of the first internal network 10 to the fourth terminal 21 of the second internal network 20. The first security equipment 15 is installed in-line between the section 14) and the backbone switch 40 to control communication traffic.

The first security equipment 15 installed in the first L2 switch 14 and the backbone switch 40 is configured such that all traffic connected to the other network (network) from the first internal network 10 must pass through the security equipment. Therefore, the header information (origin address, destination address, destination port, etc.) of the TCP / IP packet transmitted between the communication targets is used to determine whether the policy conforms to the policy to determine whether to pass or block.

This general in-line network security device configuration causes network speed delays in communication and network disconnection in the event of a security device failure.

In addition, when communicating between the first terminal 11 and the second terminal 12 in the first internal network 10, since the packets transmitted between the two terminals do not pass through the first security equipment 15, the connection is controlled. It has a limitation that cannot be done.

The present invention was devised to solve the above problems, and an object of the present invention is a virtual in-line technology, in which the actual physical configuration is not in-line, but communication parties use security equipment. The idea is to provide a virtual inline network security method that enables communication via a network so that the same security operation as in a physical in-line configuration is possible.

In addition, another object of the present invention, when installing the security equipment in the network, it is possible to install the equipment without network interruption, the network failure does not occur in the conventional single point of failure (Single point of failure), the authorized network The device provides a virtual inline network security method that eliminates speed delay by allowing communication without passing through a virtual in-line configured device.

In addition, another object of the present invention is to provide a virtual inline network security method for controlling the communication and traffic between the terminals in the same network as well as traffic to the outside via the security equipment.

In addition, another object of the present invention is to provide a virtual inline network security method that is suitable for the use of unauthorized systems to effectively block a number of internal networks and the system that effectively generates the abnormal traffic.

In order to achieve the above object, the present invention provides a virtual inline network security method, comprising: a first process of determining whether a specific device is subject to application of a virtual path setting; A second process of setting a virtual path of the application target device when it is determined that the specific device is suitable for the virtual path setting target through the first process; A third step of checking whether the traffic of the set virtual path conforms to a security policy; A fourth step of checking whether the traffic of the virtual path is harmful traffic; And a fifth process of separating the system of the virtual path from the network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram of a virtual inline network security device to which the present invention is applied.

As shown, the virtual in-line network security device to which the present invention is applied operates unlike the conventional configuration after connecting the equipment to the network in the form of a general terminal.

That is, a plurality of terminals and a plurality of internal networks including L2 switches (hubs) connected to the terminals are formed, and at the same time, the DB (database) server 33 and the APP (application) server 34 are connected. An L2 switch (hub) 32 is configured, and is connected to the backbone switch 40 connected to the hubs, an inline firewall 50 connected to the backbone switch 40, and an inline firewall 50. In a network device including a router (60) and the Internet, each of the internal network hubs and the L2 switch (hub) 32 to which the DB server 33 and the APP server 34 are connected are respectively inline (In-). line) (16,26,35) system was constructed.

In the present invention configured as described above, when the network control of the first terminal 11 of the first internal network 100 is to be performed, the first terminal 11 transmits a packet to a hardware address of a communication partner or a gateway. It requests a (MAC address), the virtual inline (16, 26, 35) system detects this address and responds to the first terminal 11 with its own MAC address.

After the response, since the packet generated in the first terminal 1 reaches the virtual inline system, access control is performed by analyzing the information and data of the packet.

In addition, in order to prevent the terminals on the same network, that is, the second or third terminal, from transmitting the packet directly with the first terminal 11, the packet is directly sent to the first terminal 11 among the terminals on the network. The virtual in-line system responds to the MAC address of the specific terminal 12 or 13 to be delivered with its own MAC address so that all input and output for communication with the first terminal 11 to be controlled can be performed. The packet passes through the security sensor.

3 is a control flowchart of a virtual inline network security method according to the present invention.

As shown, the virtual inline network security method according to the present invention, through the first process (S100) and whether the specific equipment is subject to the application of the virtual path setting, and through the first process (S100) When it is determined that the specific device is suitable for the virtual path setting target, the second process (S200) of setting the virtual path of the application target device, the third process (S300) of checking whether the traffic of the set virtual path is suitable for the security policy, and And a fourth step (S400) of checking whether the traffic of the virtual path is harmful traffic and a fifth step (S500) of separating the system of the virtual path from the network.

In the first step (S100), the security device analyzes the MAC address request packet generated from the terminal device, and extracts a source address and a media access control (MAC) address.

The source address, the MAC address, the operating system (OS) of the client, and the state of the other terminal are determined to determine whether the virtual path target system.

In the second step (S200), if it is determined whether the target is a virtual path, the virtual path system responds to the MAC address request generated by the target system with its MAC address in order to set the virtual path.

Even when another terminal requests the MAC address of the system that is the target of the virtual path, the virtual path system sends an ARP packet to its MAC address.

In the third step (S300), the protocol, the destination address, the destination port, etc. of the packet generated in the target system is examined to determine whether or not the pass.

In the fourth step (S400), the data content of the packet generated in the target system is checked to determine whether harmful traffic is included.

In the fifth step (S500), the system that harmful traffic is found in the fourth step (S400) periodically sends a fake MAC address response packet to the system to completely block the communication of the harmful system.

4 is a control flowchart illustrating in detail the first process S100 of FIG. 3.

As shown, the first step (S100) comprises the steps of monitoring the MAC request packet (S110), extracting the source address and the MAC address of the ARP Request packet (S120), and the extracted Adding a source address and a MAC address of an ARP request packet to a node table (S130); and estimating an operating system (OS) for the extracted node (S140). .

Table 1 below shows an example of the node table.

TABLE 1

 [Applicable Table]

MAC address IP address OS user time How it works 00: 13: D4: 04: BD: C0 192.168.1.2 Linux permit 00: 0F: EA: 6D: 71: 2A 192.168.1.1 Windows XP Kimpd Virtual path 00: 90: FB: 09: 0F: 17 192.168.1.3 Windows XP ANYTIME Isolation

So if you look at this,

The first step (S100) of determining whether a specific device is subject to the application of the virtual path configuration monitors the MAC request packet on the network, and extracts the source address and the MAC address of the ARP request packet. do.

In addition, the source address and MAC address of the extracted ARP request packet are added to the node table, and the operating system (OS) for the extracted node can be recognized.

FIG. 5 is a control flowchart illustrating the second process S200 of FIG. 3 in detail.

As shown, the second step (S200), the step of setting the operation method to the node of the node table (S210), the step of connecting a security policy to the node of the node table (S220), and the operation method And responding to all MAC address requests of the " virtual path " node with the MAC address of the virtual path system (S230).

 Table 2 below shows an example of the supplementary policy table.

TABLE 2

Destination address Destination port slot Action 192.168.2.1 TCP / 80 ANYTIME ALLOW 10.10.1.1 TCP / 25 ANYTIME ALLOW 10.10.1.1 UDP / 53 ANYTIME ALLOW

So if you look at this,

If it is determined through the first step (S100) that the specific device is suitable for the virtual path setting target, the second step (S200) of setting the virtual path of the application target device, the operation method is set to the node of the node table, It attaches a security policy to the nodes in the node table and responds to every MAC address request of the "virtual path" node established by the operation method with the MAC address of the virtual path system.

FIG. 6 is a control flowchart illustrating the third process S300 of FIG. 3 in detail.

As shown, the third process (S300), the step of extracting a protocol, a destination address and a destination port number, etc. from the packet flowing into the virtual path system (S310), and whether the correspondence with reference to the security policy table Determining step (S320).

Determining whether or not the correspondence with reference to the security policy table (S320), the step of determining the correspondence (S321), and if the determination step (S321), if it is allowed in the step of forwarding (forwarding) the packet (S322) And, if it is rejected in the determination step (S321) further comprises the step (S323) of discarding the packet.

So if you look at this,

The third step (S300) of checking whether the traffic of the established virtual path conforms to the security policy is performed by extracting a protocol, a destination address, a destination port number, etc., from a packet flowing into the virtual path system, and then referring to the security policy table. Determine the response.

If the result of the determination indicates that the packet is allowed, the packet is forwarded. If the result of the determination indicates that the packet is rejected, the packet is discarded.

FIG. 7 is a control flowchart illustrating the fourth process S400 of FIG. 3 in detail.

As shown, the fourth process (S400) is the step of extracting the payload (payload) of the packet (S410), the step of referring to the malicious / malicious database (DB) (S420), and the payload of the packet (S430) determining whether the payload and the harmful / malignant database (DB) match, and if the payload and the harmful / malignant database (DB) of the packet match in the determination step (S430), the node. Changing (blocking) an operation method to a table (S440); and transmitting the packet if the payload of the packet does not match the malicious / malignant database (DB) in the determination step (S430). (S450), and a step (S460) for creating an audit record log for the action.

If you look at its behavior,

The fourth step (S400) of checking whether the traffic of the virtual path is harmful traffic extracts the payload of the packet, refers to the harmful / malignant database, and then checks the payload of the packet. Determine if the harmful / malignant database is consistent.

As a result of the determination, if the payload of the packet matches the harmful / malignant database (DB), the operation method is changed (blocked) in the node table, and as a result of the determination, the payload and the harmful / If the malicious database does not match, the packet is transmitted. In addition, a test record log of the corresponding action is created.

FIG. 8 is a control flowchart illustrating the fifth process S500 of FIG. 3 in detail.

As shown, the fifth step (S500) is to identify the malicious node with reference to the operation mode of the node table (S510), and periodically transmitting a false MAC address response packet to the malicious node (S520), Sending a packet to a false MAC address for all MAC address requests of the malicious node (S530).

So if you look at its behavior,

In a fifth process S500 of separating the virtual path system from the network, the malicious node is classified by referring to the operation mode of the node table and periodically transmits a false MAC address response packet to the malicious node.

And for all MAC address requests of the malicious node will send a packet to the false MAC address.

As described above, the present invention is a virtual in-line technology, and the actual physical configuration is not in-line, but the physical in-line by allowing communication parties to communicate via security equipment. line) the same security behavior as the configuration.

In addition, the present invention, when installing the security equipment in the network, it is possible to install the equipment without network interruption, and when the equipment failure does not occur in the conventional network (Single point of failure) occurs, the authorized network equipment is virtual The advantage of eliminating speed lag is that it allows communication without going through in-line configured equipment.

In addition, the present invention has the advantage that can control the communication and traffic between the terminals in the same network as well as outgoing traffic through the security equipment.

In addition, the present invention has the advantage that can effectively block the system that generates the traffic and the use control of unauthorized systems in a plurality of internal networks.

Claims (7)

In the virtual inline network security method, A first step (S100) of determining whether a specific device is subject to the application of the virtual path setting; A second step (S200) of setting a virtual path of the application target device when it is determined that the specific device is suitable for the virtual path setting target through the first step (S100); A third step (S300) of checking whether the traffic of the set virtual path conforms to a security policy; A fourth step (S400) of checking whether the traffic of the virtual path is harmful traffic; And And a fifth step (S500) of separating the system of the virtual path from the network. The method of claim 1, The first step (S100) comprises the steps of monitoring a MAC request packet (S110), extracting a source address and a MAC address of the ARP Request packet (S120), and the extracted ARP request (Request) Adding a source address and a MAC address of the packet to a node table (TABLE); and a step (S140) of estimating an operating system (OS) for the extracted node (S140). Network security method. The method of claim 1, The second process (S200), the step of setting the operation method to the node of the node table (S210), the step of connecting the security policy to the node of the node table (S220), and the "virtual path set by the operation method; "In response to all the MAC address requests of the node with the MAC address of the virtual path system (S230), characterized in that the virtual inline network security method. The method of claim 1, The third step S300 may include extracting a protocol, a destination address, a destination port number, etc., from a packet flowing into the virtual path system (S310), and determining whether to correspond with reference to a security policy table (S320). Virtual inline network security method, characterized in that consisting of. The method of claim 4, wherein Determining whether or not the correspondence with reference to the security policy table (S320), the step of determining the correspondence (S321), and if the determination step (S321), if it is allowed to forward the packet (forwarding) ( And S322), and discarding the packet (S323) when the determination is made (S321). The method of claim 1, The fourth process (S400) comprises the steps of extracting the payload (payload) of the packet (S410), the step of referring to the malicious / malicious database (SDB) (S420), payload (payload) and harmful of the packet Determining whether the malicious database (DB) matches (S430), and if the payload of the packet coincides with the harmful / malignant database (DB) in the determining step (S430), a method of operation is performed in the node table. Changing (blocking) (S440) and transmitting the packet (S450) if the payload of the packet does not match the malicious / malignant database (DB) in the determination step (S430), Virtual in-line network security method comprising the step (S460) of creating a test record log of the action. The method of claim 1, The fifth step (S500) is a step of identifying a malicious node by referring to the operation mode of the node table (S510), periodically transmitting a false MAC address response packet to the malicious node (S520), and And transmitting the packet to the false MAC address for every MAC address request (S530).

Images