KR20060040405A - The blocking apparatus and method of undesirable traffic with home gateway in home network - Google Patents

Abstract

The present invention relates to an apparatus and method for blocking harmful traffic in a home network for protecting home network terminals from harmful traffic such as harmful sites, harmful contents and viruses, hacking, etc. using a home gateway.

The harmful information blocking device is located at the home gateway and checks the packet transmitted from the subscriber and received from the Internet, and if it is determined to be harmful, the packet filtering device drops the packet and transmits a blocking message to the subscriber. It consists of the harmful information DB necessary to determine the traffic and the central harmful information DB management system which provides the real time to the filtering system by realizing this harmful information DB.

The present invention is to provide a smooth Internet use and home networking by protecting the existing home network terminal from harmful traffic from the outside by using a home gateway as described above.

Home Gateway, Harmful Traffic Blocker, Packet Filtering Device

Description

Harmful traffic blocking device and method using home gateway in home network {THE BLOCKING APPARATUS AND METHOD OF UNDESIRABLE TRAFFIC WITH HOME GATEWAY IN HOME NETWORK}             

1 is a block diagram showing a conventional harmful information blocking method,

2 is an overall configuration diagram of a harmful traffic blocking system installed inside a home gateway according to the present invention;

3 is an overall configuration diagram of a harmful traffic blocking system installed outside the home gateway applied to the present invention;

4a is a flowchart of a normal packet when web access is allowed outside the home gateway according to the present invention;

4b is a flowchart of a normal packet when web access is allowed inside a home gateway according to the present invention;

5a is a flowchart of a harmful traffic packet when a web connection is blocked outside the home gateway according to the present invention;

5b is a flowchart of a harmful traffic packet when web access is blocked inside a home gateway according to the present invention;

Figure 6 is a block diagram showing the configuration of a harmful traffic blocking system for blocking harmful traffic applied to the present invention,

7 is an overall flowchart of a harmful traffic blocking method using a home gateway according to the present invention.

※ Brief description of reference numerals

10: home gateway 20: harmful traffic blocking system

30: Internet 40: Harmful Information DB Management System

The present invention relates to a method and apparatus for protecting terminals of a home network such as a computer, a TV, a refrigerator, and the like from harmful traffic such as harmful sites, harmful contents, viruses, hacking, and the like. It features.

At present, the Internet is growing phenomenal enough to change the existing lifestyle and thinking paradigm. The nations around the world have established high-speed networks, developing various multimedia contents, and competing in the telecommunication market based on the establishment of a knowledge-based society. It is competing to revitalize the use of the Internet through generations. In addition, the home network world is expanding, in which all home appliances constituting the home network are not only interconnected through various interfaces but also freely connected to the external Internet. Users can also remotely control various electronics and computers connected to the home network using the Internet.

However, at present, home network terminals connected to the home network are exposed to defenselessness from harmful traffic such as hacking, viruses, harmful contents, and the like.

In order to solve this problem, according to the completion report of the Internet unhealthy site construction system (XRobot 1.0) developed by the Information and Communication Ethics Committee with the conventional technology (December 31, 1999), it can be used on client PCs such as homes, school libraries, and companies. In order to effectively block unhealthy information by installing a blocking program (NCApatrol Proxy 1.0) such as AntiX, Nox, Guardian Angel, a method of efficiently constructing unhealthy site information that is the basis of the blocking program is described.

As shown in FIG. 1, harmful information blocking software is installed on a user's client PC at home, or a harmful information system is installed in a LAN of each school or group to perform access control for each LAN. As a result, users have to download the update patch or purchase a new hazard prevention program and install a hazard blocking program (NCApatrol Proxy 1.0) on the client PC. Blocking the harmful information site is unprotected, and since the administrator must manage the harmful information blocking server at school or group, it wastes a lot of time and money, and has a problem of having a dedicated administrator separately.

Accordingly, in the present invention, as described above, it is created in order to solve the conventional problems, and the home which blocks and analyzes harmful traffic which is introduced into various devices connected to the home network from the Internet or transmitted from the home network device in advance in the home gateway It is to provide an apparatus and method for blocking harmful traffic using a gateway.

In addition, the quality of blocking service can be dramatically improved by classifying harmful information DB required for harmful traffic by harmful traffic category and updating and providing services in real time from central DB management system.

As a constitutional means for achieving the above object of the present invention, the harmful traffic blocking device using a home gateway in a home network according to the present invention,

A harmful traffic blocking system consisting of a packet filtering device located inside and outside the home gateway and inspecting a packet transmitted from a subscriber and received from the Internet to determine that the packet is harmful and dropping the packet through a packet redirect device and sending a blocking message to the subscriber. and,

It includes a harmful information DB management system that establishes various harmful information DBs necessary to determine whether harmful traffic of packets received from the harmful traffic blocking system is present, and makes the harmful information DB present and provides it to the filtering system in real time. do.

In addition, the harmful traffic blocking method using a home gateway in a home network,

A first step of receiving, by the packet redirecting apparatus, the harmful traffic blocking system;

Simultaneously transmitting to each analysis module to determine whether there is harmful traffic in the received packet;

Each harmful traffic analysis module comprises three steps of returning the result back to the distribution module when the harmful traffic is harmful traffic compared to the harmful DB maintained, managed and updated;

The distribution module determines whether the corresponding packet is harmful according to a result received from each analysis module, and discards the packet and stores a log if the packet is harmful;

If the received traffic is not harmful, step 5 of forwarding the packet;

Each time a packet is received, steps 1 to 5 are repeatedly performed.

Hereinafter, an apparatus and method for preventing harmful traffic using a home gateway in a home network according to the present invention will be described in detail with reference to the accompanying drawings.

Figure 2 shows the overall configuration of the harmful traffic blocking system installed inside the home gateway applied to the present invention, Figure 3 is an overall configuration diagram of the harmful traffic blocking system installed outside the home gateway applied to the present invention, which It consists of harmful traffic blocking system installed inside and outside the home gateway module and harmful information DB management system.

The harmful information management DB system 40 is automatically updated for each category to block the harmful DB required by the harmful traffic blocking system, and automatically updates the harmful traffic blocking system installed in each home network in real time or periodically.

In order to quickly determine the harmfulness of packets received by the harmful traffic blocking system, the harmful DB is divided into a harmful site DB, a harmful content DB, a virus DB, and a hacking pattern DB.

The harmful traffic blocking system 20 is configured as a module system or a separate system outside the home gateway to analyze the harmful site, harmful content access requested from the subscriber to extract the HTTP URL and harmful content access data and extract the data. Based on the data, it is judged whether there is harmful content access by comparing with the harmful DB, and analyzes the packet flowing from the external internet and transmitted from the home network device to determine whether the packet is harmful traffic such as virus, hacking, etc. In comparison, the packet filtering device 22 discards the packet and transmits a block message to the subscriber when it is determined that the traffic is harmful.

Here, as shown in Figs. 4A to 5B, the packet filtering device 22 reads the packet input from the packet redirecting device 21 which redirects when harmful traffic is inputted, and then, in the harmful information DB management system. Checks whether the specified filtering target is allowed to determine whether web access is allowed.

In addition, the packet redirecting device 21 is located inside a home gate, and receives a packet flowing from the Internet and transmitted from a home network device within the home gateway, and LSP (l3; Layered Service) of Windows Socket Ver.2. By using a provider module or a PCAP (Portable Packet Capture Library), a packet is captured (sniffed) from a physical interface connected to a home gateway and the Internet, and the packet is transmitted to a packet filtering device.

4A is a flowchart of a normal packet when web access is allowed outside the home gateway according to the present invention, and FIG. 4B is a flowchart of a normal packet when web access is allowed inside the home gateway applied to the present invention. 5A is a flowchart of a harmful traffic packet when the web connection is blocked outside the home gateway applied to the present invention, and FIG. 5B is a flowchart of a harmful traffic packet when the web connection is blocked inside the home gateway applied to the present invention. to be.

That is, this shows the operation of the packet filtering device installed inside and outside the home gateway, and if the packet is a normal packet instead of the harmful packet designated by the harmful information DB management system inside and outside the home gateway, the packet is forwarded through the packet filtering device to the Internet. Become,

Harmful Information If the DB management system determines that the packet is harmful, the packet is discarded, the blocking message is sent to the subscriber, and the blocking log is recorded.

Figure 6 is a block diagram showing the configuration of a harmful traffic blocking system for blocking harmful traffic in the home gateway applied to the present invention.

The harmful traffic blocking system 20 is configured in an independent modular manner for each harmful traffic category to block various harmful traffic that can be newly generated and defined in the future, and configured to have future expandability. Also, in order to prevent the subscriber's Internet performance degradation due to packet inspection, it is configured to determine whether packets are harmful at the same time for each module instead of sequential scanning.

That is, the packet receiving / transmitting module 23 performs packet capturing from the home gateway module or the network device, and transmits the captured packet to the packet distribution module.

Then, the packet distribution module 24 simultaneously transmits the contents of the packet to each module that determines whether the traffic is harmful, and each module compares the received database with the received database to determine whether there is harmful traffic. Configure to

Here, the harmful site analysis module is linked with the harmful site DB, the harmful content analysis module is linked with the harmful content DB, the virus blocking module is linked with the virus pattern DB, and the hacking blocking module is configured with the hacking pattern DB.

7 is a flowchart illustrating a harmful traffic blocking method using a home gateway according to the present invention.

First, the harmful traffic blocking system receives a packet transmitted from the home network terminal through the packet redirecting device and flows in from the Internet (S10), and the packet is transmitted through the packet distribution module to the harmful site analysis module, the harmful content analysis module, and the virus blocking module. In addition, the hacking blocking module and other harmful traffic are transmitted to each packet analysis module (S20).

At this time, if the packet analysis module attempts to access the web (S30), extract the URL from the packet and compare the extracted URL with the harmful site DB updated in real time from the central DB server (S80),

When the packet attempts to access the content (S40), the content request information is extracted from the packet, and the extracted content is compared with the harmful content DB (S90).

On the other hand, if the packet does not correspond to the above case (S50 ~ S70), by analyzing the pattern of each packet and find the pattern of the packet and compared with the pattern DB that stores the pattern of the harmful packet (S100), If it is determined that the packet is harmful, such as a virus, hacking (S110), discards the packet and transmits a blocking message to the subscriber and records the blocking log (S120).

At this time, when attempting to access the harmful information as a result of the comparison (S130), to send a blocking message to the customer terminal, to record the corresponding log (S120), receives the packet analysis result (S140), drop the packet ( Drop) (S150).

On the other hand, if the comparison result of the packet analysis result is not attempt to access harmful information (S140), it is determined to be a normal packet and packet forwarding is performed (S150).

As described in detail above, the home network is exposed to many harmful traffic generated from the Internet unprotected, and for the smooth home networking in the future, it is necessary to secure the home network from such harmful traffic.

To this end, by installing a harmful traffic blocking system located as a separate system inside or outside the home gateway that serves as a gateway to the home network, it protects the home network terminals from various harmful traffic and also serves as a criterion for determining harmful traffic. By updating the data in real time from the central DB management server, it is possible to use more secure home networking.

Claims (5)

In blocking harmful traffic such as hacking, viruses, harmful content, etc. flowing to the home network terminal connected to the home network, The packet filtering device 22 which is located inside or outside the home gateway and examines the packet received from the subscriber and received from the Internet, and if it is determined to be a harmful packet, drops the packet through the packet redirect device 21 and transmits a blocking message to the subscriber. Hazardous traffic blocking system 20 consisting of, The harmful information DB management system 40 constructs various harmful information DBs necessary to determine whether harmful packets are received from the harmful traffic blocking system, and makes the harmful information DB currently available to the filtering system in real time. Harmful traffic blocking device using a home gateway in a home network, characterized in that the configuration. The harmful traffic blocking system 20 is modularized for each harmful traffic type such as a harmful site analysis module, a harmful content analysis module, a virus blocking module, a hacking blocking module, and the module to determine whether a packet is harmful. Harmful traffic blocking device using a home gateway in the home network, characterized in that the simultaneous search instead of sequential search. 2. The packet redirection apparatus 21 according to claim 1, wherein the packet redirecting apparatus 21 is located inside the home gate and transmits packets from the Internet and transmitted from the home network device to the LSP (l3) of Winsock 2 (l2) in the home gateway. Using a Layered Service Provider (PAP) module or a Portable Packet Capture Library (PCAP) to capture (sniff) packets from the physical interface between the home gateway and the Internet and send the packets to a packet filtering device. Harmful traffic blocking device using home gateway in home network The system of claim 1, wherein the harmful information DB management system 40 includes a harmful site DB, a harmful content DB, a virus pattern DB, and a hacking pattern DB, and is maintained, managed, and updated for each harmful traffic category. Harmful traffic blocking device using home gateway. In the method of blocking harmful traffic, A first step of receiving, by the packet redirecting apparatus, the harmful traffic blocking system; Simultaneously transmitting to each analysis module to determine whether there is harmful traffic in the received packet; Each harmful traffic analysis module comprises three steps of returning the result back to the distribution module when the harmful traffic is harmful traffic compared to the harmful DB maintained, managed and updated; The distribution module determines whether the corresponding packet is harmful according to a result received from each analysis module, and discards the packet and stores a log if the packet is harmful; If the received traffic is not harmful, step 5 of forwarding the packet; The harmful traffic blocking method using a home gateway in a home network, characterized in that the steps 1 to 5 are repeatedly performed every time a packet is received.

Images