KR20060044494A - Network management system and network management server of co-operating with authentication server - Google Patents

Abstract

The present invention relates to a network management system in cooperation with an authentication server, the user terminal to control the access rights to the network devices constituting the network. The network management system communicates with at least one network device connected to the network, and stores and manages the registration information set in the network device and the security policy applied to each user, and interworks with the management server. When an authentication request is generated from a user terminal, the authentication server may determine whether to allow the user terminal to access the network and access authority to the corresponding network devices by using the registration information and the security policy stored in the management server. The network device includes a firewall server, a VPN server, an IDS or IPS server, and the like.

According to the present invention, it is possible to control the access rights to the network devices for each user who wants to access the network through the authentication server, it is possible to enforce a stronger security policy for the network.

Network, security, authentication server, firewall

Description

NETWORK MANAGEMENT SYSTEM AND NETWORK MANAGEMENT SERVER OF CO-OPERATING WITH AUTHENTICATION SERVER}

1 is a configuration diagram schematically showing an authentication system according to the IEEE 802.1x standard.

FIG. 2 is a flow chart showing the operation contents between the entities of the authentication system of FIG.

3 and 4 are each a configuration diagram illustrating a centralized authentication method and a distributed authentication method.

5 is a block diagram exemplarily illustrating areas to which a network management system according to an embodiment of the present invention may be applied.

Figure 6 is a block diagram showing the overall network management system according to a preferred embodiment of the present invention.

7 is a block diagram generally showing another embodiment of a network management system according to the present invention.

8 is a flowchart for sequentially explaining the overall operation of the network management system according to the present invention.

9 is a flowchart for sequentially explaining the operation of the network management system of FIG.

<Explanation of symbols for the main parts of the drawings>

100: requestor

110: certifier

120: authentication server

600: authentication server

610: management server

640, 642: user terminal

The present invention relates to a network management system capable of managing the network devices constituting the network as a whole. More specifically, the authentication server performs authentication for a user and whether to provide access rights to the network device for each user. The present invention relates to a network management system that can secure a network and efficiently perform management of network devices by determining.

1 is a diagram schematically illustrating an authentication system according to the IEEE 802.1x standard as a whole, and FIG. 2 is a diagram sequentially illustrating an authentication process. Referring to FIGS. 1 and 2, at present, the IEEE 802.1x standard standard defines three entities: a supplicant 100, an authenticator 110, and an authentication server 120.

Here, the requestor 100 is an entity for providing authentication information of the user to the authenticator 110 and requesting authentication, and examples thereof include wired and wireless terminals to be connected to a network. The authenticator's initial port status when the requestor requests authentication from the authenticator is set to uncontrolled port status, where the requestor and authenticator communicate only as an Extensible Authentication Protocol (EAP). This is possible.

Meanwhile, the authenticator 110 transmits the authentication information and the authentication request received from the requestor 100 to the authentication server 120. When the authentication is successful from the authentication server, the authenticator 110 transmits an authentication success message to the requestor and uses the port of the authenticator. Switch to Controlled port status. An example of such an authenticator may be one of an access point, a router, a switch, and the like.

In addition, the authentication server 120 is an entity that receives an authentication request for the requestor 100 from the authenticator 110 and determines whether to authenticate. The authentication server 120 stores and manages authentication information about the user in an internal database, or an external entity. It communicates with and receives authentication information about the user to determine whether to authenticate. At this time, the protocol used between the authentication server 120 and the authenticator 110 is not defined in IEEE 802.1x, but it is recommended to use the protocol used in the general AAA (Authentication, Authorization, Accounting) server. . Accordingly, the RADIUS (Remote Authentication Dial-In User Service) protocol is becoming an industry standard (De-Facto Standard).

In case of communication between authenticator and authentication server using RADIUS protocol, network access authority control for user is determined by authentication server's internal authentication algorithm and RADIUS attributes that can be transmitted in authentication success message. This can be implemented by using vendor and vendor specific RADIUS attributes (VSA).

Meanwhile, authentication methods in a network to which a plurality of devices are connected may be broadly classified into a central authentication method and a distributed authentication method. 3A is a diagram illustrating a network configuration according to a centralized authentication scheme, and FIG. 3B is a diagram illustrating a network configuration according to a distributed authentication scheme.

When the network is configured in accordance with the centralized authentication method as shown in FIG. 3, the authentication server is centrally installed to centralize user authentication management and thus have administrative advantages. However, if the authentication attempts are distributed to several places, there are restrictions on the speed of the network, and performance decreases due to an increase in server load.

In addition, in the distributed authentication scheme as shown in FIG. 4, a main authentication server is installed at a central location, connected to a network to centrally manage resources and databases, and requires authentication to reduce the load of the central authentication server. You will handle TLS sessions and key management locally. In this way, when the distributed authentication method is used, the efficiency of the network is increased about 5 times compared to the centralized authentication method, and stability is increased even when the local user is authenticated.

The Internet, meanwhile, is a network of networks using the Transmission Control Protocol / Internet Protocol (TCP / IP) developed by the US Department of Defense, which is connected to thousands of networks and millions of hosts worldwide. It was initially used as an academic and research network connecting schools, research institutes, etc., and recently expanded to commercial networks. Although the TCP / IP network protocol structure guarantees interworking to provide heterogeneous and efficient interconnection to information resources around the world, there are various security problems due to the open source of UNIX systems and communication utilities. Cases of damage by intruders continue to increase.

Examples of damage to the system or network of the Internet sign-up agency include not only the use of network intrusion through Telnet, but also various illegal activities on the system after the intrusion and the distribution of illegal programs such as the Internet Worm. Is being reported. The ways to prevent and prevent such violations hierarchically by type are being researched, and the development of practical security tools for the corresponding layers, security policies against security incidents, development of network applications that provide various security services, etc. Research and development is active in many fields.

As such, as the Internet develops, security and management of various systems and networks are emerging as important issues. Accordingly, the present invention proposes a system that can more powerfully manage the resources of the network.

SUMMARY OF THE INVENTION An object of the present invention for solving the above problems is to provide a network management system capable of granting access rights to network devices constituting a network for each user in association with an authentication server.

Another object of the present invention is to provide a network management server that can store and manage registration information for network devices constituting a network in association with an authentication server or set network devices to desired registration information.

Still another object of the present invention is to provide a network management system that can set network devices constituting a network to desired registration information through an authentication server and can efficiently control the network devices.

A feature of the present invention for achieving the above-described technical problem, in connection with the authentication server, relates to a network management system for the user terminal to control the access rights to the network devices constituting the network,

A management server which communicates with at least one network device connected to a network, and stores and manages registration information set in the network device and a security policy applied to each user;

When the authentication request is generated from the user terminal in cooperation with the management server, determining whether to allow the user terminal to access the network and access authority to the corresponding network devices using the registration information and the security policy stored in the management server. By providing an authentication server, it is possible to control the access rights to the network devices for each user who wants to access the network, so that a stronger security policy can be performed for the network.

Here, the network device includes a firewall server, and the management server stores and manages registration information set in the firewall server and a security policy for the firewall applied to each user, and the authentication server is a user terminal. When the authentication request is generated from, it is preferable to perform a firewall on the user terminal according to the security policy corresponding to the user stored in the management server.

In addition, the network device is a virtual private network (Virtual Private Network) server, the management server stores and manages the registration information set in the virtual private network server and the security policy for the virtual private network applied for each user, the authentication server When the authentication request is generated from the user terminal, it is preferable to apply a virtual private network to the user terminal according to the security policy corresponding to the user stored in the management server.

In addition, the network device is an access point or switch, the management server stores and manages the registration information for the access point or switch registered in the network and the security policy for the access point or switch applied for each user, and the authentication When an authentication request is generated from a user terminal, the server may determine whether to allow access to a specific access point or switch to the user terminal according to a security policy corresponding to the user stored in the management server. .

In addition, the authentication server is a network device is a server of an intrusion prevention system (Intrusion Prevention System) or intrusion detection system (Intrusion Detection System), the management server is registered information about the intrusion prevention system or intrusion detection system and for each user A security policy to be applied is stored and managed. When an authentication request is generated from a user terminal, the authentication server generates an intrusion prevention system or an intrusion detection system for the user terminal according to a security policy corresponding to the user stored in the management server. It is desirable to determine whether or not to operate.

The network management system according to another aspect of the present invention further includes a registration setting unit for inputting registration information for a network device into an authentication server, and transmits registration information inputted to the registration setting unit to the security server. The management server is capable of two-way communication with the network devices, and transmits the registration information received from the authentication server to the network device.

The network management system according to another aspect of the present invention further includes a registration setting unit for inputting registration information for a network device in a management server, wherein the management server is capable of two-way communication with the network devices. The registration information input by the registration setting unit is transmitted to the corresponding network device, or the registration information is transmitted to the authentication server at the request of the authentication server.

According to another aspect of the present invention, a network management server includes a database for storing and managing registration information and security policy applied to each user for at least one network device constituting a network, and in response to a request from an authentication server. The registration information of the network device stored in the database and the security policy applied for each user are transmitted to the authentication server.

The network management server may further include a registration setting unit for inputting registration information to be set for the network device, and transmits the registration information input to the registration setting unit to the corresponding network device.

In addition, the network device preferably includes at least one of a server of an intrusion detection system (IDS), a server of an intrusion prevention system (IPS), a server of a virtual private network (VPN), and a server of a firewall.

Hereinafter, with reference to the accompanying drawings will be described in detail the overall configuration and operation of the network management system according to an embodiment of the present invention.

5 is a block diagram illustrating various network devices to which a network management system according to the present invention can be applied. As shown in FIG. 5, a firewall server, an intrusion prevention system (IPS) server, an intrusion detection system (IDS) server, a virtual private network (VPN) server, and the like. The network device is connected to the network management system according to the present invention, thereby securing the network. On the other hand, if the device or system that can be connected to the network, even if the network device not illustrated in Figure 5, it is natural that it can be managed by the network management system according to the present invention.

6 is a block diagram conceptually illustrating a network management system according to a preferred embodiment of the present invention. Referring to FIG. 6, the network management system according to the present invention includes user terminals 640 and 642 for authenticating a user, an authentication server 600, and a management server 610 linked with the authentication server. Other examples of devices that can be connected to a network include a virtual private network (VPN) 620, a firewall 630, internal and external networks 650 and 654, an e-mail server 654, and the like. Hereinafter, the operation of each component constituting the network management system according to the present invention will be described in detail.

First, the management server 610 is provided with a database for storing and managing registration information set in at least one or more network devices connected to the network, and a security policy applied to each user, and from the authentication server 600. Send the relevant information to the authentication server as requested. Here, the management server may receive two-way communication with network devices to receive registration information from the corresponding network devices.

Next, when the authentication request is generated from the user terminals 640 and 642 via the switch, the authentication server 600 based on the authentication information (for example, user ID, password, etc.) transmitted from the user terminal. Perform authentication on. When the authentication server succeeds in authenticating the user, the authentication server receives registration information about the network device and a security policy applied to the user from the management server, and according to the received information, the network access authority and network for the user. Grant access to the device.

8 is a flowchart for sequentially explaining the overall operation of the network management system according to the present invention. Referring to FIG. 8, first, the management server stores and manages registration information set in network devices connected to a network (step 800). Next, when there is an authentication request from the user, the authentication server receives the security policy and related information applied to the user from the management server (step 810), and uses the information received from the management server for the user. The authentication is performed and it is determined whether to provide access to network devices according to the received security policy (step 820).

According to the present invention, the authentication server can control access rights to network devices for each user who wants to access the network, and as a result, a stronger security policy can be performed for the network.

Hereinafter, the network devices to which the network management system according to the present invention can be applied will be described as an example, and its operation and connection relationship will be described in detail. However, the network device described in the present specification is described by way of example, and it is natural that other network devices not described herein may be applied to the network management system according to the present invention.

First, a device to which the network management system according to the present invention can be applied may be a firewall server. The firewall system for internet security provides efficient security services by allowing access to authorized Internet services according to the security policy of the corresponding authority and thoroughly blocking traffic due to unauthorized services. In other words, the firewall system prevents illegal traffic from outside and permits only authorized or authorized traffic to protect the internal network of the corresponding institution. In general, such firewall systems provide proactive security measures to reduce the risk zone while ensuring transparency as possible to network users.

The management server of the network management system according to the present invention stores and manages the registration information set on the firewall server in the database and the security policy for the firewall applied to each user. In addition, when an authentication request is generated from a user terminal, the authentication server applies a firewall to the user terminal according to a security policy corresponding to the user stored in the management server. As a result, the security policy of the firewall can be performed for each user according to the present invention.

Next, a device to which the network management system according to the present invention may be applied may be a virtual private network (VPN) server. Virtual private network refers to a network solution that can establish a wide area network (WAN) at low cost by connecting point-to-point using a tunneling protocol based on cryptography without a separate private network. Such a virtual private network does not require a separate equipment or software, thereby reducing costs compared to a general leased line service, and is suitable for communication between the headquarters and branch offices or branch offices throughout the country. However, since it is based on the Internet's standard protocol, the security of information is not clear.

In addition, a virtual private network refers to all technologies for securely transmitting data in an insecure network, and encryption and encapsulation become basic components of a VPN.

The management server of the network management system according to the present invention stores and manages the registration information set in the virtual private network server in the database and the security policy for the virtual private network applied for each user, and the authentication server receives an authentication request from the user terminal. When this occurs, the virtual private network is applied to the user terminal according to the security policy corresponding to the user stored in the management server. As a result, according to the present invention, the security policy of the virtual private network can be executed for each user.

Next, a device to which the network management system according to the present invention may be applied may be an access point or a switch. The user terminal that wants to access the network using wired or wireless accesses the authentication server through a switch or an access point.

The management server of the network management system according to the present invention stores and manages the registration information set in the access point or the switch in the database and the security policy for the access point or the switch applied for each user. When the authentication request is generated, the access authority to the access point or the switch is controlled for the user terminal according to the security policy corresponding to the user stored in the management server.

9 is a flowchart sequentially illustrating a process of controlling access authority to an access point (AP) or a switch (SW) by a network management system according to the present invention. Hereinafter, a process of controlling access authority will be described in detail with reference to FIG. 9.

First, the authentication server registers information about the AP and SW in the database (step 900), and then transmits and synchronizes information about the AP and SW registered in the authentication server to the management server (step 910). Next, the management server generates a configuration file for the AP and SW, and transmits to the DHCP server (step 920). The DHCP server sets AP and SW according to the contents of the configuration file received from the management server (step 930). The management server receives the information on the AP or SW connected from the Simple Network Management Protocol (hereinafter referred to as " SNMP ") server (step 940), and transmits the information on the received AP or SW to the database. The information is analyzed by comparing with the registered information. If the information about the received AP or SW is not registered in the database, it is determined to be an illegal AP, and as a result, the information is transmitted to the authentication server (step 950).

According to the present invention, it is possible to search for an illegal access point and to block the access of the illegal access point.

Next, a device to which the network management system according to the present invention may be applied is a server of an intrusion prevention system (IPS) or an intrusion detection system (IDS). The intrusion prevention system is a security solution that stops abnormal traffic by finding an attack signature in the network and automatically taking a predetermined action. In addition, the intrusion prevention system may automatically control the abnormal behavior of the factor by detecting and automatically blocking the information leakage caused by the abnormal behavior of the server. In addition, the intrusion detection system is a system for detecting abnormal use, misuse, and abuse of a computer in real time, and the intrusion prevention system alone can cope with illegal behavior (for example, confidential leakage, etc.) and external hacking by an internal user. Therefore, in order to block all internal and external information flow in real time, tracking of hacker intrusion patterns and monitoring of harmful information are necessary.

The management server of the network management system according to the present invention stores and manages the registration information set in the IDS or IPS server in the database and the security policy for IDS or IPS applied to each user, and the authentication server authenticates from the user terminal. When a request occurs, IPS or IDS is applied to a user terminal according to a security policy corresponding to the user stored in the management server. As a result, according to the present invention, it is possible to perform a security policy of IPS or IDS for each user.

Meanwhile, in another embodiment of the present invention, the management server includes a registration setting unit for inputting registration information about a network device, thereby allowing an administrator to input registration information about the network device through the management server. . Also, the management server transmits the registration information input through the registration setting unit to the corresponding network device, and the network device sets the received registration information in its own system.

On the other hand, in another embodiment of the present invention, the authentication server has a registration setting unit for inputting the registration information for the network device, so that the administrator can input the registration information for the network device through the authentication server do. Also, the authentication server transmits the registration information input through the registration setting unit to the management server, the management server transmits the received information back to the corresponding network device, and the network device sets the received registration information in its own system. Do it.

Although the present invention has been described above with reference to preferred embodiments thereof, this is merely an example and is not intended to limit the present invention, and those skilled in the art do not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications which are not illustrated above in the scope are possible. For example, in the embodiment of the present invention, the type of network device that can be connected to the network management system, the data items stored in the database of the management server, the communication method between the management server and the network device, etc. may be improved. Various modifications can be made in consideration of the processing speed and the like. And differences related to such modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

By the network management system according to the present invention, the authentication server may grant access rights to the network device for each user. In addition, according to the present invention, the authentication server can control access to all network devices connected to the network. In addition, according to the present invention, the authentication server can control the access to the network device to the user at the same time performing the authentication for the user.

As a result, the network management system according to the present invention provides a powerful and convenient network control and management function by the authentication server and the management server.

Claims (14)

In the network management system in conjunction with the authentication server, the user terminal controls the access rights to the network devices constituting the network, A management server in communication with at least one network device connected to a network to store and manage registration information set in the network device and a security policy applied to each user; When an authentication request for a user is generated from a user terminal, an authentication server for determining whether the user terminal is allowed to access the network and access authority for the corresponding network devices using the registration information and security policy stored in the management server. And a network management system for controlling access rights to network devices for each user who wants to access the network. The network management system of claim 1, wherein the authentication server provides a dynamic host configuration protocol service to users or network devices registered in a network. The network device of claim 1, wherein the network device comprises a firewall server. The management server stores and manages the registration information set in the firewall server and the security policy for the firewall applied for each user. The authentication server, if an authentication request is generated from the user terminal, the network management system, characterized in that to perform a firewall for the user terminal in accordance with the security policy corresponding to the user stored in the management server. The method of claim 1, wherein the network device is a virtual private network (Virtual Private Network) server, The management server stores and manages the registration information set in the virtual private network server and the security policy for the virtual private network applied for each user. And when the authentication request is generated from the user terminal, the authentication server applies a virtual private network to the user terminal according to a security policy corresponding to the user stored in the management server. The network device of claim 1, wherein the network device is an access point or a switch. The management server stores and manages registration information for an access point or switch registered in a network and a security policy for an access point or switch applied for each user. When an authentication request is generated from the user terminal, the authentication server determines whether to allow access to a specific access point or switch for the user terminal according to a security policy corresponding to the user stored in the management server. Characterized by a network management system. The apparatus of claim 1, wherein the authentication server is a server of an intrusion prevention system or an intrusion detection system. The management server stores and manages registration information about the intrusion prevention system or the intrusion detection system and a security policy applied for each user. When the authentication request is generated from the user terminal, the authentication server determines whether to operate the intrusion prevention system or the intrusion detection system for the user terminal according to the security policy corresponding to the user stored in the management server. Network management system. The method according to any one of claims 1 to 6, wherein the authentication server further comprises a registration setting unit for inputting registration information for a network device, and transmits the registration information input to the registration setting unit to the management server. , The management server is capable of bidirectional communication with the network devices, the network management system, characterized in that for transmitting the registration information received from the authentication server to the network device. The management server according to any one of claims 1 to 6, further comprising a registration setting unit for inputting registration information for the network device, The management server is capable of bidirectional communication with the network devices, and transmits the registration information input by the registration setting unit to the corresponding network device, or transmits the registration information to the authentication server at the request of the authentication server. Characterized by a network management system. A database for storing and managing registration information and at least one security policy applied for each user for at least one network device constituting the network; In response to a request from an authentication server, transmitting registration information about the network device stored in the database and a security policy applied for each user to the authentication server. The network management server of claim 9, further comprising a registration setting unit configured to input registration information to be set for the network device. And transmitting the registration information inputted to the registration setting unit to the corresponding network device. The network management server of claim 9, wherein the network management server is capable of two-way communication with at least one network device constituting the network. The network management server of claim 9, wherein the network management server receives registration information about a network device from the authentication server, and transmits the received registration information to the corresponding network device. The network device according to any one of claims 9 to 12, wherein the network device is at least one of a server of an intrusion detection system (IDS), a server of an intrusion prevention system (IPS), a server of a virtual private network (VPN), and a server of a firewall. Network management server comprising the above. The network management server of claim 9, wherein the network management server receives registration information on an access point or switches from the authentication server, and stores and manages the registration information in a database. If information on the access point or switch connected to the network is input, it is compared with the information registered in the database, If the access point or the switch does not match the registration information, the access point or switch is determined to be an illegal access point, and the network management server is blocked.

Images