KR20060117693A - Web security method and apparatus therefor - Google Patents

Abstract

A web security method and a device thereof are provided to prevent hacking in a web application platform, recover contents stored in a web server by promptly checking alternation of the contents, and promptly recover the web server in case that the web server is abnormally operated. A reference information manager(1007) receives, stores, and manages reference information used for determining whether hacking trial or non-permitted information is included in web request/response information. A web request information receiver(1001) receives the web request information from a user computer. A web request information checker(1002) determines whether the hacking trial is included in the received web request information based on the reference information. A web response information generator(1003) generates the web response information corresponding to the web request information in the case of no hacking trial. A web response information checker(1004) determines whether non-permitted contents are included in the generated web response information based on the reference information.

Description

Web security method and apparatus therefor

1 is a reference diagram for explaining the overall concept of the present invention.

2 is a schematic flowchart of a preferred embodiment of a web security method according to the present invention.

3 is a data flow diagram of a preferred embodiment for checking the web request information in the web security method according to the present invention.

FIG. 4 is a flowchart of a preferred embodiment of the denial of service attack (DOS) attack inspection method of step 304 of FIG.

FIG. 5 is a flowchart of a preferred embodiment of a buffer overflow attack checking method of step 803 of FIG. 3.

FIG. 6 is a flowchart of a preferred embodiment of the parameter checking method of step 308 of FIG. 3.

7 is a data flow diagram of a preferred embodiment for checking the web response information in the web security method according to the present invention.

8 is a data flow diagram of a preferred embodiment for checking for content tampering in a web security method in accordance with the present invention.

9 is a data flow diagram of a preferred embodiment for monitoring a web server among other web security methods in accordance with the present invention.

10 is a block diagram of a preferred embodiment of a web security server according to the present invention.

The present invention relates to a web security method and apparatus (web security server), and more particularly, to a security method in a web application stage and a web security server to which the method is applied.

Conventionally, security of a web server includes a firewall, an intrusion prevention system (IPS), an intrusion detection system (IDS), and the like.

However, the cause of the accident such as the alteration of a website running on a web server or the loss of important information by a hacker can be presumed to be infected with malware such as adware or spyware. Is mostly due to a web application.

However, even if you have double-layered firewalls with conventional firewalls, IDS, IPS, VPNs, etc., the web server should open at least 80 or 443 ports of the firewall for external communication so that mail and web services can be provided. Hackers are looking for vulnerabilities in these web applications.

Conventional network firewalls usually operate at the network level and allow access to sites only for specified protocols and services. In other words, a network firewall can be likened to a fence that forces people who want to access a site to enter only through the front door. However, the features of these network firewalls are difficult to prevent from hacking and require the ability to focus on the application level to maintain the accuracy of requests arriving at the Web site. In other words, a tool is needed to ensure that the user who enters through the front door is doing the normal thing.

Experts said, "The existing security is the security that solves the vulnerabilities related to the 3 ?? 4 layer mainly when the network is divided into 7 layers." Since the security solutions are firewalls, intrusion detection systems, virtual private networks (VPNs), and the like, the problem of web application security is not the problem of the 3rd or 4th layer of the network but of the 7th layer. I can't solve the problem. " In addition, the existing firewall does not detect web traffic encrypted with SSL, etc., and the encoding technology of the general application passes through the firewall of the existing network. Even if an existing network firewall can examine encrypted and encoded traffic, the problem is that the design of the current network firewall was designed before the web because it was designed in the early 1990s. The design of the network firewall was before the creation of a commercially successful web browser, so it was difficult to update products that were built on older architectures that were 10 years old and up-to-date with the latest business applications.

And one of the most important problems is the fact that no matter how advanced the existing network firewall is, it is not enough to improve the performance of the application. Experts say, "Definite security is essential, but security should not be gained at the expense of application performance." "Traditional firewalls, by their very nature, can only be bottlenecks in application performance, making it difficult to improve application performance or availability. That's why we need specialized web security products. "

And the International Web Security Association's Open Web Application Security Project (OWASP) (www.owasp.org) said, "An institution adopting a web application means that anyone in the world can send HTTP requests. This is because it is one of the normal HTTP requests. "" Firewalls, filtering solutions, server security solutions, and IDS are difficult to filter, and even SSL-enabled Web sites can use a separate set of Web requests that arrive in encrypted tunneling. It's often accepted without checks, and we should be aware that web applications are a perimeter of security, and don't overlook the fact that as the number, size, and complexity of web applications increases, so do the front lines to defend. " have. OWASP's 10 Most Critical Web Application Security Vulnerabilities include a lack of input validation, poor access control, weak authentication and session management, and buffer overflows. As mentioned earlier, these vulnerabilities are difficult to effectively defend with existing security products. Therefore, there is an urgent need for security tools dedicated to web applications, specialized defense products specialized for web applications.

An object of the present invention is to provide a web security method and a device (web security server) to which the method is applied.

The web security method according to the present invention for solving the above problems is based on (a) a criterion for determining whether a web server that provides predetermined web page information to a user computer through the Internet has a hacking attempt by a predetermined method. Receiving and storing information, (b) the web server receiving predetermined web request information from the user computer, (c) the web server predetermined method to the web request information based on the reference information Determining whether a hacking attempt is included; (d) if the web server determines that there is no hacking attempt, generating web response information corresponding to the web request information; and (e) The web server examines the web response information based on the reference information to determine whether or not predetermined content is included. And (f) the web server transmitting the web response information to the user computer when the web response information does not include the disallowed content. It features.

In addition, in the step (e) or the step (f) of the web security method, the web request information includes a hacking attempt of a predetermined method in the determination result of the step (c), or the determination result of the (d) step When the response information includes the content that is not allowed, when determining whether to block the access of the user's computer according to a predetermined criterion, the web information of the pre-stored blocking web page is read and the user is read. It may be characterized in that the transmission to the computer and to cut off the connection to the user computer, or to block the session connected to the user computer, wherein step (e) or (f) is the reference of step (a) The information further includes mobile phone number or email address information of an administrator who manages the web server. If the web request information includes a hacking attempt of a predetermined method as a result of step (c) or if the web response information includes the content that is not allowed, the administrator's portable And sending a text message (SMS) to a phone number or sending an email to the email address to indicate that the hacking attempt or the unacceptable content is included in the web response information. Step (e) or step (f) includes a hacking attempt of a predetermined method in the web request information as a result of the determination of step (c), or the web response information is not allowed in the web response information as a result of the determination of step (d). If the content is not included, the IP (IP) address assigned to the user computer is extracted, and the extracted IP address of the user computer And the trusted IP information which is an absolutely reliable IP address which is set in advance, and the web response information may be transmitted to the user computer when both are identical.

In addition, if there is the same web request information from a predetermined user computer having the same IP within a predetermined time in the reference information of step (a) of the web security method, it is determined that there is a DOS hack attempt. DOS reference information is included, and the step (c) may include determining whether the web request information from the user computer corresponds to the DOS attempt based on the DOS reference information. And

In the reference information of step (a) of the web security method, the total size of web request information that does not cause a buffer overflow, the allowable size of a URL, the allowable size of a query string, the allowable size of a parameter variable name, and the parameter input. Buffer overflow reference information including at least one information of an allowable size of a value is included. In step (c), whether the web request information corresponds to a buffer overflow attempt based on the buffer overflow reference information. It may be characterized in that it comprises a step of determining whether,

The reference information of step (a) of the web security method includes UEL reference information, which is URL information allowable by the web security server, and the step (c) includes the web based on the UEL reference information. It may be characterized in that it comprises the step of determining whether the request information is a service request for the allowable UAL.

In addition, the reference information of step (a) of the web security method includes a parameter name applicable to a URL allowed by the web security server, an input value length of a parameter, a type of a parameter input value, a signature method classification, and a parameter. Parameter reference information including at least one of the use of the information is included, and step (c) determines whether the parameter included in the web request information is a normal parameter based on the parameter reference information. The reference information of the step (a) includes a parameter name applicable to a URL allowed by the web security server, an input value length of a parameter, a type of a parameter input value, and the like. Permitted range of parameter value, signature type classification, use of parameter, web request information When the web page is dynamically generated, parameter reference information including at least one or more pieces of predetermined data which should not be included in the web page is included, and the step (c) is based on the parameter reference information. The method may include determining whether the parameter included in the web request information is a normal parameter.

The step (c) of the web security method is previously stored in the web server corresponding to the first cookie when the web request information includes information stored in a first cookie which is a predetermined cookie. It is determined whether the first cookie is modified by comparing the second cookie and the first cookie, and the step (f) sends the cookie corresponding to the web request information or the web response information to the web server. The method may further include storing.

In addition, the reference information of step (a) of the web security method includes predetermined header information that is not allowed to be included in the web response information, header change reference information showing other header information to change the header information, and the web response information. Contents inspection criteria information about contents which are not allowed to be included in the contents and contents transformation criteria information which is contents to be replaced by being replaced with the contents inspection criteria information, and the step (e) is included in the web response information. It is determined whether the header information and the content information correspond to headers or contents which are not allowed based on the header change criterion information and the content inspection criterion information. The step (f) includes the web response information. When the header information is not allowed, the header information is changed based on the header change criterion information. If it does have the content in a Web response information it is not allowed may be characterized in that it further comprises the step of changing a content to be allowed of the content based on the modified reference information kentencheu,

In addition, the step (a) of the web security method generates and stores the content management information generated by reading the information on the creation date, size, and content of the contents stored in the web server, and (g) the web server Generating content management information corresponding to the contents stored by the user at regular intervals and checking whether the contents have been tampered with by comparing with the previously stored content management information in step (a); The web server may further include recovering the modulated contents based on the content management information stored in the step (a) when the contents are modified as a result of the checking in the step (g).

The web security server according to the present invention for solving the above problems is not allowed for the hacking attempt or security of a predetermined method on the web request information received from a predetermined user computer via the Internet or the web response information corresponding to the web request information. A reference information management unit which receives and stores reference information, which is a reference for determining whether information is not included, a web request information receiving unit receiving predetermined web request information from the user computer, and based on the reference information A web request information inspecting unit which determines whether a hacking attempt of a predetermined method is included in the web request information provided from the web request information receiving unit, and the web request information inspecting unit determines that there is no hacking attempt Generating web response information corresponding to the request information. A web response information generation unit, a web response information inspection unit and the web response that examine whether the web response information provided from the web response information generation unit includes predetermined content based on the reference information; And a web response unit for transmitting the web response information to the user computer when the web response information does not include the disallowed content.

The web response unit of the web security server may block access to the user computer when the web request information includes a hacking attempt of a predetermined method or when the web response information includes the disallowed content. In the case of blocking and determining according to a predetermined predetermined criterion, the web information of the pre-stored blocked web page is read and transmitted to the user computer and the connection with the user computer is blocked, or a session connected to the user computer is blocked. It may be characterized in that the blocking,

The web security server reads and stores information on the generation date, size, and content of the stored contents to generate and store the generated content management information, and whether the contents stored by the web server are modified at regular intervals. The method may further include a content inspecting and restoring unit configured to inspect the information and restore the modulated contents based on the pre-stored stored content management information when the contents are modified. The web request information inspecting unit and the web response information inspecting unit may receive and store the determination result information, and may further include a statistics processing unit for generating statistical information of the stored information at regular intervals.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a reference diagram for explaining the overall concept of the present invention.

The user computer 101 refers to a computer of a user who receives a web service by accessing the web security server 102 through the Internet.

The web security server 102 receives web request information (web request information, information for requesting information on a predetermined web page) from the user computer 101, and hacks a predetermined method based on predetermined reference information. After determining whether an attempt is included, generating web response information corresponding to the web request information, and determining whether the information that should not be disclosed for security is included in the web response information based on the above standard information. Only if there is no function to provide a web service to the user computer 101.

The management server 103 stores in advance the reference information set in the web security server 102 when there are a plurality of the web security server 102, and provides the web security server 102 with the function or the above. After receiving the result of the operation of the web security server 102 and storing it, if necessary, it can perform a function of providing statistics to the administrator of the web security server.

2 is a schematic flowchart of a preferred embodiment of a web security method according to the present invention.

First, the web security server provides reference information as a reference for determining whether the web request information is hacked from the administrator or the management server 103 or whether the web response information includes content or information that should not be allowed for security. Receive and store it to build the information database (201).

Thereafter, upon receiving 202 web request information for requesting predetermined web page information from a predetermined user computer 101, whether the hacking attempt of the predetermined method is included in the web request information based on the above reference information. Inspect (203).

It is determined whether or not there is no abnormality as a result of the inspection (204), and if there is no abnormality, web response information corresponding to the above web request information is generated (205), and based on the above criteria information, the web response information should not be allowed. After checking whether the information or the content is included (206), it is determined whether or not the above inspection result is abnormal (207). If there is no abnormality, the web response information is transmitted to the user's computer (209).

If there is an error in step 204 or 207 above, whether or not to block access to the user's computer is stored in advance of predetermined setting information (for example, the IP address assigned to the user's computer is trusted by the IP address). If not, determine whether to block access to the user's computer or block the session (208), and if so, transmit the information of a predetermined blocked webpage to the user's computer (210). ) To block access to the user's computer or to block the session.

FIG. 3 is a data flow diagram of a preferred embodiment for checking the web request information in the web security method according to the present invention, which illustrates step 203 of FIG. 2 in more detail.

First, upon receiving predetermined web request information from the user's computer, a predetermined setting mode (for example, canceling the security function, setting the security function, etc.) is checked (301), and the security function is not set, but only the monitoring function is set. The web request information is stored in a log file (302).

If the setting information in the check mode (ie, the security function setting) in step 301 is read, the IP address information to be blocked in advance is unconditionally blocked, and the IP address and the user's computer assigned to the IP address are read. The IP address is extracted and it is checked whether the IP address assigned to the user's computer is registered as the blocked IP.

After that, if the IP address assigned to the user's computer is not registered as the blocked IP address in step 303, the previously stored DOS-based information (for example, DOS that repeatedly requests the same web request information more than a predetermined number of times within a predetermined period of time). It is read as an attack and checks whether the web request information is a DOS attack based on the DOS criterion information (304).

DOS (Denial of service) attack is a hacking method that prevents the web server from operating normally by making a web request that exceeds the processing capacity to a specific web server. If the preset number of times is exceeded, it can be determined that there is a DOS attack.

Then, in step 304, if the web request information is not a DOS attack, the overflow reference information is read to check whether the web request information corresponds to a buffer overflow attack (305).

A buffer overflow attack is a method that manipulates the return address of a program by inputting data exceeding the amount of buffer allocated to the memory of a specific web server through web request information, and ultimately, a code desired by a hacker. In this case, the term "buffer" is a space in which data necessary for processing a program is temporarily stored, and includes a stack area and a heap area of memory. In the present invention, the total length of the web request information, the total length of all URLs included in the web request information, the total length of the query string, the total length of the parameter variables, and the total length of the parameter input values are set to the preset criteria. If it exceeds the predetermined length, it can be determined that there is a buffer overflow attack.

If it is not a buffer overflow attack in step 305 above, it is checked whether the URL information included in the web request information is allowed in the URL (306), and the URL checking is the URL included in the web request information. By comparing the URL information with the URL information allowable in the specific web server, it is checked whether the URL information included in the web request information is included in the allowable URL. The yuel check may further check information such as a domain, a URL, a method, the presence or absence of a parameter, the number of parameters, and the like.

In the case of the UAL test result of 306 above, it is checked whether the cookie information has been tampered with by comparing the previously stored cookie information and the cookie information stored in the user's computer (307).

Cookies are temporary files that contain information generated when a user's computer accesses a website on a particular web server. The cookie is smaller than 4KB in size, and a cookie is usually created to help Internet users access the homepage. The first time you visit, a cookie is created that records your username and password, and you can quickly connect to the site the next time you go. Cookies are usually stored on the user's computer, which can be used for hacking by accessing resources that are not allowed by tampering with the values stored in the cookie.

In the present invention, the same information as the cookie stored on the user's computer is stored separately in the web server, and when there is a connection from the user's computer, the information stored in the cookie on the user's computer and the web server are stored. Validate by comparing cookie information.

In the case where the cookie is not tampered with in step 307, it is checked whether the parameter included in the web request information is normal based on the parameter reference information. The parameter is usually ASP and PHP. Or URL after the URL information that calls a web page written in HTML or the like, and then a predetermined variable and a value inputted to the variable are designated. Parameter checking is based on web request information based on the parameter name applicable to URL (URL) allowed for a specific web server, parameter input value length, parameter input value type, signature type classification, parameter usage, etc. Compared with the information of the included parameters, it is determined that there is a hacking attack when the information of the parameters included in the web request information deviates from the above reference information.

When the parameter information included in the web request information of the parameter check result of the above 308 is normal, it is checked whether the hidden variable included in the web request information is normal based on the hidden variable reference information (309). In other words, the hidden variable check extracts the hidden variable value included in the web request information received by a specific web server, and compares the hidden variable value previously stored to the value of the hidden variable included in the above web request information. Determine and examine whether it has been tampered with.

On the other hand, the order of performing the steps of 304 to 309 may be changed as necessary, and only some of the above steps may be applied if necessary.

If there is an error in steps 303 to 309, it is determined whether to block access of the user computer, which is performed in step 1008 of FIG.

FIG. 4 is a flowchart of a preferred embodiment of the denial of service attack (DOS) attack inspection method of step 304 of FIG.

First, an IP address (Internet protocol address) of the counterpart computer that has sent the received web request information is extracted (401). Thereafter, the number of web request information received from the extracted IP address is accumulated in the internal storage and summed (402). Thereafter, the DOS reference information is read and the number of web requests from the IP address is determined to be greater than the reference included in the DOS reference information to determine whether it is a DOS attack (403).

If it is determined in step 403 that a DOS attack is determined, the IP address is registered as an access blocking IP address (404).

In the case of the IP address without the web request within the predetermined time (for example, 1 second), the request accumulation count is reset to 0 (405).

On the other hand, if it is determined in step 403 that it is not a DOS attack, it immediately moves to step 450.

FIG. 5 is a flowchart of a preferred embodiment of a buffer overflow attack checking method of step 803 of FIG. 3.

First, after reading the overflow reference information, the total length of the received web request information is measured to determine whether the total length of the measured web request information is smaller than the allowable total length of the web request information included in the overflow reference information. It is determined whether or not (501).

As a result of the above determination, if the total length of the received web request information is within the allowable range, the header length of the received web request information is measured, and then the header length of the measured web request information is included in the overflow reference information. It is determined whether the request information is smaller than the allowed header length (502).

After that, if the header length of the received web request information is within the allowable range, the length of the query string included in the web request information is measured, and the length of the measured query string overflows the above. It is determined whether the length is smaller than the length of the allowed query string included in the reference information (503).

Here, the query string refers to a statement that performs a predetermined operation (for example, creating and deleting a table, storing and retrieving predetermined data, etc.) in a database.

As a result of the determination in step 503, if the length of the extracted query string is within an allowable range, the length of the parameter variable name of the web request information and the length of the input value assigned to the variable name are measured, and the measured length is It is determined whether the parameter included in the overflow reference information is within the size of the input value (504). As a result, if the measured parameter variable and its magnitude (length) are within the allowable range, the overflow check is completed.

On the other hand, if the total length of the web request information, the header length, the query string length, the length of the parameter variable name, and the length of the input value allocated to the parameters exceed the allowable range in steps 501 to 504, the step 708 of FIG. Move.

FIG. 6 is a flowchart of a preferred embodiment of the parameter checking method of step 308 of FIG. 3.

First, input value information allocated to parameter variables included in the received web request information is extracted (601). Thereafter, the parameter reference information stored in advance is read out, and characters corresponding to the XSS (Cross Site Scripting) signature included in the parameter reference information read out among the extracted input values (for example, '<', '>' And the like) are determined (602). As a result of the determination, if a character corresponding to an XS signature is not included in the extracted input value, a signature character corresponding to SQL injection included in the parameter reference information among the extracted input values (for example, For example, '.WWinsert. *', '. * WWdelete. *', '.WWselect. *', '.WWupdate. *', '. * WW-. *', '. * WWPRINT. *', ' . * WWUsers. * ','. * WWUNION. * ',' * WWSET. * ','. * WW @. * ','. * WW +. * ','. * W tweets. * W =. * ', Etc.) is determined (603).

If it is determined that the extracted injection value does not include the Escrow injection signature character, the extracted input value does not correspond to an input value type of the parameter variable on the parameter reference information. It is determined whether the value (for example, the form of the input value of the predetermined parameter variable is a character or a number that is not corresponding to it) in step 604, and if there is no abnormality, the parameter inspection is completed.

On the other hand, if the type of the extracted input value in step 602 to step 604 above corresponds to the SMS signature on the parameter reference information, or corresponds to the SK injection signature character, or is an input value of an unacceptable form, 708 of FIG. Go to step.

FIG. 7 is a data flow diagram of a preferred embodiment for checking the web response information in the web security method according to the present invention, which shows steps 205 and 206 of FIG. 2 in more detail.

If there is no abnormality after step 309 of FIG. 3, the web security server generates the web response information corresponding to the web request information (1001), and then checks the header information included in the web response information and should not be included in the header. Whether or not the information is included is determined based on the preset header change reference information, and if the information is not allowed in the header, the header information is modified 1002 by changing it to any other information or deleting it. Thereafter, it is checked whether the web response information is an error page (1003), and if it is an error page, the process returns to step 1001. If the check result of the step 1003 is not an error page, the content included in the web response information is inspected (1004), which checks whether the content that should not be disclosed is included in the web response information. Inspection is based on the standard information. Content not disclosed herein may include, for example, directory information of a web server.

Thereafter, the information that should not be disclosed as a result of the inspection of step 1004 is included in the web response information. However, when the information is changed to other information and provided to the user's computer, predetermined content transformation criteria information (for example, The contents of the above contents may be changed based on information that should not be published, such as directory information of a web server, with guidance information such as "The requested information is not disclosed for security reasons."

Thereafter, the cookie information and the hidden variable information corresponding to the web response information are stored to be used at step 307 or 309 of FIG. 3.

On the other hand, when the web response information is a content for downloading a predetermined file, it is determined whether the downloaded file is a download prohibited file or not based on previously stored download prohibited file information.

Then, based on the above test result, it is determined whether to block access to the user's computer or to disconnect the session established with the user's computer (1008). The IP address of the user's computer is always read by reading a reliable IP address. If the same read IP address is always trusted, the web response information is transmitted to the user's computer regardless of the test result. However, if the IP of the user's computer is different from the trusted IP address at all times, and the result of the above check is to request hacking or disallowed contents, the IP address of the user's computer is stored in the attacking IP address database.

If it is determined in step 1008 that the web response information may be transmitted, the web response information is transmitted to the user computer (709). If it is determined in step 1008 that the access of the user computer is blocked, it is stored in advance. Block Web page information is read and transmitted to the above user's computer, and the user's computer is blocked.

When the user's computer is blocked from access, the above information is transmitted to the mobile phone of the administrator of the web security server, which is stored in advance, using a text message, or transmitted to the administrator's e-mail address (710). Then save the above to a log file.

On the other hand, the log file is used as the basic information of the statistical analysis of the attack number, attack method, etc. per predetermined period (711).

8 is a data flow diagram of a preferred embodiment for checking for content tampering in a web security method in accordance with the present invention.

When the web security server is instructed to scan the contents stored in the web server by the administrator, the web security server searches all the stored contents and stores the contents management information including information on the creation date, size, content location, and the contents of the contents. Create and store (801). On the other hand, if the administrator has changed the predetermined content receives the information about it from the administrator to update the content management information (802).

Thereafter, the web security server inspects the contents stored by the web security server based on the above contents management information at predetermined intervals, and checks whether the contents have been tampered with (803). In operation 804, the contents tampering and restoration are transmitted to the administrator using the administrator's mobile phone number or email address information.

9 is a data flow diagram of a preferred embodiment for monitoring a web server among web security methods in accordance with the present invention.

The web security server checks whether the web security server has failed (901) based on preset web server failure determination criteria information (e.g. whether the web server process is running or not). If a failure occurs, the server recovers the failure of the web security server according to the web server failure recovery reference information (for example, restarting the web server) (902). Thereafter, the failure and recovery information of the web security server is transmitted to the administrator's mobile phone or e-mail address and stored in the log file (903).

10 is a block diagram of a preferred embodiment of a web security server according to the present invention. The web security server according to the present invention includes a web request information receiving unit 1001, a web request information inspecting unit 1002, a web response information generating unit 1003, a web response information inspecting unit 1004, and a web responding unit 1005. The apparatus may further include a content inspection and recovery unit 1006, a reference information management unit 1007, and a statistical processing unit 1008.

The web request information receiving unit 1001 performs a function of receiving predetermined web request information from the user computer.

The web request information inspecting unit 1002 performs a function of determining whether a hacking attempt of a predetermined method is included in the web request information provided from the web request information receiving unit based on the reference information, and the web request information inspecting unit ( The method for checking the web request information at 1002 is the same as the method described in detail with reference to FIG. 3.

The web response information generator 1003 performs a function of generating web response information corresponding to the web request information when it is determined that there is no hacking attempt.

The web response information inspecting unit 1004 inspects the web response information provided from the web response information generating unit on the basis of the reference information to determine whether or not predetermined content is included. The detailed method of checking the web response information in the web response information inspecting unit 1004 is the same as the method described with reference to FIG. 4.

The web response unit 1005 transmits the web response information to the user computer when the web response information does not include the disallowed content, as a result of the determination of the web response information inspection unit. If the web request information includes a hacking attempt of a predetermined method or if the web response information includes the disallowed content, whether or not to block access to the user computer is determined based on a predetermined criterion. Therefore, in case of judging and blocking, the web information of the pre-stored blocking web page is read and transmitted to the user computer, and the connection with the user computer is blocked, or the session connected with the user computer is blocked.

The content inspecting and restoring unit 1006 generates and stores content management information generated by reading information on the generation date, size, and content of the stored contents, and whether the contents stored therein are modulated at regular intervals. Inspects the content management information based on the content management information, and restores the modulated contents based on the previously stored stored content management information when the contents are modified.

The reference information management unit 1007 determines whether web request information received from a predetermined user computer via the Internet or web response information corresponding to the web request information includes hacking attempt of a predetermined method or information that is not allowed for security. It receives the standard information that is the standard for determining the data and stores and manages it.

The statistical processor 1008 receives and stores the determination result information of the web request information inspector and the web response information inspector, and generates statistical information of the stored information at regular intervals.

So far we looked at the preferred embodiment according to the present invention in detail. The scope of the present invention is not limited to the above-exemplified embodiments, and if the technical spirit of the present invention is applied, all will be said to belong to the scope of the present invention.

Meanwhile, the methods according to the present invention can be produced by a computer program that can be executed by a computer, and the above computer programs can be recorded on a computer-readable recording medium (CD, hard disk, various memories, etc.).

According to the present invention, it is possible to prevent hacking of a web application stage, which could not be prevented by a conventional security method for a web server. There is an effect that can be, and if the web server does not operate normally, there is an effect that can be restored immediately.

Claims (17)

(a) receiving and storing reference information, which is a reference for determining whether a hacking attempt is attempted by a web server providing predetermined web page information to a user computer through the Internet; (b) the web server receiving predetermined web request information from the user computer; (c) determining, by the web server, whether a hacking attempt of a predetermined method is included in the web request information based on the reference information; (d) generating, by the web server, web response information corresponding to the web request information when it is determined that there is no hacking attempt; (e) checking, by the web server, the web response information based on the reference information to determine whether predetermined content is included; And (f) when the web server determines that the web response information does not include the content that is not allowed, transmitting the web response information to the user computer. Web security method. The method of claim 1, wherein step (e) or step (f) If the web request information includes a hacking attempt of a predetermined method as a result of the step (c), or if the web response information includes the content that is not allowed, the user is requested. In the case of judging whether to block the access of the computer according to a predetermined criterion, the web information of the pre-stored blocked web page is read and transmitted to the user computer, and the access to the user computer is blocked, or the user is blocked. Web security method characterized by blocking the session connected to the computer. The method of claim 2, wherein step (e) or (f) The reference information of step (a) further includes mobile phone number or email address information of the administrator managing the web server, If the web server includes a hacking attempt of a predetermined method in the web request information as a result of the determination in step (c), or if the web response information includes the content not allowed in the web response information as a result of the determination in the step (d) And sending a text message (SMS) to the administrator's mobile phone number or sending an email to the email address to indicate that the hacking attempt or allowed content is included in the web response information. Web security method. The method of claim 2, wherein step (e) or (f) If the determination result of the step (c) includes a hacking attempt of a predetermined method in the web request information, or if the web response information includes the disallowed content, the determination result of the step (d) includes: When the IP address assigned to the user's computer is extracted, and the extracted IP address of the user computer is compared with the trusted IP information which is a predetermined absolute IP address, the two are the same. And the web response information is transmitted to the user computer. The method of claim 1, The reference information of step (a) includes DOS reference information that determines that there is a DOS hack attempt when the same web request information is received from a predetermined user computer having the same IP within a predetermined time. , The step (c) includes determining whether the web request information from the user computer corresponds to the DOS attempt based on the DOS criterion information. The method of claim 1, The reference information of step (a) includes the total size of web request information that does not cause a buffer overflow, the allowable size of URL, the allowable size of query string, the allowable size of parameter variable name, and the allowable size of parameter input value. Buffer overflow reference information including at least one piece of information is included, The step (c) includes determining whether the web request information corresponds to a buffer overflow attempt based on the buffer overflow reference information. The method of claim 1, The reference information of step (a) includes the UEL reference information which is URL information allowable by the web security server, The step (c) includes determining whether the web request information is a service request for an allowable UAL based on the UEL reference information. The method of claim 1, The reference information of step (a) includes at least one of a parameter name applicable to a URL allowed by the web security server, a length of a parameter input value, a type of a parameter input value, a signature type classification, and whether a parameter is used or not. Parameter reference information including one or more pieces of information is included. The step (c) includes determining whether a parameter included in the web request information is a normal parameter based on the parameter reference information. The method of claim 1, The reference information of step (a) includes the parameter name applicable to the URL (URL) allowed by the web security server, the length of the parameter input value, the type of the parameter input value, the allowable range of the parameter value, the signature method classification, the parameter. Is used, when the web page corresponding to the web request information is dynamically generated, the parameter reference information including at least one or more information of predetermined data that should not be included in the web page is included, The step (c) includes determining whether a parameter included in the web request information is a normal parameter based on the parameter reference information. The method of claim 1, In the step (c), when the web request information includes information stored in a first cookie which is a predetermined cookie, a second cookie which is previously stored in the web server corresponding to the first cookie Comparing the cookie with the first cookie to determine whether the first cookie has been tampered with, The step (f) further comprises the step of storing a cookie corresponding to the web request information or web response information on the web server. The method of claim 1, The reference information of step (a) is not allowed to be included in the predetermined header information that is not allowed to be included in the web response information, header change reference information which shows other header information for changing the header information, and the web response information. The content inspection criteria information on the content that does not and the content deformation criteria information which is the content to be replaced by being replaced with the content inspection criteria information, In the step (e), it is determined whether the header information and the content information included in the web response information correspond to a header or content which is not allowed based on the header change criterion information and the content inspection criterion information. In the step (f), when the header information included in the web response information is not allowed as a result of the determination, the header information is changed based on the header change criterion information, and the content included in the web response information is allowed. If not, further comprising the step of changing the content to the allowable content based on the content transformation criterion information. The method of claim 1, The step (a) is to generate and store the content management information generated by reading the information on the creation date, size, content of the contents stored in the web server, (g) the web server generates content management information corresponding to the contents stored by the user at regular intervals and checks whether the contents have been tampered with by comparing the previously stored content management information in the step (a). step; (h) if the contents of the web server are modified as a result of the check in the step (g), the web server may further include recovering the modulated contents based on the content management information stored in the step (a). Web security method. A computer-readable recording medium having recorded thereon a computer program capable of executing the method of any one of claims 1 to 12. Criteria for determining whether web request information received from a user's computer through the Internet or web response information corresponding to the web request information includes a hacking attempt of a predetermined method or information that is not allowed for security A reference information management unit which receives the information and stores and manages it; A web request information receiver configured to receive predetermined web request information from the user computer; A web request information inspecting unit determining whether a hacking attempt of a predetermined method is included in the web request information provided from the web request information receiving unit based on the reference information; A web response information generation unit generating web response information corresponding to the web request information when it is determined that there is no hacking attempt as a result of the determination of the web request information inspection unit; A web response information inspecting unit which checks whether the web response information provided from the web response information generating unit includes content which is not allowed based on the reference information; And And a web response unit configured to transmit the web response information to the user computer when the web response information does not include the disallowed content. Web security server. 15. The method of claim 14, wherein the web response unit If the web request information includes a hacking attempt of a predetermined method or if the web response information includes the disallowed content, whether to block access to the user computer is determined according to a predetermined standard. In the case of blocking, the web security server may read web information of a pre-stored blocking web page and transmit it to the user computer and block access to the user computer, or block a session connected to the user computer. The method of claim 14, Generates and stores contents management information generated by reading information about creation date, size, and contents of stored contents, and inspects whether contents stored by the user are modified at regular intervals based on the contents management information And if the contents are modified as a result of the inspection, a content inspection and recovery unit for restoring the contents modified based on the previously stored stored content management information. The method of claim 14, And a statistical processor configured to receive and store the determination result information of the web request information inspector and the web response information inspector, and to generate statistical information of the stored information at regular intervals.

Images