KR20070109527A - Securtioy system and method for controlling a traffic using the same - Google Patents

Abstract

A security system and method for controlling a traffic using the same are provided to share traffic, state, policy, environment information with a different traffic control module in all duplicated network structures, thereby performing synchronization between network service modules and continuously providing network services without disconnecting a network. A security system includes a traffic module, a link detecting unit, a managing unit, an information transceiving control unit, and a packet mirroring control unit. The traffic module(10) monitors a traffic which is inputted to a network. The link detecting unit(22) monitors a link connection state of the network. The managing unit(28) arbitrarily changes a different link state of the network according to partial link state information of the network. The information transceiving control unit(26) receives security policy information or transmits the security policy information. The packet mirroring control unit transceives information about sessions and packets.

Description

Security system and traffic control method {SECURTIOY SYSTEM AND METHOD FOR CONTROLLING A TRAFFIC USING THE SAME}

1 is a general redundant network diagram.

2 is a configuration diagram in which the abnormal traffic control module is provided on the network in FIG.

3 is a block diagram of a security system according to an embodiment of the present invention.

FIG. 4 is a diagram illustrating a network equipped with the security system of FIG. 3.

* Description of the symbols for the main parts of the drawings *

10: abnormal traffic control module 12: network interface

14 input packet copy unit 16 packet mirroring interface

18: session processing unit 20: abnormal traffic control unit

22: link inspection unit 24: engine condition inspection unit

26: information transmission and reception control unit 28: management unit

30: policy application

The present invention relates to a network security system having a redundant structure, and more particularly, to a security system and a traffic control method for controlling to prevent network service disconnection caused by abnormal network and equipment.

In general, the network uses a redundancy system using two modules for survivability and reliability. That is, when one module cannot continuously provide network service due to a failure of the active module and the active module that currently provide network service or other reasons, the one module is continuously authorized to provide network service. Using a standby module.

1 schematically illustrates such a generally redundant network configuration.

As shown, there is provided a first top / bottom network module (1) (3) as an active module and a second top / bottom network service module (5) (7) as a standby module to provide a totally redundant network configuration. do. According to this network configuration, when the first upper / lower network module (1) (3) fails to provide the network service, the second upper / lower network module (5) (7) is automatically granted authority. 2 Service is provided by the top / bottom network module 5 (7).

That is, when the connection between the first upper network module 1 and the first lower network module 3 is disconnected (Link Down), the first lower network module 3 transmits the incoming traffic to the second lower network module. Change the path to transmit to the (7), and also change the path to send the incoming traffic to the second upper network module (5) to provide services without network disconnection. will be.

However, such a network configuration alone could not cope with abnormal traffic. Anomalous traffic is, for example, a number of requests that occur over a relatively short time, with the intention of bringing down a system by overloading a particular server. Accordingly, if a module capable of inspecting the abnormal traffic is not provided on the network, the corresponding traffic may be introduced without any unreasonable packet. In recent years, as described above, after recognizing a potential threat, if it is determined to be an invalid packet, an intrusion that is a network security technology that blocks the IP address or incoming traffic, and delivers legitimate traffic to the receiver without any interruption or service delay. An abnormal traffic control device such as a prevention system or network traffic management equipment is provided.

2 shows a configuration in which the abnormal traffic control module is provided on the network.

As described above, in the redundant network configuration of FIG. 1, a first abnormal traffic control module 2 is configured between the first upper network module 1 and the first lower network module 3 as an active module. A second abnormal traffic control module 6 is configured between the second upper network module 5 and the second lower network module 7 as.

In this configuration, even if a link between the first upper network module 1 and the first abnormal traffic control module 2 is disconnected, the first lower network module 3 and the first abnormal traffic control module ( 2) Since the link between phases is normal, when traffic flows into the first lower network module 3, the traffic is to be transmitted by the first abnormal traffic control module 2 to the first upper network module 1. something to do. However, the service is not normally provided due to the link disconnection between the first upper network module 1 and the first abnormal traffic control module 2.

In addition, even if the network path is changed to the standby module due to a failure or other reason of the active module, the session information of the first upper / lower network module (1) 3 of the active module is stored in the standby mode. Since a path that can be transmitted to the second upper / lower network module 5 (7) of the module is not formed, the session information cannot be transmitted and thus the session information is lost. In addition, since the security policy applied to the active module is not transmitted to the standby module, even when providing a network service through the standby module, it is difficult to properly deal with abnormal traffic.

In addition, although a plurality of generated packet data must be processed by either one of an active module and a standby module, if the network structure of FIGS. 1 and 2 is provided asymmetrically, the incoming traffic may be distributed and introduced. . In this case, since the abnormal traffic control modules 2 and 6 provided in the active module and the standby module respectively inspect only packet data of traffic flowing into the active module, the session processing cannot be performed correctly.

Accordingly, an object of the present invention is to provide a security system and traffic for continuously executing network services by sharing traffic information and session information processed by each network service module in a symmetric-symmetric or symmetric-asymmetric duplex network structure. To provide a control method.

Another object of the present invention is to share link state information, engine state information, session information, environment information, policy information, and the like of a network service module.

In addition, the present invention monitors a pair of network interfaces included in the network module, and when one network link is disconnected, the other link is automatically disconnected, and if any one link is restored, the other link is automatically restored. There is another purpose.

A feature of the present invention for achieving the above object is, in the security system of a network having a redundant structure, an abnormal traffic module for monitoring the traffic flowing into the network, and a link inspection unit for monitoring the link connection state of the network; And a management unit for arbitrarily changing a state of another link of the network according to link state information of a portion of the network.

In addition, another aspect of the present invention, in the security system of a network having a redundant structure, the abnormal traffic module for monitoring the traffic flowing into the network, and transmits the security policy information applied to the network to another network or another network An information transmission and reception control unit for receiving the security policy information of the packet and the packet mirroring control unit for selectively transmitting information about the packets and sessions flowing into the network to another network or receiving the information transmitted from another network.

In addition, another aspect of the present invention, in the security system of a network having a redundant structure, the abnormal traffic module for monitoring the traffic flowing into the network, the link inspection unit for monitoring the network link connection state, and a portion of the network A management unit for arbitrarily changing the state of other links of the network according to link state information, an information transmission and reception control unit for transmitting security policy information applied to the network to another network or receiving security policy information of another network, and the network. And a packet mirroring control unit for selectively transmitting the information about the packet and the session introduced into the other network or receiving the information transmitted from the other network.

The present invention further includes a policy applying unit for comparing the security policy information and modifying its security policy information in different cases and synchronizing with other networks.

The present invention further includes an input packet copying unit which transmits information on packets and sessions flowing into the network to the packet mirroring control unit.

The security policy information of the present invention represents link status information, engine status information, policy information having detection / blocking information, driving environment information of the abnormal traffic module, and session information.

In the present invention, the command / response data is used to confirm the normal operation of the information transmission and reception control unit, the command / response data is a ping command.

In the redundant structure of the present invention, any one of an active module-standby module, an active module-active module, and an active module-active module is provided as an asymmetric network structure.

According to another aspect of the present invention, in a traffic control method of a security system having a redundant structure, copying packet information of traffic flowing into a network, and transferring the packet information and security policy information applied to the network to another network. Transmitting or receiving packet information and security policy information of another network.

The present invention may further include modifying and synchronizing any one of the security policy information when the security policy information applied to the network is different from the security policy information of another network.

The present invention may arbitrarily change other link states of the network according to link state information of a portion of the network.

The present invention checks whether the other network is normal when transmitting security policy information applied to the network to another network. Such normality can be confirmed by sending and receiving a ping command and its response command.

The security policy information of the present invention is provided with at least one of link status information, engine status information, policy information having detection / blocking information, driving environment information, and session information.

The network of the present invention is any one of an active module-standby module as a symmetric network structure, an active module-active module, and an active module-active module as an asymmetric network structure.

According to the present invention having such a configuration, any network service module on a redundant network can share its information with other network service modules, so that in the event of a network failure, the network can be continued without losing information through the standby network line. Can operate.

Hereinafter, a security system and a traffic control method of a network having a redundant structure according to the present invention will be described in detail with reference to a preferred embodiment shown in the accompanying drawings.

3 is a diagram illustrating a security system according to a preferred embodiment of the present invention, and FIG. 4 is a diagram illustrating a network equipped with the security system of FIG. 3.

In describing the embodiments of the present invention, the network configuration described in the prior art will be cited.

According to the figure, the abnormal traffic control module 10 (10 ') is provided with a pair (first and second abnormal traffic control module), the first upper network module (A) as the first network service module (A) Between 1) and the first bottom network module 3 and between the second top network module 5 and the second bottom network module 7 as the second network service module B, respectively. The first network service module (A) and the second network service module (B) operate as an active module or a service module, and their network configuration is symmetrically or asymmetrically. Therefore, since the redundant network configuration of the present invention may be composed of an active module-a standby module as a symmetric network structure, an active module-active module, and an active module-active module as an asymmetric network structure, it will be described separately. will be.

And the abnormal traffic control module 10 (10 ') for monitoring the traffic provides the following configuration. Only the above-described abnormal traffic control module 10 will be described, and the remaining 10 'is the same configuration, and only the symbols are given differently.

A network interface 12 is provided to transmit and receive packet data on traffic flowing from the network and packet data on traffic flowing out of the abnormal traffic control module 10 of the present invention. Since the network interface 12 is a redundant network configuration, a pair of transceivers is provided. That is, a transmitter / receiver is provided in the first upper network module 1 and the first lower network module 3, respectively.

The second network service module (B) includes an input packet copying unit (14) for copying packet data flowing from the network interface (12) and the packet data copied by the input packet copying unit (14). A packet mirroring interface 16 for transmitting to two or more traffic control modules 10 'is provided. The packet mirroring interface 16 is also provided with a transmitter and a receiver, respectively. Therefore, the packet mirroring interface 16 transmitter of the first abnormal traffic control module 10 is configured to be connected to the packet mirroring interface receiver of the second abnormal traffic control module 10 'to transmit packet data. Similarly, the packet mirroring interface receiver of the first abnormal traffic control module 10 is configured to be connected to the packet mirroring interface transmitter of the second abnormal traffic control module 10 'to receive packet data.

Packet data flowing through the first upper network module 1 and the first lower network module 3 and packet data flowing from the second abnormal traffic control module 10 'through the packet mirroring interface 16 are processed. The session processing unit 18 is provided. The session processor 18 processes all input session information and transmits its session information to another network service module when an asymmetric network and a network failure occur.

An abnormal traffic control unit 20 is provided to examine the packet data transmitted from the session processor 18 to determine whether abnormal traffic is present and to control the abnormal traffic.

And a link check unit 22 for checking a link state between the network modules 1 and 3. The link checker 22 checks the link state of the upper or lower network module 1 and 3, and if the link of any one network module 1 or 3 is down, the other network The link of the module is also forced to down. In addition, when the downlink of any one network module is restored, the other network module is forcibly restored. The link inspection unit 22 transmits the inspected link state information to the information transmission and reception control unit 26 which will be described later.

An engine state inspection unit 24 for inspecting the driving state of the engine of the abnormal traffic control apparatus of the present invention is provided. The engine state inspection unit 24 also checks whether the engine of the traffic control module 10 is abnormally to which it belongs and transmits the engine state information to the information transmission / reception control unit 26.

In addition, the information transmission and reception control unit 26 receives the link status information, engine status information, policy information, environment information, and session information, and transmits them to the abnormal traffic control module 10 'of another network service module B configured redundantly. It plays a role.

The information transmission and reception control unit 26 checks whether the counterpart abnormality traffic control module 10 is normal according to the transmission result after transmitting the 'Ping' command used when the target equipment is normally operated as one of UNIX commands. do. Here, the policy information refers to a detection and blocking policy of the abnormal traffic control module 10 (10 '). In addition, the environmental information refers to environmental information according to the operation of the abnormal traffic control module 10 (10 ').

Applying the policy information and environmental information of the other party's abnormal traffic control module 10 'received from the information transmission and reception control unit 26, and receives and applies their policy information and environmental information from the management unit 28, Comparing one's own information with the other party's information, if the information is different from each other, it is provided with a policy applying unit 30 for synchronizing the information by modifying its information. The information processed by the policy applying unit 30 is stored in the policy DB 32.

In addition, the management unit 28, the link inspection unit 22, the engine state inspection unit 24, the abnormal traffic control unit 20, information transmission and reception control unit 26, the policy application unit 30, the information received from the user interface ( 34) to transmit. In addition, the management unit 28 plays a role of arbitrarily changing the state of other links of the network according to the link state information inspected by the link inspection unit 22.

Next, the traffic control method in the redundant network security system according to the present invention having the configuration as described above will be described in detail.

The present invention is provided in a redundant network configuration, and as described above, may be composed of an active module-standby module and an active module-active module as a symmetric network structure, and an active module-active module as an asymmetric network structure. Therefore, the control method in the network structure thus divided will be described.

First, the network configuration is symmetrically duplicated as an active module-standby module.

In this case, all traffic information generated by the network and the abnormal traffic control module 10 flows in and out through the first upper network module 1 or the first lower network module 3 of the first network service module A. This is made, and the process of introducing the traffic information generated in the network according to the present invention will be described.

When the traffic information is generated through the first upper network module 1 or the first lower network module 3 of the first network service module A, the traffic information is introduced through the network interface 12.

Then, the input packet copying unit 14 receives the traffic information from the network interface 12, copies the packet data for the traffic information, and transmits the packet information to the packet mirroring interface 16. Accordingly, the packet mirroring interface 16 has information on all packet data flowing into the network interface 12.

The packet mirroring interface 16 transmits the packet data to the second or more traffic control module 10 'via the packet mirroring interface 16' of the duplexed second network service module B connected to the transmitter. do. Accordingly, the second abnormal traffic control module 10 ′ also has traffic information processed by the first abnormal traffic control module 10. That is, although the traffic information directly flowing through the second abnormal traffic control module 10 'does not occur, the first abnormal traffic control module 10 shares the session information of the introduced traffic.

With such session information sharing, the information transmission / reception control unit 26 provided in the first abnormal traffic control module 10 transmits its own state information, environmental information, policy information, etc. to the second abnormal traffic control module 10 '. Is transmitted to the information transmission and reception control unit 26 '. Then, the policy application unit 30 'of the second abnormal traffic control module 10' compares the received information, and the first and second abnormal traffic control modules 10 and 10 'according to the information sharing. ) Exact motivation is achieved between each other.

Next, the link checker 22 continuously checks the link state of the first upper network module 1 or the first lower network module 3. If one link is down, the link checker 22 causes the other link to be down. On the contrary, if any one link is restored in the link down state, the link checker 22 forcibly restores the other link. That is, when any one link is down by the link checker 22, the other link is also down and the network path of the first network service module A which is currently active is blocked and the second network service module B is disconnected. Change the path to the network path.

At this time, since the state information, environment information, policy information, and session information of the first abnormal traffic control module 10 are already transmitted to the second abnormal traffic control module 10 ', synchronization is preceded without loss of information. Continuous service provision is possible.

In other words, the information transmission and reception control unit 26 provides link status information, engine status information, environmental information of the abnormal traffic control module 10, and policy information indicating a detection and blocking policy of the abnormal traffic control module 10. The first abnormal traffic control module 10 and the second abnormal traffic control module 10 are transmitted to the corresponding counterpart abnormal traffic control module 10 'and the session information is transmitted using the packet mirroring interface 16. 10 ') share the same information. In this case, the session information includes information on abnormal traffic inspected by the abnormal traffic controller 20.

Accordingly, the policy application unit 30 'of the second abnormal traffic control module 10' may newly apply policy information and environment setting information of the abnormal traffic control module 10 'with reference to the received information. have.

Meanwhile, the information transmission / reception control unit 26 should check whether the second abnormal traffic control module 10 'normally operates when transmitting and receiving the information.

To this end, when the first information transmission and reception control unit 26 of the first abnormal traffic control module 10 intends to transfer information to the second information transmission and reception control unit 26 'of the second abnormal traffic control module 10', First, the first information transmission and reception control unit 26 transmits the 'Ping' information to the second information transmission and reception control unit 26 '. The 'Ping' information is one of the above-mentioned 'UNIX' commands and is used to check whether the target device is normally operated. The Internet Control Message Protocol (ICMP) is generally used.

Accordingly, when response information for 'Ping' information is transmitted from the second information transmission / reception control unit 26 ', the first information transmission / reception control unit 26 is an abnormal traffic control module 10 of the second information transmission / reception control unit 26'. ') Is operating normally. The first abnormal traffic control module 10 transmits its link status information, engine status information, policy information, environment information, session information, etc. to the second abnormal traffic control module 10 '. Similarly, the second abnormal traffic control module 10 ′ transmits its information to the first abnormal traffic control module 10. At this time, if the engine driving state is abnormal among the received information, the management unit 28 (28 ') transmits it to the user interface 34 (34') to inform the engine state. Such information and the like are applied by the policy application unit 30 (30 ') and stored and managed in the policy DB (32) (32').

If the response information for 'Ping' information transmission is not generated, the first information transmission / reception control unit 26 may have a bad connection cable with the second abnormal traffic control module 10 'or the second abnormal traffic. It is determined that the power supply of the control module 10 'and the second network service module B is off or abnormal. Of course, the information according to the determination result is transmitted to the user interface 34 through its management unit 28.

The abnormal traffic control module 10 of the active module (the first network service module, A), when configured as an active-standby module as a symmetric network structure, receives the incoming traffic from the standby module (the second network service module, B). The abnormal traffic control module 10 'and the abnormal traffic control module 10 and 10' share their own status information / environmental information / policy information / session information. do.

The link checker 22 monitors the link state of the first upper / lower network module 1 and 3 in real time, and if one network link is disconnected, forcibly disconnects the other network link. do. Accordingly, since the entire network path of the first network service module A is blocked and automatically changed to the second network service module B, the network service can be continuously provided without loss of information due to the synchronization. .

The next active module-an active module, in which the network configuration is symmetrically duplicated.

This is the same as the configuration in which the network is redundant with the above-described active module-standby module.

Therefore, even if a failure occurs in one active module, the service may be continuously provided through the other active module. Of course, all information about one active module is transmitted to another active module, and thus information sharing is possible.

Next, the network configuration is asymmetrically duplicated with an active module-active module.

In the redundant configuration of the asymmetric network, the packet data flowing from any active module is transmitted to other active modules through the packet mirroring interfaces 16 and 16 ', thereby sharing the packet data. Each active module may share its own state information, environment information, policy information, session information, and the like through the information transmission and reception control unit 26 (26 '). Therefore, continuous network service is possible even if one network fails.

That is, in the conventional asymmetric network structure, the session sharing and the sharing of the above information are impossible, so the session processing was not processed correctly.

As described above, the present invention described in the above embodiments can synchronize each network service module having a dual structure, and if the link is disconnected at a predetermined part in one network line due to the information sharing by the synchronization, Even if the remaining link is forcibly disconnected, it can be seen that normal service is possible without disconnecting the session through another network line.

As described above, the security system and the traffic control method of the present invention have the following effects.

First, traffic information flowing into any one network service module in all network structures symmetrically or asymmetrically duplicated, and status information (link state / engine state), policy information, and environment information of the abnormal traffic control module of the network service module. Since it is shared with other corresponding traffic control module corresponding to each other, it is possible to synchronize between the network service modules can provide a continuous network service without network disconnection.

In addition, when any one of the upper or lower network modules provided to any one network service module is disconnected from the abnormal traffic control module in the redundant network structure, the link with the remaining modules is forcibly disconnected and automatically Since the network path is changed and provided to the network service module, it is possible to continue to provide the abnormal traffic control service without losing session information and various information due to the information synchronization.

Claims (16)

In the security system of a network having a redundant structure, An abnormal traffic module for monitoring the traffic flowing into the network; A link check unit for monitoring a link connection state of the network; And a management unit for arbitrarily changing a state of another link of the network according to link state information of a portion of the network. In the security system of a network having a redundant structure, An abnormal traffic module for monitoring the traffic flowing into the network; An information transmission and reception control unit for transmitting security policy information applied to the network to another network or receiving security policy information of another network; And a packet mirroring control unit for selectively transmitting information about packets and sessions flowing into the network to another network or receiving the information transmitted from another network. In the security system of a network having a redundant structure, An abnormal traffic module for monitoring the traffic flowing into the network; A link inspection unit for monitoring the network link connection state; A management unit for arbitrarily changing a state of another link of the network according to link state information of a part of the network; An information transmission and reception control unit for transmitting security policy information applied to the network to another network or receiving security policy information of another network; And a packet mirroring control unit for selectively transmitting information about packets and sessions flowing into the network to another network or receiving the information transmitted from another network. The method according to any one of claims 1 to 3, And a policy application unit for comparing the security policy information of the network and modifying its security policy information and synchronizing with other networks in different cases. The method of claim 2 or 3, And an input packet copying unit which transmits information on packets and sessions flowing into the network to the packet mirroring control unit. The method of claim 2 or 3, The security policy information, Security information, characterized in that the link status information, engine status information, policy information having detection / blocking information, driving environment information of the abnormal traffic module, session information. The method of claim 2 or 3, And using command / response data to confirm normal operation of the information transmission and reception control unit. The method of claim 7, wherein And the command / response data is a ping command. The method according to any one of claims 1 to 3, The redundant structure, A security system, which is any one of an active module-a standby module as a symmetric network structure, an active module-an active module, and an active module-an active module as an asymmetric network structure. In the traffic control method of a security system having a redundant structure, Copying packet information of traffic flowing into the network; And transmitting the packet information and the security policy information applied to the network to another network, or receiving the packet information and the security policy information of the other network. The method of claim 10, And when the security policy information applied to the network is different from the security policy information of another network, modifying and synchronizing any one of the security policy information. The method of claim 10, And randomly changing another link state of the network according to link state information of a portion of the network. The method of claim 10, When the transmission of the security policy information applied to the network to another network, the traffic control method of the security system, characterized in that it checks whether the other network is normal. The method of claim 13, The normality of the traffic control method of the security system, characterized in that by confirming the transmission and reception of the ping command and its response command. The method of claim 10, The security policy information is at least one of link status information, engine status information, policy information having detection / blocking information, driving environment information, and session information. The method of claim 10, The network, A method for controlling traffic of a security system, the method comprising: an active module-a standby module as a symmetric network structure, an active module-an active module, and an active module-an active module as an asymmetric network structure.

Images