KR20090052225A - Network access control method based on microsoft network access protection - Google Patents

Abstract

The present invention relates to a network access control method based on Microsoft Network Access Protection (NAP), which performs a policy on a client terminal to access a network, and checks a policy of an authenticated user on an authentication server, and then receives the policy received from the client terminal. Controls the client terminal's network access by comparing the execution result and the policy information about the user received from the policy server, and the policy server is connected to the authentication server to provide or manage policies for each user. Soft) NAP's policy expansion can be implemented to enhance network security. Furthermore, it is easy to extend MS NAP's policy by extending policy even larger than MS NAP's standardized packet size limit. To make it happen.

NAP, authentication, policy, network security

Description

Network Access Control for Microsoft Network Access Protection Foundation {NETWORK ACCESS CONTROL METHOD BASED ON MICROSOFT NETWORK ACCESS PROTECTION}

The present invention relates to a network access control method, and more particularly, to a policy extension of MS (Microsoft, Microsoft) NAP (Network access protection).

Although the development of the Internet has made it possible to easily exchange information, the probability of security accidents such as the leakage of information is increasing. In particular, due to the development of the wireless Internet, the possibility of access by an unidentified person on a network becomes easier, thereby increasing the probability of a security accident.

Therefore, companies related to network security are developing various technologies to prevent security accidents. Among them, Microsoft developed and proposed a technology called NAP.

NAP technology checks the security status (or health status, the same below) during the network connection or communication according to the security policy for the client to access the network, until the client's network connection is met. It is based on limiting

The introduction of the above NAP technology has the following features and benefits.

First, from a user's point of view, when accessing a network for the first time, the NAP client installed in its own computer automatically checks the security state of the system to determine whether it meets the preset security state policy. If your computer meets the policy, you will be able to use authorized network resources as much as the network permissions granted to you. Otherwise, you will have a NAP client with limited access that only allows access to the quarantine zone. do. Therefore, if the user has limited access to the network because the virus engine is not updated on his computer, the user needs to update the virus engine. At this time, the virus engine can be manually or automatically updated in the restricted access quota zone. have. In addition, even after the network access is authorized, the security status check by the NAP client provides continuous security management. This makes it possible to strengthen network security by allowing network access only if the security policy is followed regardless of the user's intention.

Next, from a security manager's point of view, an analysis report of network operation or security perspective can be easily printed and used as a basis for the next network security plan. In addition, it is possible to collectively enforce the security of the network access terminal that has been assigned to the user in the past, thereby effectively controlling the security threat to the internal network due to user's indifference or mistake.

However, since the policy provided by MS NAP is applied uniformly to all client terminals without user identification, some security holes (for example, design staff can steal personnel policy data from human resources department). It is very likely to occur.

In addition, in MS NAP, the size of the field in which the policy data can be put in the packet included in the packet is limited to 4 Kbytes. Therefore, if the policy size exceeds 4 Kbytes, it cannot be applied as a policy. It has a limitation of and acts as a limiting factor to prevent the occurrence of security hole.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and an object of the present invention is to provide a technology that enables application of a security policy for each user based on MS NAP, and a policy application of a size larger than a limited size. It is done.

Microsoft NAP-based network access control method according to the present invention for achieving the above object, A step of providing a policy for the user to the client terminal authenticated user in the policy server via the authentication server; After executing the policy in the client terminal and sending the policy execution result and the performed policy information to the certificate server, the policy server checks the policy information for the user through the policy server and then the policy information performed by the client terminal. Determining whether the client terminal accesses the network by checking whether the policy information checked by the policy server matches; And controlling the network connection of the client terminal in the authentication server according to the determination result in the step B; Characterized in that it comprises a.

If a policy does not exist in the client terminal, steps A and B are performed, and if a policy exists in the client terminal, step B is performed.

The step A, step A1 of transmitting the authentication information for the user from the client terminal to the authentication server; A2 step of requesting that the policy server has a policy for the user after authenticating the user in the authentication server; A3 step of transmitting the policy to the authentication server if there is a policy for the user in the policy server; And transmitting the corresponding policy from the authentication server to the client terminal. It includes a more specific feature to include.

The policy transmitted to the client terminal may be divided into a plurality of packets, and may be sequentially transmitted.

It is another feature that the step A is repeated until all of the plurality of packets are transmitted to the client terminal.

Step B, Step B1 to perform the policy in the client terminal; A step B2 of transmitting the result of the policy in the client terminal and the applied policy information to the authentication server; A step B3 of requesting confirmation from the authentication server to the policy server whether a policy exists for the user; The policy server transmits the policy to the authentication server if the policy exists; And step B5, wherein the authentication server checks whether the policy information received in step B2 and the policy information received in step B3 match. It includes a more specific feature to include.

According to the present invention as described above, various security policies differentiated for each user can be applied even in the MS NAP-based, it is possible to apply a security policy of a size larger than the standardized size can further enhance the network security.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of a network access control method based on the Microsoft network access protection (MS NAP) based on the present invention as described above will be described.

<Description of Basic Security System Structure>

MS NAP-based network 140 access control method according to the present invention is made in the basic security system structure shown in FIG.

The security system shown in the block diagram of FIG. 1 includes a client terminal 110 to access a network 140, an authentication server 120 for authenticating a user, a policy server 130 for managing and supporting a security policy, and the like. It is composed.

The client terminal 110 is equipped with an MS NAP-based SHA 111, and transmits user authentication information such as a Windows login ID, IP, MAC, etc. to the authentication server 120, and performs a security policy to perform a security policy. The result and the performed policy information is transmitted to the authentication server 120. In addition, access to the network 140 or only to the isolation zone 141 depends on security policy compliance.

The authentication server 120 is equipped with the MS NAP-based SHV 121, and after authenticating the user with the user authentication information received from the client terminal 110, whether there is a policy for the user through the policy server 130 Check and then receives the policy for the user from the policy server 130 and sends to the client terminal (110). The result of the execution of the security policy and the policy information received from the client terminal 110 are compared with the policy information received from the policy server 130 to determine and control whether the client terminal 110 is connected to the network 140.

The policy server 130 has a security policy to be differentiated by user or by group (human resources group, design group, sales group, etc.), and the security server 120 requests the corresponding security policy at the request of the authentication server 120. Serve as a role.

<Process made in the client terminal 110>

A process performed in the client terminal 110 will be described with reference to the flowcharts of FIGS. 2 and 3.

1. If a security policy exists in the client terminal 110 (see Fig. 2)

1-1. Security policy enforcement <S201>

The client terminal 110 performs a security policy that is currently applied. That is, it checks the issues according to the security policy such as whether a specific virus engine is updated or system security patch is installed.

1-2. Sending result of security policy performance <S202>

In order to access the network 140, user authentication information such as a window login ID, an IP, a MAC, a security policy execution result, and the executed policy information are transmitted to the authentication server 120.

1-3. Network 140 connection / restriction <S203>

If the network 140 is allowed to access the network 140 from the authentication server 120 after the step S202, the network 140 is connected to the network 140 within the range in which the user can access the network 140 resources. Of course, as will be described later, in order for the client terminal 110 to be effectively connected to the network 140, the security policy existing in the client terminal 110 and the security policy of the user in the policy server 130 need to be the same. Do. If the network 140 is restricted from the authentication server 120 after step S202, only the isolation zone 141 is connected.

2. If there is no security policy in the client terminal 110 (see Figure 3)

2-1. Send user authentication information <S301>

The client terminal 110 attempting to access the network 140 transmits user authentication information to the authentication server 120.

2-2. Receive Security Policy <S302>

After step S301 receives a scripted security policy from the policy server 130 via the authentication server (120).

Thereafter, the above-described steps S201 to S203 are performed.

<Process made in the authentication server 120>

A process performed in the authentication server 120 will be described with reference to the flowcharts of FIGS. 4 and 5.

1. If a security policy exists in the client terminal 110 (see Fig. 4)

1-1. Receive Information <S401>

Receives user authentication information, security policy execution result, and executed policy information from the client terminal 110 to access the network 140.

1-2. Judgment of results and review of security policy validity <S402>

Reviewing the result of performing the security policy, it is determined whether the client terminal 110 is authorized to access the network 140. At this time, the policy server 130 is reviewed to examine the validity of the security policy information received from the client terminal 110. Send and receive the user information to distinguish the user by requesting the security policy information for the user and then compares the security policy information received from the client terminal 110 with the security policy information received from the policy server 130.

1-3. Network 140 access control <S403>

In operation S402, if the client terminal 110 complies with the security policy and the security policy information received from the client terminal 110 and the security policy information received from the policy server 130 match, the network of the client terminal 110 ( 140) allow the connection, otherwise limit the network 140 connection of the client terminal 110 to the isolation zone 141 only.

2. If there is no security policy in the client terminal 110 (see Fig. 5)

2-1. Receive User Authentication Information <S501>

User authentication information is received from the client terminal 110 attempting to access the network 140.

2-2. User Authentication <S502>

The user is authenticated with the user authentication information received in step S501.

2-3. Security policy request and reception <S503>

In order to obtain a security policy to be applied to the authenticated user, the policy server 130 requests a security policy for the user. At this time, user information that can distinguish users is sent together.

2-4. Security policy transmission <S504>

When the security policy is received from the policy server 130 in step S503, the security policy is sent to the client terminal 110.

Thereafter, the above-described steps S401 to S403 are performed.

<Process Made in Policy Server 130>

A process performed by the policy server 130 will be described with reference to the flowchart of FIG. 6.

1. Received request <S601>

The authentication server 120 receives user information for distinguishing a user and a request for a security policy to be applied to the user.

2. Search <S602>

The security policy to be applied to the user is searched for according to the request received in step S601.

3. Security policy transmission <S603>

When the search is completed in step S602 to find a security policy to be applied to the user, the security policy is transmitted to the authentication server 120.

<Overall process>

Subsequently, with reference to the flowchart of FIG. 7, the processes of the respective processes in the above-described individual configurations will be described as a whole. For the convenience of description, the reference numerals of the steps are different from the same steps described above.

1. If no security policy exists in the client terminal (110)

1-1. Sending and Receiving User Authentication Information <S701>

The client terminal 110 attempting to access the network 140 transmits user authentication information to the authentication server 120, and the authentication server 120 receives user authentication information sent from the client terminal 110.

1-2. User Authentication <S702>

The authentication server 120 authenticates the user with the user authentication information received in step S701.

1-3. Security policy request and reception 1 <S703>

The authentication server 120 requests the security policy for the user by sending user information to distinguish the user to the policy server 130 to obtain a security policy to be applied to the authenticated user, the policy server 130 receives such a request do.

1-4. Sending and Receiving Security Policy 1 <S704>

The policy server 130 searches for and finds a security policy to be applied to the user, then transfers the policy to the authentication server 120 in a scripted form, and the authentication server 120 receives the security policy.

1-5. Security policy transmission and reception <S705>

The authentication server 120 transmits the security policy received from the policy server 130 to the client terminal 110, and the client terminal 110 receives the received security policy. According to the MS NAP, the size of a packet to be sent to the client terminal 110 cannot exceed 4 Kbytes. Therefore, if the size of the security policy exceeds 4Kbyte, the security policy is divided into a plurality of packets smaller than 4Kbyte and then sent in sequence, and the client terminal 110 is sent in sequence from the authentication server 120 Receive packets sequentially. Therefore, the above steps S701 to S705 are repeated until the plurality of packets from which the client terminal 110 is separated are received. 1-6. Security Policy Execution <S706>

The client terminal 110 executes the received security policy.

1-7. Sending and receiving security policy execution result <S707>

The client terminal 110 transmits the user authentication information such as the window login ID, IP, MAC, security policy execution result, the executed policy information to the authentication server 120, and the authentication server 120 receives this. At this time, the information to be sent is converted into a hash value and sent.

1-8. Security policy request and reception2 <S708>

The authentication server 120 requests the security policy for the user by sending user information that can distinguish the user to the policy server 130 to check the security policy applied to the authenticated user, and the policy server 130 requests such a request. Receive.

1-9. Security Policy Transmit and Receive 2 <S709>

The policy server 130 searches for and finds a security policy to be applied to the user, and transmits the policy to the authentication server 120 in a scripted form, and the authentication server 120 receives the security policy.

1-10. Judgment of security policy result and review of security policy validity <S710>

The authentication server 120 determines whether the client terminal 110 is authorized to access the network 140 by reviewing the security policy performance result, and, in addition, the security policy information and the policy server received from the client terminal 110. The security policy information received from the 130 is compared to examine the validity of the security policy performed by the client terminal 110.

1-11. Network 140 access control <S711>

In operation S710, when the client terminal 110 complies with the security policy and the security policy information received from the client terminal 110 and the security policy information received from the policy server 130 match, the network of the client terminal 110 ( 140) allow the connection, otherwise limit the network 140 connection of the client terminal 110 to the isolation zone 141 only. If the security policy information does not match, the above steps S701 to S711 are repeated.

2. When a security policy exists in the client terminal 110

When the security policy exists in the client terminal 110, only the above steps S707 to S711 are performed.

As described above, the detailed description of the present invention has been made by the embodiments with reference to the accompanying drawings. However, since the above-described embodiments have only been described with reference to preferred examples of the present invention, the present invention is limited to the above embodiments. It should not be understood that the scope of the present invention is to be understood by the claims and equivalent concepts described below.

1 is a block diagram of a security system to which the MS NAP-based network access control method according to an embodiment of the present invention is applied.

2 and 3 are flowcharts of processes performed in the client terminal applied to the security system of FIG.

4 and 5 are flowcharts of processes performed in the authentication server applied to the security system of FIG.

6 is a flowchart illustrating a process performed in a policy server applied to the security system of FIG.

7 is a flowchart illustrating a method for controlling network access based on MS NAP according to the present invention.

Claims (6)

A step of providing a policy for the user to the client terminal authenticated by the user in the policy server via the authentication server; After executing the policy in the client terminal and sending the policy execution result and the executed policy information to the authentication server, the policy information for the user in the authentication server through the policy server after checking the policy information for the user through the policy server Determining whether the client terminal is connected to the network by checking whether the policy information checked by the policy server is identical to the policy information; And A step C of controlling the network connection of the client terminal in the authentication server according to the determination result of the step B; Network access control method for Microsoft NAP (Network Access Protection) based, comprising a. The method of claim 1, And performing step A and step B if there is no policy in the client terminal, and performing step B if there is a policy in the client terminal. The method of claim 1, Step A, A1 step of transmitting the authentication information for the user from the client terminal to the authentication server; A2 step of requesting that the policy server has a policy for the user after authenticating the user in the authentication server; A3 step of transmitting the policy to the authentication server if there is a policy for the user in the policy server; And A4 step of transmitting the policy from the authentication server to the client terminal; Microsoft NAP-based network access control method comprising a. The method of claim 3,  The policy transmitted to the client terminal is divided into a plurality of packets, characterized in that for transmitting sequentially to the Microsoft NAP-based network access control method. The method of claim 4, wherein And repeating step A until all of the plurality of packets are transmitted to the client terminal. The method of claim 1, Step B, Step B1 of performing a corresponding policy in the client terminal; A step B2 of transmitting the result of executing the policy in the client terminal and the applied policy information to the authentication server; A step B3 of requesting confirmation from the authentication server to the policy server whether a policy exists for the user; The policy server transmits the policy to the authentication server if the policy exists; And Step B5 of the authentication server checking whether the policy information received in step B2 and the policy information received in step B3 match; Microsoft NAP-based network access control method comprising a.

Images