KR20110036419A - System and method for firewalling wide area network - Google Patents

Abstract

PURPOSE: A system and method for firewalling a wide area network are provided to distribute a firewall policy to one or more hosts or network nodes on the wide area network. CONSTITUTION: A distributed fireproof device client(300) is connected to a dispersion firewall server. The dispersion firewall server comprises a fireproof policy input interface unit(220) and a fireproof policy distributing unit(260). The fireproof policy distributing unit receives a fireproof policy from a firewall policy making person. The firewall policy distributing unit distributes the firewall policy to distributed fireproof device clients.

Description

Fire protection system and method for wide area network {System and method for firewalling wide area network}

The present invention relates to a network arson apparatus, and more particularly, at least one arson policy generated from a network arson policy creator located on a network path connecting a source address of a packet included in the arson policy and a destination address of the packet. The present invention relates to a distributed fire protection apparatus and method for distributing harmful traffic to the public Internet by distributing to the host or network node.

In the field of computer networks, a fire protection device or firewall refers to a software, hardware, or a combination of hardware and software used to block or control network traffic that is not desired by a user of a network or computer.

The fire protection device may be classified into a server side fire protection device and a client side fire protection device according to the installed position.

The server-side fire protection device may be installed in software form in an application server to protect an application server such as a web server, a mail server, or a file server, or may be implemented as a network device physically separated from the application server in front of the application server. The administrator of the application server properly configures the server-side fire protection device to block harmful traffic from entering the application server. For example, if a client overloads an application server by deliberately sending nonsense traffic to intentionally overload the application server, the server-side firewall can block traffic from that client to the application server, which is harmful to the application server. You can block traffic from reaching it. In addition, if a specific client attempts to find out the ID or password of a victim user through a brute force attack, the brute force attack can be prevented by blocking the client from the server-side firewall. .

The client side fire protection device may be installed in the form of software in the personal computer mainly to protect the personal computer, or may be installed in front of the personal computer as network equipment physically separated from the personal computer. The client-side firewall can block attempts to infect viruses by using a bug in the operating system, such as viruses spreading through the network, and block unwanted traffic from entering or exiting according to the intention of the computer user. Can be used to

3 is a block diagram of a fire protection device according to the prior art. According to FIG. 3, 510a to 510c are personal computers requesting service to the application server 540, 520a to 520e are network devices (routers, switches, etc.) located on a network path, and 540 is a service to personal computers. Provided is an application server, 530 is a server-side fire protection device installed in front of the application server. At this time, if the personal computer 510a and 510c transmits harmful traffic for the DDOS attack to the application server 540, it will block such harmful traffic using the server-side fire protection device (530). The setting of the server side fire protection device 530 to block harmful traffic may be accomplished manually by the administrator of the application server, or may be accomplished by automated detection of the application server 540.

The blocking of harmful traffic according to the prior art may block harmful traffic for DDOS attacks from personal computers 510a and 510c from reaching the application server, but it does not fundamentally prevent the traffic from entering the public Internet. There is a problem. In the above example, since the server side fire protection device 530 blocks harmful traffic for the DDOS attack, the harmful traffic for DDOS attack disappears between the server side fire device 530 and the application server 540, but the personal computer ( In the section from 510a, 510c to the server side fire protection device 530, harmful traffic still continues, and the congestion of the public Internet continues. Therefore, in the above example, the personal computer 510b cannot access the application server 540 smoothly because the network path to the application server 540 is congested even though it does not generate harmful traffic. . In addition, even if the administrator of the application server 540 blocks harmful traffic by using the server-side fireproof device 530, harmful traffic continues to reach the server-side fireproof device 530, which wastes network line resources and is unnecessary. There is a problem in that damage caused by additional line charges is generated.

Another problem of the harmful traffic blocking according to the prior art is that the traffic is blocked without any guidance to the user of the blocked personal computer. In particular, when harmful traffic for a DDOS attack is generated, it is common to reject (REJECT) or drop (DROP) all packets from the personal computer in the DDOS attack to the application server 540. Will make the application server appear to be down. If a user of a personal computer 510a or 510c that generates harmful traffic for a DDOS attack is not attacking the application server 540 by their intention, the application server 540 is opposed to their intention by a virus or malware. In the case of attacking, the user of the personal computer 510a or 510c is blocked from accessing the application server 540 without knowing the reason and cannot receive the service from the application server 540. As described above, when a packet transmitted from a specific personal computer is rejected or dropped by the server-side fire protection device, the prior art is an automated method that can explain to the user of the personal computer the reason for blocking and how to solve the problem. It did not provide a method, and it used a form of informing a user of a personal computer about the cause of traffic blocking and a solution by using conventional means such as telephone contact.

The present invention has been made to solve the above-mentioned problems of the prior art, and is located on a network path that connects the origination address of the packet included in the arson policy and the destination address of the packet to the arson policy generated from the arson policy creator. It is an object of the present invention to provide a distributed fire protection apparatus and method for distributing harmful traffic to the public Internet by distributing it to at least one host or network node.

Another object of the present invention is to provide an apparatus and method for outputting a guide message for blocking traffic to a user of a computer generating traffic when network traffic is blocked by a fire protection device.

It is another object of the present invention to provide a consistent interface to various existing server-side fireproof devices, client-side fireproof devices, and network node fireproof devices, and to use the existing fireproof devices to build a globally distributed fireproof device. It is to provide an apparatus and method.

Another object of the present invention is an apparatus and method for selectively distributing a fire protection policy only to a host or a network node located on a network path connecting a source address of a packet and a destination address of a packet included in a fire policy generated from a fire policy creator. To provide.

Other objects and advantages of the invention will be described below.

In order to achieve the above object, the present invention provides a fire protection apparatus for controlling network traffic, comprising: a distributed fire prevention apparatus server; At least one distributed fire protection device client connected to the distributed fire protection device server, wherein the distributed fire protection device server comprises: a fire protection policy input interface configured to receive a fire protection policy from a fire protection policy generator; A fire protection policy distribution unit for distributing the fire protection policy received through the fire protection policy input interface unit to a distributed fire protection device client, wherein the distributed fire protection device client comprises: a fire protection policy receiving unit receiving a fire policy from the fire policy distribution unit; And a fire protection policy output interface unit for outputting the fire protection policy received by the fire protection policy receiver to a target fire protection device.

Preferably, the distributed fire prevention server includes: a client register configured to register client information from a distributed fire protection device client that wants to receive a fire protection policy distributed by the distributed fire protection server; A client information storage unit for storing the client information transmitted when the distributed fire protection device client registers with the distributed fire protection device server through the client registration unit; A fire prevention policy storage unit for storing the fire prevention policy inputted from the fire protection policy creator through the fire protection policy input interface unit in a storage device of a computer; And an authentication unit configured to authenticate the distributed fire protection device client that accesses the fire protection policy input interface unit to input the fire protection policy or to the client registration unit to register the client information.

Preferably, the distributed fire protection device client further comprises a user guide unit for outputting a guide message included in the fire protection policy received from the fire protection policy receiver to the user.

In order to achieve the above object, the present invention provides a fire prevention method for controlling network traffic, comprising: a fire prevention policy input step of receiving a fire protection policy from a fire prevention policy generator by a distributed fire protection device server; A fire protection policy distribution step of distributing the fire protection policy received in the fire protection policy input step to a distributed fire protection device client by a distributed fire protection device server; An arson policy receiving step of receiving, by the distributed arson apparatus client, the arson policy distributed in the arson policy distribution step; And a fire prevention policy output step of outputting the fire prevention policy received at the fire prevention policy receiving step by the distributed fire protection device client to the target fire protection device.

Preferably, the distributed fire prevention method comprises: a client registration step of registering client information from a distributed fire protection device client that wants to receive a fire protection policy distributed by a distributed fire protection device server; A client authentication step of authenticating the distributed fire protection device client before receiving client information from the distributed fire protection device client in the client registration step; A client information storing step of storing, in the storage device of the computer, client information transmitted when the distributed fire protection device client registers with the distributed fire protection server in the client registration step; An arson policy generator authentication step of authenticating the arson policy generator before receiving the arson policy from the arson policy creator in the arson policy input step; A fire prevention policy storing step of storing a fire prevention policy inputted from a fire prevention policy creator in a fire protection policy input step in a storage device of a computer; And a user guide step of outputting a guide message included in the fire prevention policy received in the fire prevention policy receiving step to the user.

According to the present invention, when harmful traffic such as a DDOS attack is generated, the server-based fire protection device that blocks the harmful traffic and at the same time distributes a fire protection policy to a computer or a fire protection device that generates the harmful traffic, and distributes the harmful policy. Minimize traffic to the Internet. Therefore, the Internet can be prevented from being congested due to harmful traffic, and an administrator of a computer that is attacked by the harmful traffic can prevent a circuit resource from being eroded by harmful traffic.

In addition, the distributed fire prevention apparatus and method according to the present invention, when the traffic from the personal computer to the application server is blocked, it is possible to output a warning or guidance message about the block to the user of the personal computer, The user can receive automated guidance as to why the traffic was blocked and how to resolve it.

In addition, the distributed fire prevention apparatus and method according to the present invention provides a consistent interface to the existing server-side fire prevention apparatus, the client fire protection device, and the network node fire prevention device, thereby utilizing the existing fire prevention devices to provide the Internet wide area fire prevention device. You can build it. Therefore, it is possible to build a distributed fire protection device that is distributed and operated on the Internet without significantly changing the existing fire protection device or network structure.

In addition, the distributed fire prevention apparatus and method according to the present invention, selects a fire protection policy only to a host or a network node located on a network path that connects the packet between the source address of the packet and the destination address of the packet included in the fire policy generated from the fire policy creator. As a result, the fire protection policy can be deployed using a minimum amount of traffic even in an Internet environment in which many hosts and network nodes are connected.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a distributed fire protection apparatus according to a preferred embodiment of the present invention. Referring to FIG. 1, the distributed fire protection device includes a distributed fire protection device server 200 and at least one distributed fire protection device client 300 connected thereto. The distributed fire protection server 200 is connected to the fire protection policy generator 100, and the distributed fire protection device client 300 is connected to the target fire protection system 400.

The arson policy generator 100 represents a device or a person who inputs the arson policy into the distributed arson apparatus 200. The arson policy generator 100 may be a source arson system (for example, a arson device installed in front of an application server) that first detects harmful traffic and generates an arson policy for the corresponding traffic. It may be a system administrator of a server, an application server itself that detects an attack from harmful traffic, or may be a distributed fire protection device client according to the present invention. In addition, the system administrator may be a web-based input device, a command line interface-based input device, a graphic user interface-based input device, or the like for inputting a fire protection policy to a distributed fire protection device server. The system administrator may include not only the system administrator of the application server, but also the system administrator of the fire protection apparatus installed in front of the application server and the system administrator of the distributed fire protection apparatus according to the present invention.

The target fire protection device 400 is a fire protection device that receives the fire protection policy inputted from the fire protection policy generator 100 using the distributed fire protection devices 200 and 300 according to the present invention to perform a fire protection policy. The target fire protection device 400 is installed in the personal firewall software installed in the personal computer, the firewall equipment installed in front of the personal computer, the firewall equipment installed in the middle node of the network, the firewall equipment installed in the front of the application server, and installed in the application server. Firewall software, and so forth. In addition, when the distributed fire prevention apparatus according to the present invention is operated in a chaining (chaining) method may be a distributed fire prevention apparatus server of another distributed fire prevention apparatus.

In other words, the term source fire protection device means a fire protection device for inputting a fire protection policy into the distributed fire protection device according to the present invention, and the term target fire protection device means a fire protection device that receives a fire protection policy from the distributed fire protection device according to the present invention. Used as

The distributed fire protection device server 200 transmits the fire protection policy input through the fire protection policy input interface 220 and the fire policy input interface 220 to receive the fire policy from the fire protection policy generator 100. Fire protection policy distribution unit 260 to distribute to (300).

More preferably, the distributed fire protection server 200 may include a client register 240 and a fire policy input interface 220 configured to register client information from a distributed fire protection device client that wants to receive a fire protection policy distributed by the distributed fire protection server. An authentication unit 210 and a distributed fire protection device client that authenticate with the fire protection policy generator 100 for inputting a fire protection policy to the fire protection policy generator 100 or the client registration unit 240 and authenticate the distributed fire protection device client 300 that registers client information. The client information storage unit 250 and the fire protection policy input interface unit 220 for storing the client information transmitted when the 300 registers the distributed fire protection server 200 through the client registration unit 240 in a storage device of a computer. Arson policy storage unit 230 for storing the arson policy inputted from the arson policy generator 100 to the storage device of the computer Further included.

The distributed fire protection device client 300 receives the fire protection policy from the fire protection policy distribution unit 260 of the distributed fire protection device server 200 and the fire protection policy received from the fire protection policy receiver 310. The fire protection policy output interface unit 330 outputs to the target fire protection device 400.

More preferably, the distributed fire protection device client 300 further includes a user guide 320 that outputs a guide or warning message included in the fire protection policy received from the fire protection policy receiver 310 to the user.

4 is a block diagram of a distributed fire prevention apparatus according to a preferred embodiment of the present invention. Referring to FIG. 4, a configuration relationship between the fire protection policy generator 100, the distributed fire protection device server 200, the distributed fire protection device client 300, and the target fire protection system 400 will be described.

Referring to FIG. 4, the input device 550 of the system administrator or the system administrator, the fire protection device 530 installed at the front of the application server, the application server 540, and the like correspond to the fire protection policy generator 100. The fire protection policy generator 100 generates a fire protection policy and inputs a fire protection policy to the distributed fire protection server 200. Referring to FIG. 4, 560 corresponds to a distributed fire protection device server. The distributed fire protection server 560 of FIG. 4 distributes the fire protection policy input from the fire protection policy generators 530, 540, and 550 to the distributed fire protection device client through a predetermined determination process. Referring to FIG. 4, 510a, 510b, and 520c receiving a fire protection policy from the distributed fire protection server 560 correspond to the distributed fire protection device client. In the distributed fire protection device clients 510a, 510b, and 520c, a target fire protection device 400 which actually executes the fire protection policy using the fire protection policy output from the distributed fire protection device client 300 and the distributed fire protection device client 300 is provided. do.

The distributed fire protection server 200 may be implemented with equipment 560 that is physically separated from the fire protection policy generators 530, 540, 550, as illustrated in FIG. 4, and the fire protection policy generators 530, 540, 550. It may be implemented in a single device or server that is physically integrated with, and may be implemented as a distributed system using a plurality of networked computer systems. As an example in which the distributed fire protection server 200 is implemented in the form of a single device or server that is physically integrated with the fire protection policy generator 100, the distributed fire protection server may be implemented in the form of a process executed in an application server. Could be.

The distributed fire protection device clients 510a, 510b, and 520c of FIG. 4 receive a fire protection policy to be applied to the target fire protection system 400 from the distributed fire protection device server 200, and output the fire protection policy to the target fire protection system 400. Allow the fire protection system 400 to carry out the fire protection policy. The target fire protection device 400 may be a fire protection device implemented in a conventional personal computer or network equipment, or may be a fire protection device manufactured separately for implementing the distributed fire protection device according to the present invention. In addition, when the distributed fire prevention apparatus according to the present invention is operated in a chaining manner may be a distributed fire prevention apparatus server constituting another distributed fire prevention apparatus.

Hereinafter, each element constituting the distributed fire protection device server 200 and the distributed fire protection device client 300 will be described in detail.

The fire protection policy input interface 220 of the distributed fire protection device server 200 receives a fire protection policy from the fire protection policy generator 100. At this time, the arson policy input interface unit 220 preferably provides a consistent interface to the various arson policy generators 100 in order to receive the arson policy from the various arson policy generators 100. The interface can be any type such as a form using network communication such as TCP / IP, a form using IPC (Inter Process Communication), a form using a web service, a form using a command line interface, or a form using a graphical user interface. The message containing the fire protection policy input through the interface can be in any form, such as text-based, binary-based, or XML-based.

The fire protection policy input from the fire protection policy generator 100 to the distributed fire protection server 200 includes a packet origin information, a packet destination information, a rule to be applied to the packet, and more preferably, a transport layer protocol (TCP, UDP, etc.). ), May further include a guide message. The source information of the packet includes the source address of the packet and preferably further includes the source port number of the packet. The destination information of the packet includes the destination address of the packet and preferably further comprises the destination port number of the packet. At this time, the source or destination address of the packet may be in the form of an IP address, a domain name address, a fully qualified domain name (FQDN), etc., and may be an address representing a specific host or a network node or an address including a specific network band. . For example, it may represent a network band including 192.168.0.1 to 192.168.0.255 in the form of 192.168.0.0/24, and all subdomain name addresses that have example.com as the parent domain name in the form of * .example.com. It may also include a host or a network node.

The fire protection policy distribution unit 260 of the distributed fire protection device server 200 distributes the fire protection policy input through the fire protection policy input interface unit 220 to the distributed fire protection device client 300. At this time, the fire prevention policy may be distributed to all the distributed fire protection client 300 known to the distributed fire prevention server 200, but more preferably, a network path connecting the source address and the destination address of the packet included in the fire protection policy. Distribute the fire protection policy only to distributed fire protection clients located on the network.

The fire protection policy receiving unit 310 of the distributed fire protection device client 300 receives the fire protection policy distributed from the fire protection policy distribution unit 260. The method of connecting the fire prevention policy distribution unit 260 and the fire protection policy receiving unit 310 may be any means suitable for digital data communication such as TCP / IP communication and IPC communication. In addition, the message including the fire protection policy transmitted from the fire protection policy distributing unit 260 to the fire protection policy receiving unit 310 may be any form such as text-based, binary-based, or XML-based. Various embodiments of transferring data between processes or between network nodes are well known techniques known to those skilled in the art, and thus will not be described in more detail.

The fire protection policy output interface unit 330 of the distributed fire protection device client 300 outputs the fire protection policy received by the fire protection policy receiver 310 to the target fire protection device 400. At this time, it is preferable that the arson policy output interface unit 330 provides a consistent interface to the various target arson apparatuses 400. The method of outputting the fire prevention policy to the target fire protection system 400 includes TCP / IP communication, IPC communication, communication using a shared data structure, a method using a predetermined variable, a predetermined function or procedure. Any form, such as a method of calling or executing a predetermined instruction, can be used.

The distributed fire protection device server 300 preferably further includes a fire protection policy storage 230. The arson policy storage unit 230 stores the arson policy input through the arson policy input interface 220 in a storage device of the computer.

The reason why the fire prevention policy storage unit 230 is provided is a network path that connects the source address of the packet included in the fire policy with the destination address of the packet when the fire policy is received through the fire policy input interface 220. This is because all of the distributed fire protection client 300 located at may be in an offline state instead of being connected to the distributed fire protection server 200 for various reasons. The reason why the distributed fire protection client 300 is offline may be that the system including the distributed fire protection client 300 is temporarily rebooting, may be due to a network related failure, or the distributed fire protection client 300 may be included. This may be because the system is off. Therefore, in this case, the distributed fire protection client 300 located on the network path associated with the fire protection policy needs to hold the fire protection policy until it is later connected to the distributed fire protection server 200 and ready to receive the fire protection policy. In this case, the arson policy storage unit 230 plays a role.

The storage device of the computer implementing the arson policy storage unit 230 may be any type such as a main storage device of the computer, a secondary storage device of the computer, a relational database management system, a storage system using a distributed system, and the like. Since the embodiment is a well known technique known to those skilled in the art, more detailed description will be omitted.

6 is an exemplary view of a fire policy database stored by the fire policy storage unit 230 according to an exemplary embodiment of the present invention. Referring to FIG. 6, the arson policy database includes packet origin information 703, packet destination information 704, and rule information 705 to be applied to traffic with matching conditions, more preferably transport layer protocol information. 702, the guide message 706 to be output to the user, and a fire policy generator identifier 701 that can uniquely identify the fire policy generator 100 that generated the fire policy. The source information 703 of the packet and the destination information 704 of the packet include address information and preferably further include port information.

The arson policy generator identifier 701 is information capable of uniquely identifying the arson policy generator 100 having inputted the arson policy to the distributed arson apparatus server 200. The arson policy generator identifier 701 is present for management purposes to identify the arson policy creator 100 that has entered each arson policy. As the arson policy generator identifier 701, an address of the arson policy creator 100, a socket descriptor number associated with the arson policy creator 100, an ID previously assigned to the arson policy creator 100 may be used. .

The transport layer protocol information 702 indicates the type of transport layer protocol among the conditions of traffic to which the arson policy is to be applied. Commonly used transport layer protocols include TCP and UDP, but other protocols may be used.

The source information 703 of the packet indicates information on the source of the packet among the conditions of the traffic to which the arson policy is to be applied. Information about the source of the packet may include a source address of the packet and a source port number of the packet. The source address of the packet can be in any form, such as an IP address, a domain name address, or a fully qualified domain name (FQDN). In the case of an IP address, it may contain all of a specific network address, and in the case of a domain name, it may include all of a specific subdomain. The source port number of a packet may restrict the condition of the packet to a particular port number and may include all port numbers. Since the setting of the condition of the packet in the fire prevention apparatus in this form is a technique widely known for the public administration, a detailed description thereof will be omitted.

The destination information 704 of the packet indicates information on the destination of the packet among the conditions to which the arson policy is applied. The information on the destination of the packet may include the destination address of the packet and the destination port number of the packet, and details thereof are similar to the source information 703 of the packet, and thus a detailed description thereof will be omitted.

The rule information 705 represents a rule to apply when the packet meets the condition. Rules can be blocked and allowed, and other forms of traffic can be limited below a predetermined number (eg 500 KB / s).

The guide message 706 is a message for outputting a guide or warning light to the user when the blocking or restriction of traffic is applied. In the related art, when harmful traffic such as a DDOS attack to an application server is detected, all the DDOS attack traffic is rejected or dropped (DROP). Therefore, the user of the computer generating the DDOS attack traffic accesses the application server. They couldn't be provided with information about why the blocking occurred, how to stop the attack, and where to contact to request an unblocking. Therefore, in this case, the prior art has contacted and guided the user of a computer whose traffic was blocked by using conventional means such as telephone contact. The guidance message 706 is to solve the problems of the prior art, and when the traffic is blocked or restricted in the fire protection device, the guidance message or warning message is sent to the user of the computer using the distributed fire protection device client 300. For output.

The distributed fire protection server 200 preferably further includes a client register 240 and a client information storage 250. The client registration unit 240 receives the client information from the fire protection policy receiver 310 of the distributed fire protection device client 300 that wants to receive a fire protection policy from the fire protection policy distribution unit 260 of the distributed fire protection device server 200. The client information storage unit 250 stores the client information received from the client registration unit 240. That is, the arson policy receiver 310 connects to the client register 240 before receiving the arson policy from the arson policy distribution unit 260 and transmits information on the distributed arson apparatus client 300 to the distributed arson apparatus server 200. Register.

Effects and operations of the client register 240 and the client information storage 250 will be described with reference to FIG. 4 by way of example.

First, in the case where there is no great difficulty in the operation of the distributed fire protection apparatus according to the present invention even without the client registration unit 240 and the client information storage unit 250, the address of the application server 540 is 192.168.0.100 and a personal computer. Assume that the address of 510a is 192.168.0.2. At this time, when the personal computer 510a attempts a DDOS attack to the application server 540, the application server 540 detects that DDOS attack traffic is generated from the personal computer 510a and uses the server-side fire protection device 530. A fire protection policy for blocking traffic transmitted from 0.2 to 192.168.0.100 and blocking traffic transmitted from 192.168.0.2 to 192.168.0.100 is input to the distributed fire protection server 560 according to the present invention. The distributed fire protection server 560 then distributes the fire protection policy to the distributed fire protection client within the personal computer 510a having an address of 192.168.0.2 and the distributed fire protection client within the personal computer 510a receives the received fire protection policy from the personal computer 510a. It outputs to the target fire prevention device provided in the inside so that a fire prevention policy can be performed. Since DDOS attack traffic is blocked within the personal computer 510a, it can block harmful traffic before it enters the public internet, and prevent the public internet from being congested with harmful traffic.

In the case of the above example, the distributed fire protection device according to the present invention operates without difficulty even though the client register 240 and the client information storage unit 250 are not separately provided in the distributed fire protection device server 200. However, this is because in the above example, the distributed fire protection client and the target fire protection device were provided in the personal computer 510a having the address of 192.168.0.2.

Referring again to FIG. 4, for example, when the client registration unit 240 and the client information storage unit 250 are necessary, the address of the application server 540 is 192.168.0.100 and the address of the personal computer 510c is 192.168.0.4. Assume The personal computer 510c is not provided with the distributed fire protection client and the target fire protection device, and the distributed fire protection device client and the target fire protection device according to the present invention is provided in the router and firewall equipment 520c installed in front of the personal computer 510c. Assume that it is. At this time, if the personal computer 510c transmits harmful traffic for the DDOS attack to the application server 540, the application server 540 detects that DDOS attack traffic is generated from the personal computer 510c, and the server-side fire protection device 530 is detected. A fire protection policy for blocking traffic transmitted from 192.168.0.4 to 192.168.0.100 and blocking traffic transmitted from 192.168.0.4 to 192.168.0.100 is input to the distributed fire protection server 560 according to the present invention. The distributed fire protection server 560 then attempts to distribute the fire protection policy to the distributed fire protection client within the personal computer 510c of 192.168.0.4, but since the personal computer 510c does not have the distributed fire protection client, The policy cannot be deployed. However, in this case, if the arson policy is distributed to the router and firewall 520c installed in front of the personal computer, harmful traffic may be blocked at an early stage when harmful traffic enters the public Internet.

At this time, the fire protection policy receiving unit 310 of the distributed fire protection device client 300 according to the present invention provided in the router and firewall 520c is connected in advance to the client registration unit 240 of the distributed fire protection device server 200 to configure the router and firewall. It is registered in the location where the 520c can control the traffic of the personal computer 510c as the distributed fire protection server 200, and the client register 240 stores the client information in the client information storage 250. Then, the distributed fire protection server 560 of FIG. 4 distributes a fire prevention policy that blocks traffic generated from the personal computer 510c to 520c, which is a router and a firewall, to block harmful traffic from the personal computer 510c.

If the distributed fire protection device according to the present invention is implemented in a small scale internetwork, it may be possible to distribute the fire protection policy to all hosts and network nodes having the distributed fire protection client and the target fire protection device in the internetwork. . However, in an Internet-wide environment in which many hosts and network nodes are connected, if the arson policy is distributed to all hosts and network nodes, a considerable amount of traffic may be used for the distribution of the arson policy. Only the host and network nodes located on the network path connecting the source address of the packet included in the fire prevention policy and the destination address of the packet included in the address of the traffic source in charge of the distributed fire protection device client 300 in advance It is desirable to distribute selectively.

Referring to FIG. 5, which shows an exemplary diagram of a client information database stored in a client information store in accordance with a preferred embodiment of the present invention, the client information includes a client identifier 601 and at least one traffic source address 602. .

The client identifier 601 is an identifier for uniquely identifying the distributed fire protection client 300. The IP address, domain name address, socket descriptor number, etc. of the host or network node provided with the distributed fire protection client 300 It is also possible. The client identifier 601 may be explicitly transmitted by the distributed fire protection client 300 or may be implicitly transmitted. An example of explicitly transmitting the client identifier 601 is a case in which the distributed fire protection client 300 directly transmits its identifier using a predetermined application protocol, and implicitly transmits the client identifier 601. An example of the case is the case where the client register 240 extracts relevant information from the communication channel established with the fire protection policy receiver 310 of the distributed fire protection device client 300. For example, if the client register 240 and the fire policy receiver 310 are connected through a TCP / IP socket, the client register 240 may extract the IP address of the distributed fire protection device client from the socket connection.

The traffic source address 602 represents the address of the traffic source managed by the target fire protection device 400 connected to the distributed fire protection device client 300. A traffic source is a host or network node that generates traffic. The traffic source address 602 means the address of the traffic source protected by the target fire protection device 400. In the above example, the router and firewall 520c has the personal computer 510c as a host of the internal network. The traffic source address managed is 192.168.0.4. When the distributed fire protection client 300 is provided in the same physical computer as the traffic source, the traffic source address 602 is one because the traffic source address is that computer, but the distributed fire protection client 300 is the traffic source. In the case of network equipment (eg, routers) that are physically separated from each other, the traffic source address 602 of the distributed fire protection client 300 may be one or more. This is because routers, switches, and independent firewall devices can be connected to one or more hosts and perform fire protection against one or more hosts.

Therefore, in the above example, the fire protection policy receiving unit 310 of the distributed fire protection device client 300 provided in the router and firewall 520c connects to the client registration unit 240 of the distributed fire protection server 200 and transmits the traffic source together with the client identifier. Send the address 192.168.0.4. At this time, if a fire policy having a source address of 192.168.0.4 is input to the fire policy input interface unit 220, the fire policy distribution unit 260 is a distributed fire protection device client having a traffic source address registered as 192.168.0.4. Search and distribute the fire protection policy to the distributed fire protection device client. Then, although router and firewall 520c is not a host with an address of 192.168.0.4, but is registered as a distributed fireproofing server that manages a host of 192.168.0.4 as a distributed fireproofing server, it starts from 192.168.0.4. Receive a fire protection policy to block the packet to be carried out, and the received fire protection policy can be performed in the router and firewall 520c.

The client information storage unit 250 stores the client information received from the client registration unit 240, and distributes the fire protection policy to any distributed fire protection device client 300 before the fire policy distribution unit 260 distributes the fire protection policy. It is used as judgment data to decide whether to do it. If only the client registration unit 240 is provided and the client information storage unit 250 is not provided, the fire protection policy receiver 310 of the distributed fire protection device client 300 continuously keeps the client information at periodic time intervals. You should check if there is a fire protection policy to receive. This method is called polling, which is applicable only in a small network environment, and is an inefficient method that is practically difficult to apply in a large device targeting the Internet. Therefore, in order to avoid such an inefficient operation, it is preferable to include the client information storage unit 250 when the client registration unit 240 is provided.

The distributed fire protection device server 200 may be configured to authenticate the fire protection policy generator 100 connected to the fire protection policy input interface 220 or the distributed fire protection device client 300 connected to the client register 240. It is preferable to further include 210. In particular, in the case of the fire protection policy generator 100 for inputting the fire protection policy into the distributed fire protection server 200, the fire protection policy is input through the fire protection policy input interface 220 only when authentication passes through a predetermined authentication procedure. It is preferable. Otherwise, a malicious hacker could enter the wrong arson policy and disrupt the network arson system. Similarly, when the distributed fire protection device client 300 tries to receive a fire protection policy, it is more preferable in terms of security that the distributed fire protection device client 300 undergoes an authentication procedure to confirm that the legitimate distributed fire protection device client 300 is correct.

The authentication unit 210 authenticates the fire protection policy generator 100 or the distributed fire protection device client 300 by using a symmetric key or a public key, a method using an ID and a password pair, a fire policy generator 100 or a distribution. Any method, such as a method of using the network address of the fire protection device client 300 may be possible. These various embodiments are well known to those skilled in the art, and thus, a detailed description thereof will be omitted.

The distributed fire protection device client 300 may further include a user guide 320 that outputs a guide message included in the fire protection policy received from the fire protection policy receiver 310 to the user. In the prior art, when the traffic transmitted by the personal computer is rejected or dropped by the server side fire protection device, the user of the personal computer cannot connect to the server without being informed of any reason or guidance. Therefore, in the related art, a user of a personal computer and an administrator of an application server used a conventional means such as a telephone call to explain a reason for traffic blocking. The user guide 320 outputs a guide message related to the user of the personal computer even when the application server side rejects or discards the traffic transmitted by the personal computer. The user of the personal computer can be immediately informed about the reason why the traffic was blocked or the solution.

The user guide 320 may be implemented by using a window in which a message is output on a screen of a user computer, using a pop-up window, and when a user attempts to access a web page of an application server in a form of an HTML page. Any form can be used, such as printing in a web browser. These various embodiments are well known to those skilled in the art, and a detailed description thereof will be omitted.

The operation method of the distributed fire protection apparatus according to the present invention can take various forms.

First, as illustrated in FIG. 4, at least one fire protection policy generator 530, 540, 550 and at least one distributed fire protection client 510a, 510b, 520c may be connected to the distributed fire protection server 560. This type of operation has advantages in that it is easy to manage and the complexity of network connection is low.

In another mode of operation, a plurality of distributed fire protection devices according to the present invention may be connected in a chaining manner. In this operation mode, the fire protection policy generator 100 is connected to the fire protection policy input interface unit 220 of the first distributed fire protection device server 200, and the fire protection policy distribution unit 260 of the first distributed fire protection device server 200. Is connected to the fire protection policy receiver 310 of the first distributed fire protection device client 300, the fire protection policy output unit 330 of the first distributed fire protection device client 300 is a fire protection of the second distributed fire protection device server 200. The policy input interface 220 may be connected to input a fire prevention policy. At this time, the target fire protection device 400 connected to the first distributed fire protection device client 300 becomes the distributed fire protection device server 200 of the second distributed fire protection device, and the distributed fire protection device server 200 of the second distributed fire protection device. ) Is connected to the fire protection policy generator 100 is a distributed fire protection device client 300 of the first distributed fire protection device. In this way a plurality of distributed fire protection devices according to the invention can be connected in a chaining manner. This type of operation has the advantage of mitigating the phenomenon of load concentrating in one distributed fire protection device because the distributed fire protection device according to the present invention is distributed locally rather than centrally operated.

Hereinafter, a dispersion fire prevention method according to a preferred embodiment of the present invention will be described with reference to FIG. 2. In the description, portions overlapping with the above description are omitted.

2 is a flowchart of a distributed fire prevention method according to a preferred embodiment of the present invention. Referring to FIG. 2, in the distributed fire protection method, a fire protection policy input step (S105) in which a distributed fire protection device server receives a fire protection policy from a fire protection policy generator, and the fire protection policy distributed in the fire protection policy server in the fire protection policy server Fire protection policy distribution step for distributing to the client (S107), Fire prevention policy receiving step (S108), the distributed fire protection device client receives the fire protection policy distributed in the fire protection policy distribution step, Distributed fire protection device client in the fire protection policy receiving step And a fire protection policy output step S110 of outputting the received fire protection policy to the target fire protection device.

More preferably, the distributed fire prevention method, in the client registration step (S102), the client registration step (S102) to receive the client information from the distributed fire protection device client that wants to receive the fire protection policy distributed by the distributed fire prevention device server Before the client information is registered from the fire protection client, the client authentication step of performing authentication on the distributed fire protection device client (S101), and the client information transmitted from the distributed fire protection device client to the distributed fire protection server in the client registration step (S102). Client information storage step (S103) for storing in the storage device of the computer, the fire policy generator authentication step (S104) to perform authentication for the fire policy creator before receiving the fire policy from the fire policy producer in the fire policy input step (S105). ), The above fire prevention policy Fire protection policy storage step (S106) of storing the fire protection policy inputted from the fire protection policy creator in the storage device (S105) in the storage device of the computer, the user guide message contained in the fire protection policy received in the fire protection policy receiving step (S108). It further includes a user guide step (S109) to output.

In the client authentication step (S101), the fire protection policy receiver 310 of the distributed fire protection device client 300 connects to the client register 240 of the distributed fire protection device server 200 and undergoes a predetermined authentication process.

In the client registration step (S102), the distributed fire protection device client 300 that has passed the client authentication process (S101) and the address information of the traffic source managed by the target fire protection system 400 connected to the distributed fire protection device client 300 and Client information including a client identifier capable of uniquely identifying the distributed fire protection device client 300 is transmitted to the client register 240 to register the distributed fire protection device client 300 with the distributed fire protection device server 200.

In the client information storing step (S103), the client registration unit 240 stores the client information received in the client registration step (S102) in the client information storage unit 250.

In the arson policy generator authentication step (S104), the arson policy generator 100, which wants to input the new arson policy to the distributed arson apparatus 200, connects to the arson policy input interface 220 and undergoes a predetermined authentication process.

In the arson policy input step (S105), the arson policy is received from the arson policy generator 100 that has passed the arson policy creator authentication step (S104).

In the arson policy storage step (S106), the arson policy received in the arson policy input step (S105) is stored in the arson policy storage unit 230.

In the arson policy distribution step (S107), the arson policy input in the arson policy input step (S105) is distributed to the distributed fire protection device client 300. The fire protection device client 300 to distribute the fire protection policy is preferably a host or a network node located on a network path connecting the source address of the packet included in the fire policy and the destination address of the packet, and registering the client (S102). If there is distributed firearms client information registered in advance, the fire control policy is distributed to distributed firearms clients having the source address of the packet included in the fire prevention policy as the traffic source address.

In the arson policy receiving step (S108), the arson policy receiver 310 of the distributed arson apparatus client 300 receives the arson policy from the arson policy distribution unit 260.

In the user guide step (S109), the guide message included in the fire prevention policy received in the fire prevention policy receiving step (S108) is output to the user.

In the arson policy output step (S110), the arson policy received in the arson policy receiving step (S108) is outputted to the target arson apparatus 400 connected to the distributed arson apparatus client 300, so that the target arson policy applies the predetermined arson policy. Make it work.

As described above, the specific contents of the present invention have been described through the limited embodiments and the drawings, but the present invention is not limited thereto, and the technical spirit of the present invention will be described by those skilled in the art to which the present invention pertains. It is obvious that various modifications and variations are possible within the scope of the equivalent claims. Therefore, it is understood that the technical spirit of the present invention to the extent that various changes or modifications can be made by those skilled in the art without departing from the gist of the present invention claimed in the claims below. shall.

1 is a block diagram of a distributed fire protection apparatus according to a preferred embodiment of the present invention,

2 is a flowchart of a distributed fire prevention method according to a preferred embodiment of the present invention,

3 is a block diagram of a fire protection device according to the prior art,

4 is a block diagram of a distributed fire prevention apparatus according to a preferred embodiment of the present invention,

5 is an exemplary diagram of a client information database stored in a client information storage unit according to a preferred embodiment of the present invention.

6 is an exemplary diagram of a fire prevention policy database stored in a fire prevention policy storage unit according to a preferred embodiment of the present invention.

<Description of Major Symbols in Drawing>

100: Arson Policy Constructor

200: distributed fireproof server

300: distributed fireproofing client

510a, 510b, 510c: personal computer

520a, 520b, 520c, 520d, 520e: network equipment

530: server side fire protection device

540: application server

550: system administrator

560: distributed fireproof server

Claims (3)

Fire protection device for controlling network traffic, Distributed fire protection server; At least one distributed fire protection client connected to the distributed fire protection server; Including, The distributed fire prevention device server, A fire protection policy input interface configured to receive a fire protection policy from a fire policy creator; A fire prevention policy distribution unit distributing the fire protection policy received through the fire protection policy input interface unit to distributed fire protection device clients; Including, The distributed fire prevention device client, An arson policy receiver for receiving a arson policy from the arson policy distributor; A fire prevention policy output interface unit for outputting the fire prevention policy received by the fire protection policy receiver to a target fire protection device; Fire protection device for a wide area network comprising a. The method of claim 1, Distributed fireproof server, A client register configured to register client information from a distributed fire protection device client that wants to receive a fire protection policy distributed by the distributed fire protection device server; Fire protection device for a wide area network, characterized in that it further comprises. As a fire prevention method for controlling network traffic, An arson policy input step of receiving, by the distributed arson apparatus server, an arson policy from an arson policy creator; A fire protection policy distribution step of distributing the fire protection policy received in the fire protection policy input step to a distributed fire protection device client by a distributed fire protection device server; An arson policy receiving step of receiving, by the distributed arson apparatus client, the arson policy distributed in the arson policy distribution step; An arson policy output step of distributing the arson policy received in the arson policy receiving step by a distributed arson device client to a target arson device; Fire prevention method for a wide area network comprising a.

Images