KR20120058670A - Unified gateway device for providing dbtabase security - Google Patents

Abstract

PURPOSE: An integrated gateway apparatus is provided to effectively solve service delay problems by applying processing technology for packets on a network. CONSTITUTION: An integrated gateway apparatus(100,300) provides firewall, IDS(Intrusion Detection System), IPS(Intrusion Prevention System), a virtual network supported by a tunneling protocol, and a security function including the web caching of a proxy server. The integrated gateway apparatus is combined with hardware. A solution of a gateway method is applied to the integrated gateway apparatus. The integrated gateway apparatus processes database security, online hacking, and online cracking.

Description

Unified gateway device that provides security for security {UNIFIED GATEWAY DEVICE FOR PROVIDING DBTABASE SECURITY}

The present invention relates to an integrated gateway device that provides DB security.

DB (Database) means that a variety of information is aggregated by the system. All information collected through the website is stored in this DB and used. Among them, various personal information such as social security number, mobile phone, and e-mail are included in DB.

For example, in recent years, the customer information DB of an auction shopping mall has been hacked, and not only the hacking accident but also the response to the damage compensation of the hacked customer has become a big topic. Recently, lawsuits are emerging because these databases containing personal information lead to the infringement of information subject's privacy due to hacking or illegal leakage of insiders.

The key criterion for such a lawsuit will be whether the company has done sufficient information protection to protect the database of customer information. As soon as information protection activities are not only an effort to protect corporate information assets, but also an important judgment basis in legal judgment, the issue of DB security has been thrown into all companies that collect personal information. The problem is that DB security is never an easily accessible problem.

DB security can seem like a very simple problem. It may be argued that if the DB is concentrated on a specific server to minimize access and apply strict control rules, the problem of DB leakage may be reduced. It may be the correct answer, but practically it will not be possible in two ways.

First of all, the strict control policy is to hinder the convenience of using DB from the business point of view, and the second problem is that there are too many scattered and managed DBs scattered all over the place. In terms of business, it is obvious that DB is a very valuable asset, but considering the difficulty of perfect security of DB information and the social wave caused by information leakage, it is obvious that DB is the powder of enterprise information protection.

Recently emerged solutions for DB protection are largely divided into access control and audit methods, and encryption methods to hide data even when information is leaked. First of all, the access control DB security solution allows easy installation of the product by allowing only administrators who can access the DB by applying criteria such as personal authentication, IP, time zone, and DB account in the network. However, if the hard disk containing the DB is physically leaked, there is a high possibility of information leakage, and the failure of the DB security solution may lead to the failure of the corporate network.

On the other hand, the biggest advantage is that DB encryption solution that encrypts data can maintain security by itself. Therefore, the previous access control DB security solution can cope with physical leakage that shows weakness. Even if the database is leaked by hacking, the information stored in the DB can be secured. However, it is pointed out that it takes a lot of time physically in the process of encrypting / decrypting DB and the failure of agent for encryption / decryption.

DB security solutions can be divided into encryption solutions, access control and audit solutions, and access control and audit solutions can be divided into packet sniffing, gateway, and resident agents. Can be.

Database encryption functions are largely divided into encryption functions included in the DBMS itself and encryption functions provided by third parties. Here, the third party products are classified into a method of being installed in a DBMS system in the form of a software agent and a separate hardware appliance according to the product implementation form.

Access control and auditing solution has the strength to control the real-time monitoring and logging, so the solution is aimed at DB access management control and real-time auditing of DB. The packet sniffing method and the gateway method are used. The packet sniffing method is a method of sniffing TCP / IP packets on a network without connecting to a DBMS, selecting and analyzing only SQL packets, and extracting and storing user information in real time. This solution, however, has become increasingly obsolete in the market because it has expertise in tracking and auditing and is not really active security, but is being reissued due to the importance of DB security.

Gateway type solution is configured on network between user PC and DB and provides access control, logging and auditing function for all sessions accessing DB. However, because all packets go through the gateway equipment, there is a concern about service delay and system failure when processing a large amount of work.

Therefore, there is a need to provide an integrated solution that fully accommodates the advantages of the solution for DB protection and minimizes the disadvantages.

An object of the present invention is to provide an integrated gateway device that provides DB security that provides an integrated solution that fully accommodates the advantages of the solution for DB protection and minimizes the disadvantages.

As a technical means for achieving the above-described technical problem, the integrated gateway device providing DB security of the present invention is a packet control, various filtering, network security and other functions, such as DB column security control, parsing, client PKI authentication Provide integrated DB security solution using one or more of each module that provides the function.

As a technical means for achieving the above-described technical problem, the integrated gateway device providing DB security of the present invention can use a kernel using uClibc, Firewall function, VPN function, Proxy & Caching function, Dual WAN function as a security gateway technology Each module includes a Traffic Shaping Qos function.

According to the integrated gateway device providing DB security of the present invention, there is an advantage of providing an integrated solution that fully accommodates the advantages of the solution for DB protection and minimizes the disadvantages.

1 illustrates an example of an integrated gateway device for providing DB security according to an embodiment of the present invention.
2 is a view comparing the IG-300 model and other products.
3 is a view comparing the IG-300 model and the IG-100 model.
4 illustrates an example of a computer system architecture that may be used to perform one or more components or operations of one embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

In addition, throughout the specification, when a part is "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another element in between. do. In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated.

1 illustrates an example of an integrated gateway device for providing DB security according to an embodiment of the present invention.

As shown in (a) and (b) of FIG. 1, an integrated gateway device (hereinafter referred to as an "integrated gateway device") for providing DB security of the present invention may be, for example, an IG-300 model 300 or an IG-. 100 may be implemented as the model 100. In this case, the gateway type solution may be applied to the integrated gateway device in the DB security solution method. In the embodiment of the present invention, in the application of the gateway method, by applying the processing technique for the packet on the network, it is possible to effectively replace and compensate for the service delay, and minimize the system failure. In addition, the integrated gateway device of the present invention provides a function capable of effectively coping with online hacking and cracking as well as DB security.

More specifically, the integrated gateway device of the present invention is at least one or more of each module providing functions such as packet control, various filtering, network security, and DB column-level security control, parsing, client PKI authentication, etc. Provide an integrated DB security solution. In addition, the integrated gateway device of the present invention provides not only DB security but also various security functions such as server security and network security.

In addition, most of the products currently on the market as an integrated hardware product using the embedded OS are software-based installation products that require the expertise of a DB administrator or an information security manager, and the cost is burdensome when purchasing a product. . However, the integrated gateway device of the present invention has the advantage that anyone can easily and quickly install and operate. This allows easy access to SMB markets such as SMEs or government offices that require DB security, so that the DB security market area centered on large companies, large shopping malls or portal companies can be expanded to the SMB market.

In addition, the integrated gateway device of the present invention is expected to have an effect of import substitution as it has a competitive advantage in quality and price with existing domestic and foreign products, and has been certified as a DB security product in regions such as Southeast Asia and China. Export will be possible.

The integrated gateway device is a unified security device (UTM), which is a network appliance that integrates security functions such as firewall, intrusion detection system (IDS), and intrusion prevention system (IPS) into one hardware. Can be.

Also, the embedded OS of the integrated gateway device can be used a kernel using uClibc, and can perform the firewall function, the VPN function, the proxy function, the proxy & caching function, the dual WAN function, and the traffic shaping Qos function.

In addition, the integrated gateway device of the present invention performs a packet filtering function, a DB vendor parsing function, a protocol, a Mac address filtering function, and a user object labeling function for DB column security control. can do. In addition, it is implemented by packet policy establishment and policy application, NAT policy establishment and policy application, DB security policy establishment and policy application, and provides web user interface (Web UI) considering convenience for administrator use. At this time, the evaluation method for each evaluation item can be summarized as shown in Table 1 below.

Evaluation item Assessment Methods 1. Session management and security setting Check whether policy is set by using statistics such as traffic usage and number of sessions using the implemented function, and block setting function and operation status inside and outside 2. Network Load Balancing Outbound load balancing Max Download Bandwidth / Max Upload Bandwidth / Round Robin / Weighted Round Robin 3.Qos (Traffic Shaping) QoS function enables policy management of traffic and bandwidth in limited network line Bandwidth setting function and checking the operation status of the implemented system 4. Proxy &
Cache Transparent proxy checks whether the system checks the operation status, whether the caching function works, and the automatic update function checks the update operation status for 20 sites 5. Parsing / Access Control Analysis of SQL statements when accessing Oracle and MySQL DB and checking status of DB access and blocking according to the results of analysis 6. Flexibility of policy application Verify that administrators can quickly and easily apply internal and external access control when configuring policies 7. Online Control and Report Check the function setting and application through WEB UI
Check the operation status of the integrated control system and the output of the audit report online

In addition, the integrated gateway device is a proxy solution that is implemented to be suitable for small and medium-sized sites, and is processed in a single device and may be an integrated security device used for information protection such as intrusion prevention, intrusion detection, intrusion prevention, and virtual private network.

In addition, the integrated gateway device may be an Internet gateway device suitable for an education network, a public office, and a small and medium-sized business using the Internet using ADSL or a low-speed dedicated line.

In addition, the integrated gateway device is equipped with a dedicated secure embedded OS kernel that minimizes OS vulnerabilities to provide powerful network management, web proxy function, and hacking prevention function. In addition, the integrated gateway device performs real-time monitoring and rapid troubleshooting through functions such as system configuration, performance, and error management.

In addition, the integrated gateway device is an optimized embedded system, which is a hardware-based integrated product, which provides easy management and log analysis, and provides strong content filtering.

More specifically, in the firewall, the integrated gateway device of the present invention blocks access, intrusion, and attack according to the inside and outside of the Internet service type, or records access control function, packet filtering, hacking blocking function, and network conversion. Provide the function.

In addition, in the intrusion blocking, the integrated gateway device of the present invention has a stateful inspection technique having a hybrid method, a strong hacking blocking function by using a dedicated OS that minimizes the vulnerability of the existing commercial OS, and content filtering (web content, FTP, URL, malware filtering, etc.), malicious site blocking (URL / Key Word), SYN Flooding, Ping Flooding, IP Spoofing, IP Fragmentation Attack, Ping of Death, ACK Storm, etc. , Visual Basic), Applets (Java, Active X), Cookies, Intrusion through Internet shortcuts, all external intrusion prevention, segment separation, various network configuration / policy based network access control, internal user internet usage control / NAT / PAT / DMZ / Session Control Management.

In addition, in an intrusion detection system, the integrated gateway device may perform intrusion detection and access blocking using the data and logging data after monitoring the network packet. In addition, it is determined to be an intrusion if it is out of range by applying a predefined data usage rule. Logging data, user activity, and system calls can be monitored and forcedly terminated when an intrusion is detected.

In addition, in intrusion prevention, the integrated gateway device performs session-based and packet-based (IDS-based) abnormality and traffic detection and blocking, and blocks known worms and viruses.

In addition, in the Web cache and proxy functions, the integrated gateway device provides a caching function transparent proxy for internet speed improvement.

In addition, in IPSec and VPN, the integrated gateway device may support virtual private networks between Max 1024-bit encryption, user authentication keys, and IPSec tunneling using hosts that are international standards.

In addition, in the VPN, the integrated gateway device includes a Lan-to-Lan VPN, an authentication algorithm (MD5, SHA-1, HAS-160, etc.), an encryption algorithm (AES, DES, etc.), a tunneling protocol (IPSec, L2TP), a user. Provide authentication (ID / Password).

In addition, the integrated gateway device provides content filtering (URL, key word) and harmful site blocking, session management function, real-time traffic confirmation for each user, dynamic DNS support, and dual gateway support.

In addition, in providing DB security, the integrated gateway device provides transparent proxy / caching (up to 20 site automatic caching updates) in the proxy & caching function.

In addition, the dual WAN function provides outbound load balancing Max Download Bandwidth / Max Upload Bandwidth / Round Robin / Weighted Round Robin, and the Traffic Shaping Qos function provides policy management of traffic and bandwidth.

In addition, in providing a DB security function, the Packet policy can make the network a closed network dedicated to the DB. At this time, the administrator can set the policy policy for each Ethernet port of the development equipment.

In addition, NAT (Network Address Translation) policy adds a NAT function that allows the server's address to be tricked into the outside. SNAT (Source NAT) distributes ports by making several addresses of origin appear as one address outside. DNAT (Destination NAT) is a technology that deceives the DB server as if it is a product when looking at the product from the outside. When the packet arrives, the product converts its destination to the actual DB server and delivers the packet. Exclude NAT (ENAT) is a temporary NAT created to solve the structural problem of packet exchange. NAT function can be used by distinguishing the port connected to DB server and the port connected to internal user.

In addition, WEB UI configures DB security policy setting management and audit report to be viewed in web environment.

And, in providing DB security function, in the management of user object registration, it is possible to register the objects to be used in advance before implementing the DB security policy.

It also adds labels to objects such as networks or user groups so that administrators can easily recognize them.

Here, the types of objects and their uses are as follows.

Network: Labeling the bundle of networks to be referred to in the policy

-Port group: Contents labeled by TCP or UDP ports for use in the policy

-Time group: Contents that label the time of application of the policy for determining Accept / Drop in time.

_ User group: Label content to check the user in DB security policy

In addition, in applying the DB security policy, the port-specific policy checks all packets coming into the corresponding port of TCP and forwards them to the detailed policy, as shown in the word port. It checks whether or not, and whether it is a query / response according to the order of the protocol. If SQL query is included, the content can be decided according to a predefined policy.

2 is a view comparing the IG-300 (300) model and other products in the integrated gateway device. 3 is a view comparing the IG-300 (300) model and the IG-100 (100) model. For example, IG-300 (300) is composed of eight Ethernet ports (two external lines, five internal lines, one service line) and IG-100 (100) four (one external line, internal 2 lines and 1 service line). The operating system used for these integrated gateway devices is powerful in the network and provides many applications.

Meanwhile, the integrated gateway device includes a module that provides multilingual functions such as English, Japanese, and Chinese. In this case, even when the language is changed, it may be operated without modification of the hardware source code, and may be configured to enable normal operation according to the input of the administrator in the changed language.

Although the integrated gateway device of the present invention has been described in connection with specific embodiments, some or all of their components or operations may be implemented using a computer system having a general purpose hardware architecture.

4 illustrates an example of a computer system architecture that may be used to perform one or more components or operations of one embodiment of the present invention.

Hardware system 800 may include a processor 810, cache 815, memory 815, and one or more software applications and drivers related to the functions described above.

Additionally, hardware system 800 includes a high performance input / output (I / O) bus 840 and a standard I / O bus 870. The host bridge 820 couples the processor 810 to the high performance I / O bus 840, and the I / O bus bridge 850 couples the two buses 840 and 870 with each other. System memory 860 and network / communication interface 830 are coupled to high performance I / O bus 840. The hardware system 800 may further include a video memory (not shown) and a display device coupled to the video memory. Mass storage 830 and I / O port 890 are coupled to standard I / O bus 870. Hardware system 800 may optionally include a keyboard and pointing device, and a display device (not shown) coupled to standard I / O bus 870. Collectively, these elements are intended to represent a wide range of computer hardware systems, including but not limited to general-purpose computer systems based on Pentium processors manufactured by Intel, as well as other suitable processors.

The components of hardware system 800 are described in more detail below. More specifically, network interface 830 provides communication between a hardware system and any wide range of networks, such as an Ethernet (eg, IEEE 802.3) network or the like. In one embodiment of the invention, the network interface 830 connects between the hardware system 800 and the network so that the hardware system 800 manages their databases. Mass storage 830 provides permanent storage for data and programming instructions to perform the above-described functions implemented in one embodiment of the present invention, and system memory 860 (e.g., DRAM) includes a processor ( When executed by 810, it provides temporary storage for data and programming instructions. I / O port 890 is one or more serial and / or parallel communication ports that provide communication between additional peripheral devices that may be coupled to hardware system 800.

Hardware system 800 may include various types of system architectures, and various components of hardware system 800 may be rearranged. For example, the cache 815 may be embedded in the processor 810. Optionally, cache 815 and processor 810 may be bundled together as a “processor module,” where processor 810 may be referred to as a “processor core”. In addition, certain embodiments of the invention may not require or include all of the foregoing components. For example, peripherals shown as being coupled to the standard I / O bus 870 may couple to the high performance I / O bus 840. In addition, in any embodiment there may be only one bus and components of hardware system 800 may be coupled to that one bus. Moreover, hardware system 800 may include additional components such as additional processors, storage devices, or memory. As discussed below, the operation of one embodiment of the present invention may be implemented as a series of software routines driven by hardware system 800. Such software routines include a plurality or series of instructions that may be executed by a processor in a hardware system such as processor 810. First, a series of instructions are stored in a storage device such as mass storage device 830. However, the sequence of instructions may be stored on any suitable storage medium, such as diskette, CD-ROM, ROM, EEPROM, or the like. Moreover, the series of commands need not be stored locally, and can be received from a remote storage device such as a server on the network via the network / communication interface 830. The instructions are copied from a storage device such as mass storage device 830 to system memory 860 and accessed and executed by processor 810.

The operating system manages and controls the operation of the hardware system 800, including data input / output with software applications (not shown). The operating system provides an interface between the software applications running on the system and the hardware components of the system. The operating system according to an embodiment of the present invention may be Microsoft's Windows 95/98 / NT / XP / VISTA operating system. However, the present invention can also be used in other suitable operating systems, such as Apple Computer's Apple Macintosh operating system, UNIX operating system, Linux operating system, and the like.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the above description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

100: IG-100
300: IG-300

Claims (5)

In the integrated gateway device for network and database security,
Drive to support security functions including firewall, intrusion detection (IDS), intrusion prevention (IPS), virtual private network (VPN) support using IPSec, a tunneling protocol, and web caching of proxy servers And an integrated gateway device integrated into one piece of hardware.
The method of claim 1, wherein the quality of service (Qos) and session management, real-time traffic confirmation per user, dual broadband network (WAN), dynamic domain name system (DNS), and network address are supported while supporting the security function. An integrated gateway device further driven to support performing add-ons, including translation (NAT) and web user interface support.
The method of claim 1, wherein the security function related to the intrusion prevention function includes a function of blocking access, intrusion, and attack from inside or outside of the Internet service, a function of controlling record access, a function of filtering a packet, and a hacking blocking function. And a network translation function.
The security function of claim 1, wherein the security function related to the intrusion prevention is integrated including a hybrid state inspection technique, content filtering, malicious site blocking, automatic detection of hacking, segment separation management and session control management for network access control. Gateway device.
The integrated gateway device of claim 1, wherein the security function related to the intrusion detection is performed by using data and logging data obtained from monitoring a network packet or by determining whether the security function is out of a range of a predefined data usage rule. .

Images