KR20140044988A - Security system and operating method thereof - Google Patents

Abstract

The present invention relates to a network and, more specifically, to a security system and an operation method thereof. The operation method of the security system according to an embodiment of the present invention comprises the steps of: monitoring packets communicated via an Internet network between a plurality of host computers and a domain name system (DNS) server; determining whether each packet is a DNS response packet including an IP address; and extracting the IP address from the determined DNS response packet. [Reference numerals] (AA) Start; (BB) No; (CC) Yes; (DD) End; (S110) Monitoring packets; (S120) DNS response packet including an IP address?; (S130) Extracting the IP address corresponding to a domain name from the DNS response packet; (S140) Adding the extracted IP address to an IP address table

Description

[0001] SECURITY SYSTEM AND OPERATING METHOD THEREOF [0002]

The present invention relates to networks, and more particularly to a security system and a method of operation thereof.

A Domain Name System (DNS) is used as a system for managing a domain name (e.g., Fully Qualified Domain Name, FQDN) on the Internet. In this case, the domain name and the IP address of the server computer are mapped and registered in the DNS server. In this state, the user of the host computer (for example, client computer) It is possible to input a domain name without inputting it, to first request to the DNS server what IP address corresponds to the domain name, and to receive the IP address from the DNS server, thereby accessing the server computer indicated by the IP address. By using the domain name system, you can connect to the server computer by entering the domain name instead of the hard-to-remember IP address.

A plurality of IP addresses can correspond to one domain name. For example, a plurality of server computers each providing a service of a homepage corresponding to one domain name can be operated.

Assume that the number of IP addresses corresponding to the domain name www.XXXX.net is 12. It is assumed that a security system managing a plurality of host computers wants to obtain IP addresses corresponding to www.XXXX.net. The security system will ask the DNS server for a DNS query packet to obtain the IP address corresponding to the domain name. At this time, even if the security system repeatedly transmits DNS query packets, the DNS server can provide only two IP addresses. That is, no matter how many DNS query packets are transmitted from a single destination (i.e., the security system) to the DNS server, the number of IP addresses provided by the DNS server may be limited. Accordingly, the security system can not efficiently obtain the IP addresses corresponding to the domain names.

Also, when a global service load balancing (GSLB) scheme is used, different IP addresses are provided for one domain name according to the DNS server. At this time, the IP addresses that the security system can obtain in association with one domain name may be limited.

It is an object of the present invention to provide a security system for efficiently obtaining IP addresses to which host computers connect.

A method of operating a security system according to an embodiment of the present invention includes monitoring packets communicated between a plurality of host computers and a DNS (Domain Name System) server through the Internet network; Determining whether each of the packets is a DNS response packet including an IP address; Extracting the IP address from the identified DNS response packet, and storing the extracted IP address.

In an embodiment, the DNS response packet may be provided to any one of the plurality of host computers from the DNS server in response to a DNS query packet from any one of the plurality of host computers.

In an embodiment, the DNS query packet corresponds to a domain name, and the extracted IP address may be matched with the domain name and stored.

In an embodiment, the determining may be performed based on a header of each of the packets.

In an embodiment, the header may include flag information indicating whether the packet is the DNS response packet.

In an embodiment, the header may include flag information indicating whether the IP address exists in the DNS response packet.

In an embodiment, the method of operating the security system may include detecting a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network, and storing information about the plurality of DNS query packets The method comprising the steps of:

In one embodiment, the destination of the DNS response packet is any one of the plurality of host computers, and the method of operation of the security system may further include, based on the information on the plurality of DNS query packets, And determining whether a DNS query packet corresponding to the DNS response packet exists.

In an embodiment, the step of storing the extracted IP address may include extracting and storing the IP address from the DNS response packet when a DNS query packet corresponding to the DNS response packet exists.

Another aspect of the invention relates to a security system. A security system according to an embodiment of the present invention includes a security device configured to manage a plurality of host computers connected to an Internet network; And a sniffing device configured to monitor packets communicated over the Internet network between the plurality of host computers and a DNS (Domain Name System) server, the sniffing device comprising: Determine whether each is a DNS response packet including an IP address, and extract and store the IP address from the determined DNS response packet.

In an embodiment, the DNS response packet may be provided to any one of the plurality of host computers from the DNS server in response to a DNS query packet from any one of the plurality of host computers.

As an embodiment, the sniffing device may be configured to determine the DNS response packet based on the header of each of the packets.

As an embodiment, the sniffing apparatus may detect a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network, and may store information on the plurality of DNS query packets.

In an embodiment, the destination of the DNS response packet is any one of the plurality of host computers, and the sniffing device is configured to send the DNS response packet of the plurality of DNS query packets based on the information on the plurality of DNS query packets. Whether or not a DNS query packet corresponding to the packet exists, and extract and store the IP address from the DNS response packet according to the determination result.

In an embodiment, the sniffing device may be configured to provide the stored IP address to the security device.

According to the embodiment of the present invention, a security system for efficiently obtaining IP addresses to which host computers connect is provided.

1 is a block diagram illustrating a network including a security system in accordance with an embodiment of the present invention.
2 is a flowchart illustrating an operation method of a security system according to an embodiment of the present invention.
3 is an exemplary diagram showing a data format of a header of a DNS response packet.
4 is a diagram showing an IP address table.
5 is a flowchart illustrating an operation method of a security system according to another embodiment of the present invention.
6 is a flowchart showing a method of acquiring a DNS query packet.
FIG. 7 is a table showing IP addresses collected in the security system when the security system of FIG. 1 directly transmits DNS query packets to a DNS server.
8 is a table showing IP addresses collected per domain name according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

1 is a block diagram illustrating a network 100 including a security system 110 in accordance with an embodiment of the present invention.

Referring to FIG. 1, a network 100 includes a plurality of host computers PC1 to PCk, a security system 110, an Internet network 120, and a DNS (Domain Name System) server 130.

The plurality of host computers PC1 to PCk are connected to the Internet network 120 through the security system 110. [ The plurality of host computers PC1 to PCk may receive the IP address corresponding to the domain name from the DNS server 130 and access the server computer (not shown) corresponding to the IP address through the Internet network 120 .

First, any one of the plurality of host computers PC1 to PCk, for example, the first host computer PC1, transmits a DNS query packet requesting an IP address corresponding to a specific domain name to the DNS server 130). The first host computer PC1 receives the DNS response packet provided from the DNS server 130 and obtains the IP address from the DNS response packet.

The security system 110 is configured to manage a plurality of host computers PC1 to PCk. The security system 110 includes a security device 111 and a sniffing device 112. The security device 111 will be configured to manage packets to be transmitted to and received from a plurality of host computers PC1 to PCk according to preset security policies.

It will be understood that the security policies applied to the security device 111 may be variously modified and thus the functions performed by the security device 111 may also be variously changed. For example, the security device 111 monitors packets transmitted to the plurality of host computers PC1 through PCk through the Internet network 120, and blocks all or a part of the packets according to preset security policies . As another example, the security device 111 may perform blocking only for packets according to preset security policies, collecting information of packets, and notifying an administrator of the security device 111 of the information. In addition, the function of the security device 111 may be variously changed.

The sniffing device 112 receives packets transmitted from a plurality of host computers PC1 through PCk to the Internet network 120 and packets transmitted to a plurality of host computers PC1 through PCk through the Internet network 120. [ Lt; / RTI >

According to an embodiment of the present invention, the sniffing device 112 is configured to collect IP addresses that each host computer receives from the DNS server 130 in relation to the domain name. That is, the sniffing device 112 determines whether each of the packets is a DNS response packet transmitted from the DNS server 130 to the plurality of host computers (PC1 to PCk) via the Internet network 120. [ According to the determination result, the sniffing device 112 is configured to obtain and store the IP address from the DNS response packet.

The DNS server 130 is connected to the security system 110 and a plurality of host computers PC1 to PCk via the Internet network 120. [ The DNS server 130 is configured to provide a DNS response packet to the host computer in response to the DNS query packet received from each host computer.

DNS server 130 will store information about IP addresses corresponding to each domain name. Based on the stored information, the DNS server 130 searches for the IP address of the DNS query packet corresponding to an IP address, and transmits a DNS response packet including the retrieved IP address information to the corresponding host computer via the Internet 120 to provide.

In an embodiment, when a plurality of IP addresses correspond to a specific domain name, the DNS server 130 provides limited IP addresses to the host computer even if DNS query packets are repeatedly transmitted from the same host computer (i.e., the same destination) can do.

Likewise, assume that the security system 110 repeatedly sends DNS query packets to the DNS server 130 to collect IP addresses corresponding to a particular domain name. The DNS server 130 will provide only limited IP addresses to the security system 110 in response to DNS query packets received from the security system 110, which are the same destination. According to this method, the security system 110 is difficult to obtain all the IP addresses with which the host computers PC1 to PCk communicate with respect to the domain name.

According to an embodiment of the present invention, the security system 110 monitors packets communicated between the host computers PC1 through PCk and the Internet network 120, distinguishes DNS response packets from such packets, Obtain the IP address from the DNS response packet. Accordingly, the security system 110 can efficiently obtain IP addresses at least with which the host computers PC1 to PCk communicate with respect to the domain name.

In Fig. 1, the security device 111 and the sniffing device 112 are shown as separate components. However, this is illustrative, and the function of the security device 111 and the function of the sniffing device 112 can be performed by a single component.

In FIG. 2, it is to be understood that the security device 111 and the sniffing device 112 may be implemented by a plurality of physical devices, and may be implemented by a single physical device. For example, each of the security device 111 and the sniffing device 112 may be implemented using various methods such as using software or using firmware.

2 is a flowchart illustrating an operation method of the security system 110 according to an embodiment of the present invention.

Referring to FIGS. 1 and 2, in step S110, the sniffing apparatus 112 monitors packets communicated between a plurality of host computers PC1 through PCk and the Internet network 120. FIG. The plurality of host computers PC1 to PCk may communicate with the DNS server 130 via the Internet network 120 or with general server computers (not shown) via the Internet network 120 . Such communication will be performed by sending and receiving packets.

Hereinafter, for convenience of description, a case where the first host computer PC1 transmits / receives a packet to / from the DNS server 130 will be described as an example in the description with reference to FIG.

In step S120, the sniffing device 112 determines whether the packet is a DNS response packet including an IP address. That is, the sniffing device 112 determines whether the packet is a DNS response packet transmitted from the DNS server 130 to the first host computer PC1.

As an embodiment, whether the packet is a DNS response packet can be determined based on the header of the packet.

If the packet is a DNS response packet, step S130 is performed.

In step S130, the sniffing device 112 extracts the IP address corresponding to the domain name from the DNS response packet. The DNS response packet is provided in response to a DNS query packet requesting an IP address corresponding to a domain name and includes an IP address corresponding to the domain name. The DNS response packet may include the corresponding domain name information and IP address information.

In step S140, the sniffing device 112 adds the extracted IP address to the IP address table. The IP address table stores corresponding IP addresses for each domain name. That is, the extracted IP address is matched with the corresponding domain name and stored. This is described in more detail with reference to FIG.

3 is an exemplary diagram showing a data format of a header (HD) of a DNS response packet.

Referring to FIG. 3, the header (HD) of the DNS response packet includes first to third flag information 11 to 13. The first flag information indicates whether the packet is a DNS packet or a normal packet. A DNS packet will refer to a packet that is communicated between each host computer and DNS server 130. A normal packet will refer to a packet that is communicated between each host computer and a typical server computer (not shown).

In an embodiment, the first flag information may be configured with an IP address of a source port of the packet. At this time, depending on whether the IP address indicates the DNS server 130, the packet can be discriminated as a DNS packet.

For example, the first flag information may be included in a TCP (Transmission Control Protocol) header of the header (HD) of the DNS response packet.

The second flag information 12 indicates whether the packet is a DNS query packet or a DNS response packet. For example, if the second flag information 12 is composed of one data bit, and the second flag information 12 is a logical state "1 ", the packet is a DNS response packet and the second flag information 12 is a logical state "0" means that the packet is a DNS query packet.

The third flag information 13 indicates whether the corresponding IP address is present and the number of corresponding IP addresses when the packet is a DNS response packet.

For example, the second and third flag information 12 and 13 may be included in the DNS header of the header (HD) of the DNS response packet.

Whether the packets communicated between the host computers PC1 to PCk and the Internet network 120 are DNS response packets can be discriminated based on the first to third flag information 11 to 13. [

4 is a diagram showing an IP address table (T).

Referring to FIG. 4, the IP address table T includes IP addresses corresponding to the respective domain names DN1 to DNn. As an example, the DNS response packet may include information on the IP address and information on the corresponding domain name. Each time the DNS response packet is detected, the sniffing device 112 matches the extracted IP address with the corresponding domain name and adds it to the IP address table T. [

As an example, the IP address table T may be stored in the sniffing device 112. [ At this time, the sniffing device 112 will include a data storage medium for storing the IP address table T. As another example, the IP address table T may be stored in the security device 111. [ At this time, each time the DNS response packet is detected, the sniffing device 112 will provide information about the extracted IP address and information about the corresponding domain name to the security device 111.

5 is a flowchart illustrating an operation method of a security system according to another embodiment of the present invention.

Referring to FIGS. 1 and 5, in step S210, the sniffing apparatus 112 monitors packets communicated between a plurality of host computers PC1 through PCk and the Internet network 120. FIG. In step S220, the sniffing device 112 determines whether the packet is a DNS response packet.

Hereinafter, for convenience of explanation, the case where the first host computer PC1 transmits / receives a packet to / from the DNS server 130 will be described as an example in the description with reference to FIG. 5 and FIG.

In step S230, the sniffing apparatus 112 determines whether or not a DNS query packet corresponding to the DNS response packet has been transmitted from the first host computer PC1 to the DNS server 130. [ To this end, the sniffing device 112 stores information on a DNS query packet transmitted from the first host computer PC1 to the DNS server 130. [ This is described in more detail with reference to FIG.

DNS response packets are transmitted to at least one of the host computers PC1 to PCk, for example, the first host computer PC1 via the Internet network 120, for various purposes, Lt; / RTI > This DNS response packet will not be generated by the DNS server 13 but will be generated by any other server.

In this case, the reliability of the header (HD) of the DNS response packet is very low. The header (HD) of the DNS response packet may include the same first to third flag information as described with reference to FIG. If the sniffing device 112 determines whether the packet is a DNS response packet based on only the header (HD) of the DNS response packet, it is possible to collect an invalid IP address.

According to this embodiment, after determining whether the packet is a DNS response packet based on the header (HD) of the DNS response packet, the sniffing device 112 determines whether the DNS query packet has occurred in the first host computer PC1 .

In step S240, the sniffing device 112 extracts the IP address corresponding to the domain name from the DNS response packet. In step S250, the sniffing device 112 adds the extracted IP address to the IP address table.

According to this embodiment, the reliability of the IP addresses collected by the sniffing device 112 can be further improved.

6 is a flowchart showing a method of acquiring a DNS query packet.

Referring to FIG. 6, the sniffing apparatus 112 monitors packets communicated between a plurality of host computers PC1 through PCk and the Internet network 120 (S210), and determines whether the packet is a DNS query packet (S220). The DNS query packet is a packet for asking for an IP address corresponding to a domain name, and is transmitted from the first host computer PC1 to the DNS server 130. [ If the packet is a DNS query packet, the sniffing device 112 stores information about the DNS query packet (S230). The information on the DNS query packet will be used in step S230 of FIG.

FIG. 7 is a diagram showing IP addresses collected in the security system 110 when the security system 110 of FIG. 1 directly transmits DNS query packets to the DNS server 130. FIG.

Referring to FIG. 7, two IP addresses corresponding to one domain name (www.daum.net) are obtained. All IP addresses with which the host computers (PC1 to PCk, see Fig. 1) communicate are not obtained.

8 is a diagram illustrating IP addresses collected per domain name according to an embodiment of the present invention.

Referring to FIG. 8, three or more IP addresses are obtained in one domain name (www.daum.net). By monitoring and detecting the DNS response packets that the host computers PC1 to PCk receive from the DNS server 130 (see FIG. 1), all IP addresses with which the host computers PC1 to PCk communicate can be obtained. Able to know.

According to the embodiment of the present invention, IP addresses to which host computers managed by a security system are connected can be efficiently obtained.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the claims equivalent to the claims of the present invention as well as the claims of the following.

Security system: 110
Internet network: 120
DNS server: 130
PC1 to PCk: first to kth host computers
DN: Domain Name

Claims (15)

A method of operating a security system for managing a plurality of host computers connected to an Internet network, the method comprising:
Monitoring packets communicated between the plurality of host computers and a DNS (Domain Name System) server over the Internet network;
Determining whether each of the packets is a DNS response packet including an IP address; And
Extracting the IP address from the determined DNS response packet, and storing the extracted IP address. The method according to claim 1,
Wherein the DNS response packet is provided to one of the plurality of host computers from the DNS server in response to a DNS query packet from any one of the plurality of host computers. 3. The method of claim 2,
The DNS query packet corresponds to a domain name,
Wherein the extracted IP address is matched with the domain name and stored. The method according to claim 1,
Wherein the determining is performed based on a header of each of the packets. 5. The method of claim 4,
Wherein the header includes flag information indicating whether the packet is the DNS response packet. 5. The method of claim 4,
Wherein the header includes flag information indicating whether the IP address exists in the DNS response packet. The method according to claim 1,
Detecting a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network, and storing information on the plurality of DNS query packets. The method of claim 7, wherein
Wherein the destination of the DNS response packet is any one of the plurality of host computers,
And determining whether there is a DNS query packet corresponding to the DNS response packet among the plurality of DNS query packets, based on the information on the plurality of DNS query packets. The method of claim 8,
Wherein storing the extracted IP address comprises extracting and storing the IP address from the DNS response packet when a DNS query packet corresponding to the DNS response packet is present. A security system configured to manage a plurality of host computers connected to an Internet network, the security system comprising:
And a sniffing device configured to monitor packets communicated between the plurality of host computers and a Domain Name System (DNS) server over the Internet network,
The sniffing device is configured to determine whether each of the packets is a DNS response packet including an IP address, and extract and store the IP address from the determined DNS response packet. 11. The method of claim 10,
Wherein the DNS response packet is provided to the one of the plurality of host computers from the DNS server in response to a DNS query packet from any one of the plurality of host computers. 11. The method of claim 10,
Wherein the sniffing device is configured to determine the DNS response packet based on a header of each of the packets. 11. The method of claim 10,
The sniffing device is configured to detect a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server via the Internet network, and to store information about the plurality of DNS query packets. 14. The method of claim 13,
Wherein the destination of the DNS response packet is any one of the plurality of host computers,
The sniffing device determines whether there is a DNS query packet corresponding to the DNS response packet among the plurality of DNS query packets based on the information on the plurality of DNS query packets, and the DNS response according to the determination result. And extract and store the IP address from a packet. 11. The method of claim 10,
Further comprising a security device configured to manage the plurality of host computers connected to the Internet network,
Wherein the sniffing device is configured to provide the stored IP address to the security device.

Images