KR20150144570A - Packet interception device and packet interception method - Google Patents

Abstract

The present invention relates to a packet blocking device and a packet blocking method based on an IP address and position information. The packet blocking device according to the present invention comprises: a receiving unit for receiving a packet having a header including a source IP address, a destination IP address, and transmission position information; a storing unit for storing information on a position of a blocked area, which shows an access blocking area; and a control unit for blocking the packet when a transmission position of the packet corresponding to the transmission position information is included in the access blocking area.

Description

[0001] PACKET INTERCEPTION DEVICE AND PACKET INTERCEPTION METHOD [0002]

The present invention relates to a packet blocking device and a packet blocking method, and more particularly, to a packet blocking device and a packet blocking method based on location information.

In the current Internet network, data is transmitted through packet exchange between a source apparatus and a destination apparatus based on IP (IPv4 or IPv6) address information. The IP address, which is a unique value for identifying all of the source apparatus and the destination apparatus, is recorded in a packet header of a predetermined size and is used for data transmission through the Internet network.

Meanwhile, in recent years, there has been an increasing number of crimes of attacking specific servers or devices by changing the IP address of the originating device for malicious purposes. These crimes are causing major disruptions in the functioning of major facilities, resulting in serious damage and social problems. However, if the IP address is changed or stolen, it is very difficult to find out who attacked the specific server or device. In such a case, a method of analyzing the type of traffic flow or analyzing packet information to block packets But it is not an effective method.

The present invention includes a packet header including (location) information of a terminal or a server transmitting a packet, and a packet for blocking the transmission of a malicious packet based on the location information and the source IP address and the destination IP address of the packet header And a packet blocking method.

The packet blocking device according to an embodiment of the present invention includes a receiving unit for receiving a packet having a header including a source IP address, a destination IP address, and origination location information, a blocking area location information indicating an access blocking area, And a control unit for blocking the packet when a transmission position of the packet corresponding to the transmission position information is included in the connection blocking area.

In the packet blocking apparatus according to another embodiment of the present invention, the storage unit further stores connection control information in which classification information, a registered IP address, and registration position information are matched, And blocks the packet when the source IP address matches the registered IP address corresponding to the source information and the registration information does not match the source location information and the registration location information, .

In the packet blocking apparatus according to another embodiment of the present invention, the storage unit further stores connection control information matching the classification information and the registered IP address, and the control unit, when the destination IP address and the identification information are incoming And blocks the packet if the corresponding registered IP address matches.

In the packet blocking apparatus according to another embodiment of the present invention, the storage unit may include a blocking history management unit that includes at least one of the source IP address, the destination IP address, the location information of the packet, And further stores the information.

In the packet blocking device according to another embodiment of the present invention, the packet is an IPv4 (Internet Protocol version 4) packet or an IPv6 (Internet Protocol version 6) packet.

According to the packet blocking device and the packet blocking method according to the embodiment of the present invention, since the location information included in the header of the packet is used, a malicious packet transmitted from a specific area likely to cause a crime can be effectively blocked. Also, since the location information is used, the location of the user terminal or the server that transmitted the malicious packet can be grasped and the user who transmitted the malicious packet can be easily tracked.

1 is a diagram schematically illustrating a packet transmission system to which a packet blocking apparatus and a packet blocking method according to the present invention are applied.
2 is a diagram schematically illustrating a packet transmission procedure of a packet transmission system to which a packet blocking apparatus and a packet blocking method according to the present invention are applied.
3 is a block diagram of a packet blocking apparatus according to an embodiment of the present invention.
4 is a diagram showing a configuration of an IPv4 packet in an embodiment of the present invention.
5 is a diagram showing a configuration of an IPv6 packet according to an embodiment of the present invention.
6 (a) is a view showing blocking area location information according to an embodiment of the present invention.
6 (b) is a view showing a connection blocking area according to an embodiment of the present invention.
7 is a diagram illustrating connection control information according to an embodiment of the present invention.
FIG. 8 is a view illustrating blocking history management information stored in a storage unit according to an embodiment of the present invention. FIG.
9 is a flowchart of a packet blocking method according to an embodiment of the present invention.
10 is a flowchart illustrating a packet blocking method according to the best embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments. For reference, the same numbers in this description refer to substantially the same elements and can be described with reference to the contents of other drawings under these rules. The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof.

[Packet transmission system]

1 is a diagram schematically illustrating a packet transmission system to which a packet blocking apparatus and a packet blocking method according to the present invention are applied.

Referring to FIG. 1, '10a', '10b' and '10c' (collectively, '10') are user terminals, '20a' and '20b' '1000' (collectively, '1000') indicates a packet blocking device, and '40' is an Internet network, '1000a', '1000b', '1000c', '1000d'

The user terminal 10 may be a desktop PC, a laptop PC, a personal digital assistant (PDA), a smart phone, a smart pad, or the like, which refers to an information communication terminal for home or business use. The user terminal 10 is connected to the Internet network 40 via the packet intercepting apparatus 1000.

The server 20 is a computing device that provides services to a client (e.g., user terminal 10). The server 20 receives a packet from a client and transmits a response packet as a result of processing the packet to a predetermined program to the client via the packet intercepting apparatus 1000 and the Internet network 40.

The user terminal 10 and the server 20 are equipped with a GPS module capable of generating position information. The location information is information indicated by the latitude / longitude with respect to the location where the user terminal 10 or the server 20 is located. Such location information is related to the packet blocking apparatus 1000 and the packet blocking method according to the present invention, as described below.

The control center server 30 transmits the management information such as the blocking area location information 210 and the access control information 220 that are periodically or temporally updated by the operator to the packet blocking apparatus 1000 . In particular, when registering or updating the connection control information 220 to be described later, the control center server 30 checks whether the registration position information matched with the registration IP address actually corresponds to the information of the position corresponding to the registration IP address, And the like.

The packet blocking apparatus 1000 itself may serve as a gateway. In addition, the packet blocking device 1000 may be hardware-installed in the gateway or installed in a software manner, and a plurality of user terminals 10 may be connected to the packet blocking device 1000. The packet blocking apparatus 1000 performs blocking control of an accessing packet by referring to management information such as the blocking area location information 210 and the connection control information 220 received from the control center server 30. A more detailed configuration and function of the packet intercepting apparatus 1000 will be described later as an embodiment.

2 is a diagram schematically illustrating a packet transmission procedure of a packet transmission system to which a packet intercepting apparatus 1000 and a packet blocking method according to the present invention are applied.

Referring to FIG. 2, in step S001, the control center server 30 transmits management information to the packet blocking apparatuses 1000a and 1000d. The management information may include blocking area location information 210 and access control information 220.

In step S002, when the user terminal 10a accesses the server 20a via the Internet 40, the GPS module provided in the user terminal 10a transmits location information (transmission location information) of the user terminal 10a, . The originating location information is recorded in the header of the packet to be transmitted.

Then, in step S003, a packet having a header in which the transmission position information is recorded is transmitted from the user terminal 10a to the packet interception device 1000a.

In step S004, the packet intercepting apparatus 1000a performs a packet blocking method based on the management information received from the control center server 30 in step S001. Details of the packet blocking method will be described later.

In step S005, if the packet is not blocked by the packet blocking method in step S004, the packet blocking apparatus 1000a performs a normal packet forwarding procedure, i.e., the unblocked packet is transmitted to the blocking apparatus 1000d via the packet Internet network 40. [ As shown in FIG.

In step S006, the packet intercepting apparatus 1000d forwards the packet to the server 20a.

In step S007, the server 20a performs a service process requested by the packet transmitted from the user terminal 10a, and generates a response packet as a result of the service process (step S007).

Subsequently, in step S008, the server 20a forwards the generated packet to the packet interception device 1000d.

In step S009, the packet intercepting device 1000d transmits the response packet again to the packet intercepting device 1000a through the Internet network 40. [

In step S010, the packet intercepting apparatus 1000a forwards the response packet to the user terminal 10a again, thereby completing the packet transmission procedure.

The packet transmission procedure of the packet transmission system to which the packet blocking apparatus and packet blocking method according to the present invention is applied is as described above. The packet blocking method may be performed in the packet blocking apparatus 1000d of FIG. 1, (For example, 1000a and 1000d) of the packet blocking device.

Hereinafter, an embodiment of a packet blocking apparatus and a packet blocking method will be described with reference to the drawings.

[Embodiment of packet interception device]

3 is a block diagram of a packet intercepting apparatus 1000 according to an embodiment of the present invention.

3, the packet intercepting apparatus 1000 includes a receiving unit 100, a storage unit 200, and a control unit 300. Although not shown, the packet intercepting apparatus 1000 may further include a configuration for performing a role as a gateway, and may further include a display unit such as a display and a power unit for supplying power.

The receiving unit 100 receives a packet having a header including a source IP address, a destination IP address, and origination location information. As described above, the calling location information is information on the location of the user terminal 10 obtained by the GPS module provided in the user terminal 10.

The header of the packet may conform to Internet protocols IPv4 and IPv6 established by the Internet Engineering Task Force (IETF). In the embodiment of the present invention, a header of a packet conforming to IPv4 (hereinafter, referred to as an IPv4 packet) and a header of a packet conforming to an IPv6 (hereinafter referred to as an IPv6 packet) include the origination position information.

4 is a diagram showing a configuration of an IPv4 packet in an embodiment of the present invention.

Referring to FIG. 4, the header of the IPv4 packet includes an IPv4 basic header (basic IPv4 header, 20 bytes) and an optional header. The IPv4 basic header includes a 32-bit source IP address and a destination IP address. Other configurations of the IPv4 basic header follow IPv4, so a detailed description will be omitted.

In the option header, the transmission position information is recorded. Specifically, a 10-byte longitude including 8-bit option type information, 8-bit option header length information, 9-byte latency information including 1-byte N / S designation information indicating north latitude and south latitude, and 1-byte E / W designation information indicating longitude / 1 byte padding for aligning the information and option header to a multiple of 4 bytes constitutes the transmission position information. The originating location information is recorded based on the latitude / longitude value obtained by the GPS module of the user terminal 10. [

The header of the IPv4 packet including the IPv4 basic header and the optional header is followed by data to be transmitted by the user terminal 10. [

5 is a diagram showing a configuration of an IPv6 packet according to an embodiment of the present invention.

Referring to FIG. 5, the header of the IPv6 packet includes an IPv6 basic header of 40 bytes and an extension header extended to a payload. The IPv6 basic header includes a 128-bit source IP address and a destination IP address. The 8-bit next header included in the IPv6 basic header indicates a next header included in the extended header. Other configurations of the IPv6 basic header follow IPv6, so a detailed description will be omitted.

In the extended header extended in the payload, the outgoing location information is recorded. Specifically, it consists of 8-bit next header, 16-bit extended header length information indicating the length of the calling location information, 9-byte latitude information including 1-byte N / S designation information indicating the north / south location, and 1-byte E / W The 10-byte longitude information including the designation information constitutes the transmission position information. The originating location information is likewise recorded based on the latitude / longitude value obtained by the GPS module of the user terminal 10. [

The IPv6 basic header and extension header are followed by data to be transmitted by the user terminal 10.

The storage unit 200 may be implemented as a device such as a memory HDD, an FDD, a flash memory, or a storage using cloud computing. The storage unit 200 stores management information used for blocking packets. The management information is information that includes the blocking area location information 210 and the access control information 220 and is received from the control center server 30. According to the embodiment, some of the information 210 and 220 included in the management information may be excluded. The management information is referred to by the control unit 300 in performing blocking of the packet.

6 and 7 show the blocking area location information 210 and the connection control information 220, respectively.

Referring to FIG. 6A, the blocking area location information 210 indicates location information of the access blocking area. The blocking area location information 210 is represented by a table as shown in FIG. 6 (a), and includes upper-bounded latitude information indicating upper boundaries on latitude, lower-bounded latitude information indicating lower boundaries on latitude, Left boundary hardness information indicating the right boundary, and right boundary hardness information indicating the right boundary of the hardness.

The upper / lower boundary latitude information is composed of the N / S designation information and the azimuth angle, and the left / right boundary hardness information is composed of the E / W designation information and the azimuth angle. When the value of the N / S designation information is 0, it represents the north, and when it is 1, it represents the south. In addition, if E / W designation information is 0, it indicates east longitude, and if it is 1, it indicates westward.

For example, the upper boundary latitude information 03650.0908 in the first line of Fig. 6 (a) shows (a) in Fig. 6 (b), the lower boundary latitude information 04123.1324 shows (b) When the hardness information 012854.6072 indicates (c) in FIG. 6 (b) and the right boundary hardness information 013023.5643 indicates (d) in FIG. 6 (b) Area A surrounded by (d) and (d) is the access blocking area. In this example, when the location indicated by the transmission position information included in the header of the packet transmitted from the user terminal 10 is included in the area A, the control unit 300, which will be described later, blocks the transmitted packet.

Referring to FIG. 7, the connection control information 220 is information used for determining whether a packet is blocked, and includes information on the registration of incoming / outgoing call, registration IP address, registration location information (latitude / longitude information) The control information is matched and stored in the storage unit 200. Each piece of information included in the connection control information 220 is registered and stored by the operator of the control center server 30.

The incoming / outgoing call distinguishing information is information indicating which of the source IP address and the destination IP address included in the header of the transmitted packet is to be matched with the registered IP address matched with the incoming / outgoing distinguishing information. When the destination / source identification information is '0' indicating origination, the source IP address included in the header of the packet to be transmitted and the registered IP address having the destination / source identification information '0' are collated, '1', the destination IP address included in the header of the packet to be transmitted is compared with the registered IP address of which the destination / source identification information is '1'.

The registered IP address is an IP address registered by the operator of the control center server 30. As described above, the registered IP address is matched with any one of the source IP address and the destination IP address included in the header of the packet to be transmitted according to the incoming / outgoing distinguishing information. The registered IP address in FIG. 7 is based on the IPv4 address system, and when the IPv6 address system is followed, an IPv6 address composed of 32 bytes can be stored.

The registration location information (latitude / longitude information) indicates location information where the user terminal 10 (or the server 20) to which the registered IP address is assigned is actually located. Registration location information is used together with the registration IP address to determine whether or not the IP address included in the header of the transmitted packet matches the location information.

The control information is information for additionally determining whether to block the packet transmitted based on the above-described call / origination discrimination information, registered IP address, and registered location information (latitude / longitude information). For example, in the case of FIG. 7, the transmitted packet is forwarded when the control information is registered as '0', and the transmitted packet is blocked when it is registered as '1'. According to the embodiment, such control information can be omitted. For example, if the destination IP address of the packet to be transmitted matches the registered IP address of the destination / source identification information of '1', all packets transmitted are blocked.

For example, when the destination IP address included in the header of the packet transmitted from the user terminal 10 is 112.132.245.53, the control unit 300, which will be described later, Addresses (lines 4, 5 in FIG. 7) and the destination IP address 112.132.245.53. As a result of comparison, the controller 300 blocks the transmitted packet because the registered IP address of the 5th line of FIG. 7 matches the destination IP address and the control information is '1'.

As another example, if the source IP address included in the header of the packet transmitted from the server 20 is 273.134.201.78, the destination IP address is 163.567.457.32, the transmission location information is 16428.5637 (latitude information), 013821.8755 ) Is assumed. In this case, the control unit 300 collates the registration IP addresses (1, 2, 3, 6th row of FIG. 7) in which the call / origination discrimination information indicates '0' with the source IP address 273.134.201.78 , The destination IP address 163.567.457.32 is compared with the registered IP addresses (line 4, 5 in FIG. 7) in which the destination / source identification information indicates '1'.

At this time, the destination IP address 163.567.457.32 of the packet to be transmitted does not coincide with any of the registration IP addresses of the fourth and fifth lines of FIG. 7, but the source IP address of the packet to be transmitted is the registration IP Address. However, the transmission location information (04022.2312 (latitude information), 013045.8732 (longitude information)) in the third line of Fig. 7 and the transmission location information 16428.5637 (latitude information) and 013821.8755 The control unit 300, which will be described later, blocks the packet to be transmitted.

Also, in the above example, even if the transmission location information of the transmitted packet and the registration location information of FIG. 7 coincide with 04022.2312 (latitude information) and 013045.8732 (longitude information), the control information of the registered IP address is '1' The control unit 300 blocks the packet to be transmitted.

FIG. 8 is a view showing the blocking history management information 230 stored in the storage unit 200 according to the embodiment of the present invention.

8, the blocking details management information 230 includes a source IP address, source location information (latitude information and longitude information) included in a header of a packet blocked by the controller 300, a destination IP address, Are matched with each other. The blocking history management information 230 is information stored in the storage unit 200 of each packet intercepting apparatus 1000.

For example, a packet having a source IP address of 139.275.113.21, a source IP address of 03650.0908 (latitude information), 012854.6072 (longitude information), and a destination IP address of 218.234.112.35 illustrated in the first line of FIG. 8 is 218.234.112.35 It means that the packet transmission to the IP address is interrupted once. On the other hand, the packet having the source IP address 215.237.102.37 and the destination IP address 145.138.132.45 illustrated in the second row of FIG. 8 assumes the user terminal 10 having no GPS module, .

Meanwhile, the source IP address and the destination IP address illustrated in FIG. 8 are based on the IPv4 address system, and when an IPv6 address scheme is followed, an IPv6 address consisting of 32 bytes is stored. Such blocking history management information 230 can be implemented so that an operator of the control center server 30 can access and confirm the packet blocking apparatus 1000 according to the embodiment.

3, the control unit 300 blocks or forwards the packet received by the receiving unit 100 based on the blocked area location information 210 stored in the storage unit 200 and the access control information 220 .

If the originating position of a packet to be transmitted is included in the access blocking area when the blocking area location information 210 is referred to, the controller 300 blocks the packet to be transmitted.

When referring to the connection control information 220, the control unit 300 determines whether the destination IP address of the transmitted packet matches the registered IP address of the incoming / outgoing call distinguishing information of the connection control information 220 of '1' If it is '1', it blocks the packet to be transmitted.

In addition, if the source IP address of the packet to be transmitted matches the registered IP address of which the destination / source identification information is '0', the control unit 300 determines that the source location information of the packet to be transmitted matches the registration location information corresponding to the registered IP address If they do not match, the packet is blocked.

In addition, if the source IP address and the source location information of the packet to be transmitted match the registered IP address and the registered location information of the '0', respectively, if the control information is '1' And blocks the packet to be transmitted.

The control unit 300 may have the function of performing the above-described functions in the embodiment of the present invention, and collectively controlling all the configurations of the packet intercepting apparatus 1000.

The configuration of the packet intercepting apparatus 1000 according to the embodiment of the present invention is as described above. Hereinafter, a packet blocking method according to an embodiment of the present invention will be described with reference to the drawings.

[Embodiment of blocking method]

9 is a flowchart of a packet blocking method according to an embodiment of the present invention.

Referring to FIG. 9, a packet blocking method according to an exemplary embodiment of the present invention includes storing blocking area location information indicating an access blocking area (step S101), a header including a source IP address, a destination IP address, (Step S102); and, when the transmission position of the packet corresponding to the transmission position information is included in the connection blocking area (Y in step S103), blocking the packet (step S104) . On the other hand, when the transmission position of the packet is not included in the access blocking area (N in step S103), the packet is forwarded without being blocked.

In step S101, the blocking area location information 210 indicating the access blocking area is stored in the storage unit 200. [ The blocked area location information 210 is transmitted from the management center server 30. The blocked area location information includes upper boundary latitude information indicating an upper boundary on latitude, lower boundary latitude information indicating a lower boundary on latitude, Left boundary hardness information indicating the left boundary of the image, and right boundary hardness information indicating the right boundary of the hardness.

In step S102, the receiving unit 100 receives a packet having a header including a source IP address, a destination IP address, and origination location information. The source IP address and the destination IP address may follow the IPv4 address system or the IPv6 address system, and the calling location information is location information including the latitude / longitude obtained from the GPS module provided in the user terminal 10 transmitting the packet.

In step S103, the control unit 300 determines whether or not the packet sending location is included in the access blocking area. If the originating position of the packet is included in the access blocking area, the process proceeds to step S104; otherwise, the process proceeds to step S105.

In step S104, since the packet sending location is included in the access blocking area, the control unit 300 blocks the packet to be transmitted.

In step S105, since the packet sending location is not included in the access blocking area, the control unit 300 forwards the packet to the user terminal 10 (or the server 20) having the destination IP address.

In another embodiment, the storage unit 200 further stores connection control information 220 in which the reception / transmission discrimination information, the registration IP address, and the registration position information are matched in step S101. In step S103, The source IP address of the packet to be transmitted matches the registration IP address indicating that the destination / source identification information indicates origination, and the source location information of the packet to be transmitted and the registration It is determined whether or not the position information is inconsistent. In step S104, the control unit 300 may block the transmitted packet if the determination in step S103 is determined to be inconsistent.

In another embodiment, in step S101, the storage unit 200 further stores connection control information 220 in which the incoming / outgoing call classification information and the registered IP address are matched. In step S103, In step S104, it is determined whether the destination IP address matches the registered IP address indicating that the incoming / outgoing call distinguishing information matches the registered IP address. If the destination IP address of the transmitted packet matches the registered IP address indicating that the incoming / And blocking the packet to be transmitted.

In addition, in another embodiment, in addition to step S104, in step S106, the storage unit 200 may perform a blocking history management including at least one of a source IP address, a destination IP address, a transmission location information, And storing the information 230. [

10 is a flowchart showing a packet blocking method according to the best embodiment of the present invention. In the present embodiment, when the incoming / outgoing call distinguishing information of the connection control information 220 is a registered IP address indicating an incoming (= '1'), all the control information of the registered IP address is blocked (= '1 ').

Referring to FIG. 10, in step S201, the receiving unit 100 receives a packet from the user terminal 10 (or the server 20). The packet may be an IPv4 packet or an IPv6 packet.

In step S202, the control unit 300 refers to the blocked area location information 210 stored in the storage unit 200 and determines whether or not the sending location of the received packet is included in the access blocking area. If the calling location is included in the access blocking area, the process proceeds to step S208, and if the calling location is not included in the access blocking area, the process proceeds to step S203.

In step S203, the control unit 300 refers to the access control information 220 stored in the storage unit 200 and determines whether the source IP address included in the header of the received packet and the registered IP address having the " 0 " . If the source IP address and the registered IP address having the incoming / outgoing call distinguishing information equal to '0' are identical to each other, the process proceeds to step S204; otherwise, the process proceeds to step S206.

In step S204, the control unit 300 refers to the connection control information 220 stored in the storage unit 200 and determines whether the registration position information corresponding to the matching registration IP address matches the transmission position information of the received packet in step S203 . When the registration position information and the calling position information are identical to each other, the process proceeds to step S205; otherwise, the process proceeds to step S208.

In step S205, the control unit 300 refers to the access control information 220 stored in the storage unit 200 and determines whether the control information corresponding to the registration IP address and registration position information matched in step S203 and step S204 is '0' 1 '. If the control information is '0', that is, if the packet is not blocked, the process proceeds to step S206. If the control information is '1', that is, if the packet is blocked, the process proceeds to step S208.

In step S207, the control unit 300 refers to the connection control information 220 stored in the storage unit 200 and determines whether the destination IP address included in the header of the received packet and the registered IP address having the incoming / . If the destination IP address matches the registered IP address of which the destination / source identification information is '1', the process proceeds to step S208, and if not, the process proceeds to step S207.

In step S207, the control unit 300 forwards the transmitted packet to the user terminal 10 (or the server 20) having the destination IP address, and ends the procedure.

In step S208, the control unit 300 blocks the transmitted packet.

In step S209, the controller 300 generates blocking history management information 230 including at least one of the source IP address, the destination IP address, the transmission location information, and the reception count included in the header of the blocked packet in step S208 And stores the block history management information 230 in the storage unit 200.

According to the packet blocking apparatus 1000 and the packet blocking method according to an embodiment of the present invention, malicious packets transmitted from a specific area that is highly likely to cause an offense by using (originating) location information included in the header of the packet It can be effectively blocked. Also, since the location information of the user terminal 10 or the server 20 that transmitted a malicious packet can be easily grasped by using the location information by the GPS module, the user who transmitted the malicious packet can be effectively tracked.

In addition, according to the packet blocking apparatus 1000 and the packet blocking method according to another embodiment of the present invention, since the registration IP address and the registration position information corresponding thereto are previously registered and stored, the source IP address of the packet to be transmitted is changed or stolen A more appropriate packet blocking control becomes possible. In addition, since the control information related to the packet to be transmitted is stored, it is possible to determine that the blocking of the transmitted packet matches the intention of the operator.

In addition, according to the packet blocking device 1000 and the packet blocking method according to another embodiment of the present invention, when the incoming / outgoing call distinguishing information is included in the connection control information 220 as a registered IP address indicating an incoming call, (Or the server) is stored, malicious packets can be prevented from being transmitted to a terminal or a server to which the connection is not permitted. This makes it possible to effectively protect a terminal or a server requiring high security from a malicious traffic attack.

In addition, according to the packet blocking apparatus 1000 and the packet blocking method according to another embodiment of the present invention, the blocking history management information 230 having the history list of the blocked packets can be stored separately, Or an operator of the management center server 30 can establish a more effective security policy by referring to the block history management information 230. [

Also, according to the packet blocking apparatus 1000 and the packet blocking method according to another embodiment of the present invention, it is possible to correspond to the transmission of IPv4 packet and IPv6 packet. Therefore, the existing IP address system (IPv4) and the newly established IP address system ) Can also effectively block malicious packets.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It will be understood that various modifications and changes may be made in the present invention. Accordingly, it is to be understood that the scope of the present invention is defined by the claims appended hereto, and all of its equivalents or equivalents are included in the scope of the present invention.

10, 10a, 10b, 10c:
20, 20a, 20b: server
30: Control center server
40: Internet network
100:
200:
210: Block location information
220: connection control information
230: Blocking history management information
300:
1000, 1000a, 1000b, 1000c, 1000d, 1000e: Packet blocking device

Claims (1)

A receiving unit for receiving a packet having a header including a source IP address, a destination IP address, and origination location information;
A storage unit for storing blocking area location information indicating a connection blocking area; And
And blocking the packet if a transmission position of the packet corresponding to the transmission position information is included in the connection blocking area.

Images