KR20180026254A - Network security system and method for displaying a blocked site - Google Patents

Abstract

The present invention relates to a network security system for displaying a blocked site and a method thereof. The method enables a DNS blocking server to mirror a DNS query packet through network equipment to which a client terminal is connected, generates and transmits a fake DNS response packet to the client terminal when a DNS query domain address, extracted from the DNS query packet, is a management target domain address, generates and transmits a private certificate to the client terminal if a warning device receives a certificate request packet from the client terminal, and transmits a warning page, which corresponds to a policy, to the client terminal if the request packet is received from the client terminal.

Description

TECHNICAL FIELD [0001] The present invention relates to a network security system and a method for displaying blocked sites,

The following description relates to a technique for preventing information leakage, and relates to a network security method.

Due to the development of information and communication, it has become possible to access the Internet and exchange information anytime and anywhere. However, there are many harmful sites on the back that provide unhealthy information. As the risks of information leakage and hacking become greater, there is a growing interest in network security.

Korean Patent Laid-Open Publication No. 2014-0044987 provides a system and method for detouring an Internet access path through Domain Name System (DNS) packet modulation, thereby preventing IP address collision and enabling smooth communication. However, in the above-mentioned patent, a network security system using a proxy server inspects packets coming from the outside and blocks them, but can not block outgoing packets from the inside. Accordingly, there is a need for a technology capable of providing a security service while maintaining the existing network environment.

Further, there is a need for a technique that can warn that the page is a blocked page without error due to SSL communication even when the site to be blocked uses SSL (Secure Sockets Layer) communication.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a network security system and method for displaying a blocking site.

Specifically, the present invention aims to provide load balancing that distributes load by providing a warning page corresponding to a policy including a plurality of warning servers to client terminals.

In addition, the present invention generates and provides a private certificate when a connection to a blocked site requiring SSL communication occurs using an alert server capable of generating SSL communication and private certificate, thereby preventing an SSL communication error, And to provide a network security system and method capable of displaying the network security system.

In order to achieve the above object, a network security system according to an embodiment of the present invention includes a client device connected to a network device to mirror a DNS query packet through the network device, A DNS blocking server for generating a fake DNS response packet and transmitting the fake DNS response packet to the client terminal when the domain address is a managed domain address based on Secure Sockets Layer (SSL) communication; And

When receiving the certificate request packet from the client terminal that has received the bogus DNS response packet, searches for a private certificate and transmits the private certificate to the client terminal if the private certificate exists, Generates a private certificate and transmits the private certificate to the client terminal, and when the server receives the request packet from the client terminal, transmits a warning page to the client terminal informing that the site is blocked.

In this case, the warning device includes a plurality of virtual warning servers for providing the warning page, and upon receiving the request packet, selects a warning page corresponding to the request packet according to a preset policy, To the client terminal.

The policy may then indicate a corresponding alert page determined by considering at least one of a source IP, a destination IP, or a server name.

In this case, the network security system further includes a plurality of warning servers for transmitting different warning pages to the client terminal according to a predetermined policy, and the warning device is located at a front end of the plurality of warning servers, Upon receiving the packet, it may select an alert server to process the request packet according to the policy, transmit the request packet to the selected alert server, and transmit the alert page to the client terminal from the selected alert server .

At this time, the policy may indicate a corresponding alert server determined considering at least one of a source IP, a destination IP, or a server name.

At this time, the private certificate may be a certificate corresponding to a site to which the client terminal wants to connect.

At this time, the warning device acquires a server name using SSL Client Hello from the information included in the private certificate, and obtains the remaining information included in the private certificate through the certificate of the warning device The private certificate can be generated.

At this time, the DNS blocking server may generate the false DNS response packet by inputting the IP address of the warning device as a response IP address corresponding to the DNS query domain address.

A network security method according to an embodiment of the present invention includes: mirroring a DNS query packet through a network device to which a client terminal is connected in a DNS blocking server; Extracting a DNS query domain address from the DNS query packet in the DNS blocking server; Determining from the DNS blocking server whether the DNS query domain address is a managed domain address based on secure sockets layer (SSL) communication; Generating a spurious DNS response packet in the DNS blocking server if the DNS query domain address is a managed domain address based on SSL communication; Transmitting the generated dummy DNS response packet from the DNS blocking server to the client terminal; And retrieving a private certificate upon receiving a certificate request packet from the client terminal that has received the fake DNS response packet from the warning device; Transmitting the private certificate to the client terminal if the private certificate exists in the warning device; Generating the private certificate and transmitting the private certificate to the client terminal if the private certificate does not exist in the warning device; And receiving a request packet from the client terminal in the warning device, causing a warning page to be transmitted to the client terminal indicating that the site is blocked.

The step of causing the warning device to transmit the warning page to the client terminal includes the steps of: when receiving the request packet, selecting an alert page corresponding to the request packet according to a preset policy; And transmitting the selected warning page to the client terminal.

The policy may then indicate a corresponding alert page determined by considering at least one of a source IP, a destination IP, or a server name.

In this case, the step of causing the warning device to transmit the warning page to the client terminal may include transmitting the warning page to the client terminal in response to the preset policy, Upon receiving the request packet, selecting an alert server to process the request packet according to the policy; And transmitting the request packet to the selected alert server so that the selected alert server transmits the alert page to the client terminal.

At this time, the policy may indicate a corresponding alert server determined considering at least one of a source IP, a destination IP, or a server name.

Here, the private certificate may be a certificate corresponding to a site to which the client terminal is to access.

In this case, the step of generating the private certificate and transmitting the private certificate to the client terminal includes: obtaining a server name using SSL Client Hello among the information included in the private certificate; Obtaining remaining information included in the private certificate through the certificate of the warning device; And generating the private certificate including the obtained server name and the remaining information.

The generating of the dummy DNS response packet may include generating the dummy DNS response packet by inputting the IP address of the warning device as a response IP address corresponding to the DNS query domain address.

The present invention is a method for mirroring a DNS query packet through a network device connected to a client terminal in a DNS blocking server and generating a false DNS response packet when the DNS query domain address extracted from the DNS query packet is a managed domain address When receiving the certificate request packet from the client terminal, the alert server generates a private certificate and transmits it to the client terminal. Upon receiving the request packet from the client terminal, a warning page informing the client terminal of the blocked site is transmitted to the client terminal The present invention is directed to a network security system that can perform network communication even if the DNS blocking server fails and can prevent the network traffic from being blocked even if the managed domain uses SSL (Secure Sockets Layer) To warn of There.

1 is a block diagram illustrating a network security system according to an embodiment of the present invention.
2 is a flowchart illustrating a process of processing a DNS query packet in a DNS blocking server of a network security system according to an exemplary embodiment.
FIG. 3 is a flowchart illustrating a process for alerting a warning server of a network security system according to an exemplary embodiment of the present invention when a connection to a management target is requested.
4 is a diagram showing a flow when a client terminal requests a connection to a site to be managed which requires SSL communication according to an embodiment.
FIG. 5 shows an example of a list of DNS blocking servers according to an embodiment.

Other objects and features of the present invention will become apparent from the following description of embodiments with reference to the accompanying drawings.

Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

However, the present invention is not limited to or limited by the embodiments. Like reference symbols in the drawings denote like elements.

Hereinafter, a network security system and method for displaying a blocking site according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 5.

1 is a block diagram illustrating a network security system according to an embodiment of the present invention.

Referring to FIG. 1, when connecting to the Internet 100 from a client terminal 160 in a network environment, the client terminal 160 may be connected to a switch 170 or a router. The client terminal 160 may be connected to the switch 170 or the router to enable network connection and data transmission. At this time, at least one client of the client terminal 160 can be connected to the Internet. For example, the client may be a terminal such as a PC or a smart phone.

The DNS blocking server 140 may be connected to the network equipment to which the client terminal 160 is connected and may mirror the DNS query packet through the network equipment. The DNS blocking server 140 may store a list of managed domain addresses. For example, the DNS blocking server 140 may store the managed domain addresses www.aaa.com, www.bbb.com, and www.ccc.com.

The DNS query packet may be transmitted to the external DNS server 120 through the Internet 100 or may be transmitted to the DNS blocking server 140 through mirroring. The DNS blocking server 140 can extract the DNS query domain address included in the DNS query packet. For example, you can extract the DNS query domain address, www.abc.com, contained within the DNS query packet. At this time, it is possible to determine whether the DNS query domain address is a managed domain address. It is possible to determine whether the address is a managed domain address by comparing the list of the managed domain addresses stored in the DNS blocking server 140 with the DNS query domain address.

If the DNS query domain address is not the address of the managed domain, the www server (not shown) sends a DNS response packet for the DNS query packet transmitted to the external DNS server 120 via the Internet 100 to the client terminal 160 . The client terminal 160 can normally access the destination site using the DNS response packet to perform communication. The DNS response packet may be provided in response to a DNS query packet requesting an IP address corresponding to a domain name, and may include an IP address corresponding to a domain name.

If the DNS query domain address of the DNS query packet is a managed domain address, a fake DNS response packet may be generated and transmitted to the client terminal 160 via the switch 170. The DNS blocking server 140 sets the IP address of the warning device 150 or one of the warning servers 151 and 152 connected to the rear end of the warning device 150 as a response IP address corresponding to the DNS query domain address You can create a fake DNS response packet by typing.

The DNS blocking server 140 may transmit the generated DNS response packet to the client terminal 160 via the switch 170. For example, if the DNS query domain address www.abc.com is a managed domain address, the DNS blocking server 140 sets the IP address (for example, 10.10.10.10) of the warning server 150 to the DNS query domain address To generate a spoofed DNS response packet, and to transmit the generated spoofed DNS response packet to the client terminal 160.

The client terminal 160 may receive the DNS response packet and may connect to the warning device 150. [ Upon receiving a request packet from the client terminal 160 generated using the false DNS response packet, the warning device 150 transmits a warning page to the client terminal 160 indicating that the site is the blocked site.

If the site to which the client terminal 160 is connected is a site requiring SSL (Secure Sockets Layer) communication, the client terminal 160 transmits the request packet to the warning device 150 To the warning device 150 included in the warning device 150, a certificate request packet requesting a certificate for SSL communication.

The warning device 150 is located at the front end of the plurality of warning servers 151 and 152 and can act as a proxy server and receives a request packet from the client terminal 160 that has received the bogus DNS response packet The user can select a warning server to process the request packet according to a preset policy and send a warning page to the client terminal 160 informing that the selected warning server is the blocked site. At this time, the predetermined policy may be a policy indicating a corresponding warning server determined in consideration of at least one of a source IP, a destination IP, and a server name.

The plurality of warning servers 151 and 152 may be a virtual warning server included in the warning device 150, and may provide different warning pages to the warning device 150. In this case, upon receiving the request packet, the warning device 150 may select a warning page corresponding to the request packet according to a predetermined policy, and transmit the selected warning page to the client terminal 160. [ At this time, the predetermined policy may indicate a corresponding warning page determined by considering at least one of the source IP, the destination IP, or the server name.

For example, if a policy provides a first alert page for a request packet received from a particular client IP band and a second alert page for a request packet received from another client IP band, Based on the client IP information, a warning page to be provided to the client terminal 160. [ That is, if the client IP band is company A, a warning page related to company A is provided. If the client IP band is company B, a warning page related to company B is provided,

As another example, if the policy provides different alert pages according to the destination IP, it may provide a corresponding alert page to the client terminal 160 according to the destination IP of the received request packet.

When the warning device 150 receives the certificate request packet from the client terminal 160 before receiving the request packet from the client terminal 160, the warning device 150 may generate a private certificate and transmit the private certificate to the client terminal 160. That is, the warning device 150 can support SSL communication. At this time, the private certificate may be a certificate corresponding to the site to which the client terminal 160 intends to access.

The transmitting of the certificate request packet from the client terminal 160 corresponds to the client Hello in the course of Client Hello, Server Hello, and Certificate connecting SSL communication. The warning device 150 transmits a private certificate to the client terminal 160, To send a certificate may correspond to a Certificate.

The warning device 150 obtains the server name from the information included in the private certificate using the SSL Client Hello and obtains the remaining information included in the private certificate through the certificate of the warning device 150, A private certificate containing the obtained server name and the remaining information can be generated. The remaining information may be information about the beginning and end of the validity period, information that can verify the authenticity of the certificate of the alert device 150.

Upon receipt of the private certificate, the client terminal 160 confirms whether the private certificate can be trusted and authenticates. When the authentication is successful, the client terminal 160 can transmit the request packet to the warning device 150.

The client terminal 160 may send the information about the warning device 150 or the warning server 151 or 152 to the trusted root certification authority 150 in advance in order to authenticate the private certificate generated by the warning device 150. [ . Alternatively, the client terminal 160 may manage the private certificate generated by the warning device 150 or the warning server 151 or 152 by including the private certificate in the root certificate.

In the past, when the network security system failed, normal network connection was often disabled. Even if the DNS blocking server 140 fails, the network security system according to the embodiment does not cause a problem of stopping the service because the network communication is continuously performed. For example, even if the DNS blocking server is malfunctioning, the DNS response packet is transmitted from the normal DNS server to the client terminal, so that the client terminal can make a normal network connection using the DNS response packet.

2 is a flowchart illustrating a process of processing a DNS query packet in a DNS blocking server of a network security system according to an exemplary embodiment.

Referring to FIG. 2, the DNS blocking server 140 mirrors a DNS query packet through a network device to which the client terminal 160 is connected (210).

Then, the DNS blocking server 140 extracts the DNS query domain address from the DNS query packet (220).

The DNS blocking server 140 determines whether the DNS query domain address is a managed domain address (230).

If it is determined in step 230 that the DNS query domain address is the address of the managed domain, the DNS blocking server 140 generates a bogus DNS response packet (240). At this time, the DNS blocking server 140 generates a spurious DNS response packet by inputting the IP address of the warning device 150 as a response IP address corresponding to the DNS query domain address.

Then, the DNS blocking server 140 transmits the generated bogus DNS response packet to the client terminal 160 (250).

FIG. 3 is a flowchart illustrating a process for alerting a warning server of a network security system according to an exemplary embodiment of the present invention when a connection to a management target is requested.

Referring to FIG. 3, the warning device 150 confirms whether the certificate request packet is received from the client terminal 160 (310).

Upon receipt of the certificate request packet in step 310, the warning device 150 determines whether a private certificate exists (step 320).

If the private certificate exists in step 310, the warning device 150 transmits the retrieved private certificate to the client terminal 160 (340).

If it is determined in step 310 that the private certificate does not exist, the warning device 150 generates a private certificate 330 and transmits the generated private certificate to the client terminal 160 (340). At this time, the private certificate may be generated including the server name obtained by using the SSL Client Hello and the remaining information included in the private certificate obtained through the certificate of the warning device 150.

Is generated by using the DNS query domain address to which the client terminal 160 wants to connect with a certificate corresponding to the site to which the client terminal 160 wants to connect.

Then, the warning device 150 confirms whether the request packet requesting connection to the site is received from the client terminal 160 that received the fake DNS response packet (330).

Upon receiving the request packet in step 330, the warning device 150 selects a warning page corresponding to the request packet according to the policy, and transmits the selected warning page to the client terminal 160 (340). At this time, the warning page is a page indicating that the site is blocked.

4 is a diagram showing a flow when a client terminal requests a connection to a site to be managed which requires SSL communication according to an embodiment.

Referring to FIG. 4, the DNS blocking server 140 mirrors a DNS query packet through a network device to which the client terminal 160 is connected (410).

If the DNS blocking server 140 extracts a DNS query domain address from the DNS query packet and confirms that the address is a management subject domain address, it is a managed domain address (412) and generates a false DNS response packet to the client terminal 160 (414). At this time, the IP address of the warning device 150 is written in the response IP address of the fake DNS response packet.

When the site to which the client terminal 160 is to access is a site requesting SSL communication, if a fake DNS response packet is received, the warning device 150 transmits a certificate request packet to the warning device 150 (416).

When the warning device 150 receives the certificate request packet from the client terminal 160 at step 416, the warning device 150 searches the stored private certificate and if the private certificate is not found, . At this time, the private certificate is a certificate corresponding to the site to which the client terminal 160 intends to access. The private certificate may be generated including the server name obtained using the SSL Client Hello and the remaining information included in the private certificate obtained through the certificate of the warning device 150. [

Then, the private certificate generated by the warning device 150 included in the warning device 150 is transmitted to the client terminal 160 (420).

When the client terminal 160 receives the private certificate from the warning device 150, it verifies whether the private certificate is legitimate. If the authentication is successful (step 422), the warning device 150 transmits the private certificate. And transmits a request packet (424).

Upon receiving the request packet from the client terminal 160 in the warning device 150, a warning page corresponding to the request packet is selected according to the policy, and the selected warning page is transmitted to the client terminal 160 (426).

FIG. 5 shows an example of a list of DNS blocking servers according to an embodiment.

5, a managed domain address list 500 is shown. The managed domain address can be stored in a database of a DNS blocking server, and an external database storing a managed domain address can be used . The managed domain address list may include a domain address field 510, an information field, and other fields may be generated and stored. At this time, the list of the managed domain addresses can be stored in a list in the database, and the managed domain addresses can be updated at regular intervals. Also, the managed domain address list can modify, add, and delete domain addresses.

The managed domain list can store the managed domain address. For example, the list of managed domains may contain the addresses of the managed domains, www.plustech.com, www.abc.com, and www.zzz.com. It may also include the address of at least one webmail site.

In the network security system according to an exemplary embodiment of the present invention, a method of displaying a blocking site may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

120; DNS server
140; DNS blocking server
150; Warning device
151; Distribution server
152; The first warning server
153; N th warning server
160; Client terminal
170; switch

Claims (16)

A DNS query packet of the DNS query packet is connected to a network device to which a client terminal is connected to mirror a DNS query packet through the network device and a DNS query domain address of the DNS query packet is a management target domain address based on Secure Sockets Layer A DNS blocking server that generates a fake DNS response packet and transmits the fake DNS response packet to the client terminal; And
When receiving the certificate request packet from the client terminal that has received the bogus DNS response packet, searches for a private certificate and transmits the private certificate to the client terminal if the private certificate exists, Generating a private certificate and transmitting the generated private certificate to the client terminal, and receiving an alert packet from the client terminal,
The network security system comprising:
The method according to claim 1,
The warning device comprises:
A plurality of virtual alert servers providing the alert pages,
Upon receiving the request packet, selects a warning page corresponding to the request packet according to a predetermined policy, and transmits the selected warning page to the client terminal
Network security system.
3. The method of claim 2,
The policy includes:
Indicating a corresponding alert page determined by considering at least one of a source IP, a destination IP, or a server name
Network security system.
The method according to claim 1,
Further comprising a plurality of warning servers for transmitting different warning pages to the client terminal according to a predetermined policy,
The warning device comprises:
Wherein the alert server is located at a front end of the plurality of alert servers, and when receiving the request packet, selects an alert server to process the request packet according to the policy, transmits the request packet to the selected alert server, The server sends a warning page to the client terminal
Network security system.
5. The method of claim 4,
The policy includes:
Representing the corresponding alert server determined by considering at least one of the source IP, the destination IP,
Network security system.
The method according to claim 1,
The private certificate includes:
Wherein the certificate is a certificate corresponding to a site to which the client terminal intends to connect
Network security system.
The method according to claim 1,
The warning device comprises:
Acquiring a server name using SSL Client Hello from the information included in the private certificate, acquiring the remaining information included in the private certificate through the certificate of the warning device, and generating the private certificate
Network security system.
The method according to claim 1,
The DNS blocking server,
The IP address of the warning device is input as a response IP address corresponding to the DNS query domain address to generate the fake DNS response packet
Network security system.
Mirroring a DNS query packet through a network device to which a client terminal is connected in a DNS blocking server;
Extracting a DNS query domain address from the DNS query packet in the DNS blocking server;
Determining from the DNS blocking server whether the DNS query domain address is a managed domain address based on secure sockets layer (SSL) communication;
Generating a spurious DNS response packet in the DNS blocking server if the DNS query domain address is a managed domain address based on SSL communication;
Transmitting the generated dummy DNS response packet from the DNS blocking server to the client terminal; And
Receiving a certificate request packet from the client terminal which has received the fake DNS response packet from the warning device, searching for a private certificate;
Transmitting the private certificate to the client terminal if the private certificate exists in the warning device;
Generating the private certificate and transmitting the private certificate to the client terminal if the private certificate does not exist in the warning device; And
When the warning device receives a request packet from the client terminal, transmitting a warning page to the client terminal informing that the site is blocked
Gt;
10. The method of claim 9,
The step of causing the warning device to transmit the alert page to the client terminal comprises:
Upon receiving the request packet, selecting an alert page corresponding to the request packet according to a predetermined policy; And
Transmitting the selected warning page to the client terminal
Gt;
11. The method of claim 10,
The policy includes:
Indicating a corresponding alert page determined by considering at least one of a source IP, a destination IP, or a server name
Network security method.
10. The method of claim 9,
The step of causing the warning device to transmit the alert page to the client terminal comprises:
When receiving the request packet from the alert server located at the front end of a plurality of alert servers for transmitting different alert pages to the client terminal according to a predetermined policy, the alert server for processing the request packet according to the policy Selecting; And
Sending the request packet to the selected alert server, and transmitting the alert page to the client terminal from the selected alert server
Gt;
13. The method of claim 12,
The policy includes:
Representing the corresponding alert server determined by considering at least one of the source IP, the destination IP,
Network security method.
10. The method of claim 9,
The private certificate includes:
Wherein the certificate is a certificate corresponding to a site to which the client terminal intends to connect
Network security method.
10. The method of claim 9,
Generating the private certificate and transmitting the generated private certificate to the client terminal,
Obtaining a server name using SSL Client Hello among the information included in the private certificate;
Obtaining remaining information included in the private certificate through the certificate of the warning device; And
Generating the private certificate including the obtained server name and the remaining information
Gt;
10. The method of claim 9,
Wherein the generating the spoofed DNS response packet comprises:
Generating the spoof DNS response packet by inputting the IP address of the warning device as a response IP address corresponding to the DNS query domain address
Gt;

Images