KR20180046476A - Apparatus and method for controlling access based on software defined perimeter - Google Patents

Abstract

A system for controlling access based on a software defined perimeter (SDP) according to an embodiment of the present invention includes: a service requesting device for transmitting a request for a network service to an SDP-based access control device; the SDP-based access control device for determining a policy on access to be applied to a service providing device for providing a network service based on pre-stored policy information, and transmitting the determined policy to the service providing device; and the service providing device which is implemented by a software defined infrastructure (SDI) system and provides the network service to the service requesting device according to the transmitted policy. Security can be improved.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an access control apparatus,

The present invention relates to an SDP-based access control apparatus and method, and more particularly, to an SDP-based access control apparatus and method that permits only a service request apparatus having an access authority to visibility of a service provision apparatus created by a Software Defined Infrastructure (SDI) system SDP-based access control apparatus and method.

Network Function Virtualization (NFV) is a technology that drives network node functions by implementing network nodes functioning as network devices in virtualized space based on cloud. For example, in the case of an EPS (Evolved Packet System) / LTE (Long Term Evolution) system, a Mobility Management Entity (MME), a Serving Gateway (SGW), a Packet Data Network Gateway (PGW)

By combining such software defined infrastructure (SDI) with NFV based mobile communication service system, various network nodes and IT service nodes can be virtualized, thereby improving the flexibility and agility of the mobile communication service system.

However, security vulnerabilities increase as the infrastructure is distributed and virtualized in a virtualized space. For example, when a service requesting device requests a network service for a virtualized network node (hereinafter, referred to as a service providing device) that provides a network service, the access to the service providing device may include a service connection such as an ID and a password It is controlled by credentials and security factors. At this time, since the service providing apparatus is visible to the service requesting apparatuses, only a malicious service requesting apparatus is allowed to access the service providing apparatus if the service access credentials are exposed.

A problem to be solved by an embodiment of the present invention is to provide a technology for improving security by restricting access of service requesting devices to a service providing device created by a software defined infrastructure (SDI) system.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed.

The SDP-based access control system according to an embodiment includes a service requesting device for transmitting a request for a network service to an SDP-based access control device, a connection request receiving unit for receiving the request and applying the service to the service providing device for providing the requested network service (SDI) system for determining a policy for a service provider based on previously stored policy information and transmitting the determined policy to the service providing apparatus, and a software defined infrastructure (SDI) Wherein the SDP-based access control apparatus is configured to provide the network service to the service request apparatus according to a policy, To access the device It is generated by receiving the policy.

The service providing apparatus includes a function providing unit that is generated by the software defined infrastructure system and provides the network service, and a gateway that manages access to the function providing unit of the service requesting apparatus based on the determined policy can do.

The SDP-based connection control apparatus according to an embodiment includes a communication unit that communicates with a service requesting apparatus, a storage unit that stores policy information used to control connection of the service requesting apparatus to a service providing apparatus that provides a network service, And a control unit that determines a policy to be applied to the service providing apparatus providing the requested network service based on the stored policy information when the network service request of the service request apparatus is received through the communication unit, Wherein the policy information is generated by receiving a policy for access right of the service request apparatus managed by the software definition infrastructure system to the service provision apparatus.

At this time, the received policy information includes a policy for the service providing device to be connected according to the network service, a policy for the authentication of the service requesting device for the service providing device, and a connection permission setting for the service providing device for the authenticated service requesting device Policy.

The SDP-based access control method according to an embodiment includes: a step in which a service requesting device transmits a request for a network service to an SDP-based access control device; and the SDP-based access control device receives the request to provide the network service Based on the pre-stored policy information, a policy regarding a connection to be applied to the service providing apparatus; transmitting the determined policy to the service providing apparatus by the SDP-based connection control apparatus; Wherein the SDP-based connection control unit is configured to transmit the service provision request from the service providing apparatus managed by the four software defined infrastructure system to the service request apparatus, Create and accept a policy for access rights to the device do.

At this time, the received policy information includes a policy for the service providing device to be connected according to the network service, a policy for the authentication of the service requesting device for the service providing device, and a connection permission setting for the service providing device for the authenticated service requesting device Policy.

According to one embodiment, an SDP-based access control apparatus based on a software defined perimeter (SDP) is combined with a software defined infrastructure (SDI) system to permit only a service request apparatus having access authority to a service provision apparatus, Security vulnerabilities can be addressed.

FIG. 1 is a diagram illustrating a configuration of an overall system including an SDP-based connection control apparatus according to an embodiment.
FIG. 2 is an exemplary diagram for explaining a connection form between a service requesting apparatus and a service providing apparatus when an SDP-based access control apparatus permits an access right to the network service of the service requesting apparatus.
3 is a functional block diagram of an SDP-based connection control apparatus according to an embodiment.
4 is a flowchart illustrating an SDP-based connection control method according to an embodiment.

DETAILED DESCRIPTION OF THE EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

The embodiments disclosed herein should not be construed or interpreted as limiting the scope of the present invention. It will be apparent to those of ordinary skill in the art that the description including the embodiments of the present specification has various applications. Accordingly, any embodiment described in the Detailed Description of the Invention is illustrative for a better understanding of the invention and is not intended to limit the scope of the invention to embodiments.

The functional blocks shown in the drawings and described below are merely examples of possible implementations. In other implementations, other functional blocks may be used without departing from the spirit and scope of the following detailed description. Also, although one or more functional blocks of the present invention are represented as discrete blocks, one or more of the functional blocks of the present invention may be a combination of various hardware and software configurations that perform the same function.

In addition, the expression "including any element" is merely an expression of an open-ended expression, and is not to be construed as excluding the additional elements.

Further, when a component is referred to as being connected or connected to another component, it may be directly connected or connected to the other component, but it should be understood that there may be other components in between.

Also, the expressions such as 'first, second', etc. are used only to distinguish a plurality of configurations, and do not limit the order or other features between configurations.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

1 is a diagram illustrating a configuration of an overall system including an SDP-based connection control apparatus 100 according to an embodiment.

1, an overall system including an SDP-based connection control apparatus 100 includes a software defined infrastructure (SDI) system 10, a service requesting apparatus 20, a service providing apparatus 30, And an SDP-based connection control apparatus 100.

Network Function Virtualization (NFV) is a technology that drives the function of a network node or an IT service node by implementing a network node or an IT service node that performs the function of a network device in a virtualized space based on a cloud. For example, a virtual machine (VM), a host (HOST), a container, and the like are implemented in a virtualized space on a virtualized space to serve as a data center (core data center) Can be driven.

In the present invention, a virtual infrastructure including the NFV is referred to as a software defined infrastructure (SDI), and a manager for the virtual infrastructure is defined as VIM (Virtual Infrastructure Manager).

Meanwhile, the software defined infrastructure system 10 according to the embodiment of the present invention provides information on a created virtual machine (VM), a host (HOST), a container, and the like to the software definition infrastructure system 10 Do not make it public.

This software defined infrastructure system 10 can be applied to network equipment services and IT services (e.g., Web, Was, DB, NoSQL, and user creation services, etc.) .

The service request apparatus 20 is a device for requesting the SDP-based connection control apparatus 100 for a network service to be provided. For example, the service requesting apparatus 20 may include a communication device such as a computer, a smartphone, a tablet PC, a smart watch, and the like.

The service providing apparatus 30 is implemented by the software definition infrastructure system 10 and provides the network service requested by the service requesting apparatus 20. [ At this time, the service providing apparatus 30 receives the functions provided in the cloud-based virtualized space by the software definition infrastructure system 10 and accesses the function providing unit 30 based on the policy determined in the SDP- Lt; RTI ID = 0.0 > a < / RTI >

At this time, the function providing unit includes a virtual machine (VM), a host (HOST), a container, and the like implemented in a virtualized space through the software definition infrastructure system 10, core date center), and so on.

In the service providing apparatus 30, one gateway can manage the connection to the plurality of function providing units, or a plurality of gateways can manage the connection to the plurality of function providing units.

Upon receiving the network service request of the service requesting apparatus 20, the SDP-based connection control apparatus 100 determines a policy on the connection to be applied to the service providing apparatus 30 based on the pre-stored policy information, To the service providing apparatus 30. The pre-stored policy information may be generated by receiving the policy managed by the SDP-based connection control apparatus 100 in the software defined infrastructure system 10. Hereinafter, the transmission of the policy will be described later.

2 is a diagram for explaining a connection form between the service requesting apparatus 20 and the service providing apparatus 30 when the SDP-based connection controlling apparatus 100 permits access to the network service of the service requesting apparatus 20. [ FIG.

As described above, in the entire system including the SDP-based connection control apparatus 100, the service requesting apparatus 20 does not exist for the service requesting apparatus 20.

2, the SDP-based connection control apparatus 100 accesses the service providing apparatus 20 to the service providing apparatus 30 providing the network service according to the network service request of the service requesting apparatus 20 The service requesting apparatus 20 sends the information necessary for accessing the service providing apparatus 30 (for example, the address of the gateway included in the service providing apparatus 30) to the SDP- The service providing apparatus 30 can access the service requesting apparatus 20 from the SDP-based connection controlling apparatus 100. The service providing apparatus 30 can access the service providing apparatus 30 from the SDP- The service requesting apparatus 20 can receive the policy and allow the connection of the service requesting apparatus 20.

For example, the gateway of the service providing apparatus 30 opens a pin-hole of a firewall in the front end of the gateway to allow connection to the gateway for a connection request of the access requesting service request apparatus 20 , A port for a function providing unit that provides a network service requested by the service requesting apparatus 20 may be opened to allow data transmission / reception with the function providing unit.

3 is a functional block diagram of an SDP-based connection control apparatus 100 according to an embodiment.

Referring to FIG. 3, the SDP-based connection control apparatus 100 includes a communication unit 110, a storage unit 120, and a determination unit 130.

The communication unit 110 performs communication with the service requesting apparatus 20 and the service providing apparatus 30. [ In order to perform these operations, the communication unit 110 may include a communication module for exchanging data with an external device.

The storage unit 120 stores policy information used to control connection of the service requesting apparatus 20 to the service providing apparatus 30 providing the network service. At this time, the SDP-based connection control apparatus 100 receives the policy of the software definition infrastructure system 10 and uses it.

For example, when creating or deleting virtualized resources such as Compute / Storage / Network in a Virtual Infrastructure Manager (VIM) of a network function virtualization system, which is one of the software defined infrastructure systems 10, It is possible to hook up the policy for setting the access authority information and store it in the storage unit 120. [ This process can be stored in the PIP (Policy Information Point, corresponding to the storage unit 120 of the SDP-based connection control apparatus 100) by the PEP (Policy Enforcement Point) according to XACML.

Therefore, it is possible to utilize the policy by interlocking the SDP-based connection control apparatus 100 without changing the implementation of the existing software definition infrastructure system 10, and to use the policy when the SDP-based connection control apparatus 100 of the service requesting apparatus 20 is called The determination unit 130 may determine a policy determined by the service providing apparatus 30 based on the PIP, that is, the policy information of the storage unit 120.

The received policy information includes, for example, a policy for the service providing apparatus 30 to be connected according to the network service, a policy for the authentication of the service requesting apparatus 20 to the service providing apparatus 30, And a permission setting policy for the requesting device 20 to the service providing device 30.

Upon receiving the network service request of the service requesting apparatus 20 through the communication unit 110, the determining unit 130 transmits a policy to be applied to the service providing apparatus 30 providing the requested network service to the storage unit 120 Determines the policy based on the stored policy information, and transmits the determined policy to the service providing device (30) through the communication unit (110).

2, when the communication unit 110 of the SDP-based connection control apparatus 100 receives a request to receive a network service from the service requesting apparatus 20, the determining unit 130 Of the first service providing apparatus 31, the second service providing apparatus 32 and the third service providing apparatus 33 that provide different network services to the storage unit 120, It is possible to determine a specific service providing apparatus 30 capable of providing the service.

In addition, it is possible to authenticate whether the determined service request apparatus 20 has an authority to access the determined service providing apparatus 30, and if it is authenticated, determine a policy for the access authority to be applied to the authenticated service request apparatus 20 .

The determination unit 130 then transmits the policy determined through the communication unit 110 to the service providing apparatus 30 providing the corresponding network service and transmits information about the service providing apparatus 30 capable of providing the network service To the service requesting device 20.

Therefore, when the SDP-based connection control apparatus 100 receives a request from the service requesting apparatus 20, the SDP-based connection control apparatus 100 transmits a policy regarding the connection to be applied to the service requesting apparatus 20 and the service providing apparatus 30 to the software definition infrastructure system 10 ), It is possible to directly determine the policy to be applied to the request through the pre-stored policy information.

Meanwhile, the communication unit 110, the storage unit 120, and the determination unit 130, which are included in the above-described embodiments, include a memory including instructions programmed to perform these functions, and a microprocessor Gt; device. ≪ / RTI >

4 is a flowchart illustrating an SDP-based connection control method according to an embodiment.

Referring to FIG. 4, the service request apparatus 20 first transmits a request for the network service to the SDP-based connection control apparatus 100 (S410).

The SDP-based connection control apparatus 100 receives the request of the service requesting apparatus 20 and determines a policy concerning the connection to be applied to the service providing apparatus 30 providing the network service based on the pre-stored policy information S420).

Then, the SDP-based connection control apparatus 100 transmits the determined policy to the service providing apparatus 30 (S430), and the SDP-based connection control apparatus 100 transmits the information of the service providing apparatus 30 to the service request apparatus 30. [ (Step S440). At this time, the time series sequence of steps S430 and S440 is not limited, and embodiments that achieve the object of the present invention can be implemented even if any of the steps are executed first.

Accordingly, the service requesting apparatus 20 can acquire information about the service providing apparatus 30 and request a connection to the service providing apparatus 30, and the service providing apparatus 30 can access the SDP-based connection controlling apparatus 100 It is possible to receive the policy for allowing access to the service request apparatus 20 to allow the connection. Accordingly, the service requesting apparatus 20 may be connected to the service providing apparatus 30 to receive the network service (S350).

Therefore, according to the embodiment described above, the SDP-based access control apparatus 100 based on software defined perimeter (SDP) is combined with the software defined infrastructure system 10, and the visibility of the service providing apparatus 30 providing the network service To the service requesting apparatus 20 having the access authority, it is possible to solve various security vulnerabilities that may be caused by the presence of the network node being exposed to the outside.

The above-described embodiments may be implemented by various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

In the case of hardware implementation, the method according to embodiments of the present invention may be implemented in one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs) , FPGAs (Field Programmable Gate Arrays), processors, controllers, microcontrollers, microprocessors, and the like.

In the case of an implementation by firmware or software, the method according to embodiments of the present invention may be implemented in the form of a module, a procedure or a function for performing the functions or operations described above. The software code can be stored in a memory unit and driven by the processor. The memory unit may be located inside or outside the processor, and may exchange data with the processor by various well-known means.

Thus, those skilled in the art will appreciate that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the embodiments described above are to be considered in all respects only as illustrative and not restrictive. The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

10: Software Defined Infrastructure (SDI) System
20: Service request device
30: Service providing device
31: first service providing apparatus
32: second service providing apparatus
33: Third service providing apparatus
100: SDP based connection control device
110:
120:
130:
SDP GW: Gateway

Claims (6)

A service requesting device for transmitting a request for a network service to a SDP (Software Defined Perimeter)
Based on the stored policy information, a policy regarding a connection to be applied to the service providing apparatus providing the requested network service, and transmitting the determined policy to the service providing apparatus, [0001]
A service providing apparatus, which is implemented by a software defined infrastructure (SDI) system and provides the network service to the service request apparatus according to the transmitted policy,
The pre-
The SDP-based connection control apparatus receives the policy for the access right to the service providing apparatus of the service requesting apparatus managed by the software defined infrastructure system
SDP based access control system. The method according to claim 1,
The service providing apparatus includes:
A function providing unit that is generated by the software defined infrastructure system and provides the network service,
And a gateway for managing a connection to the function providing unit of the service requesting apparatus based on the determined policy
SDP based access control system. A communication unit for performing communication with the service request apparatus,
A storage unit for storing policy information used to control connection of the service requesting apparatus to a service providing apparatus providing network services;
When the network service request of the service request apparatus is received through the communication unit, a policy to be applied to the service providing apparatus that provides the requested network service is determined based on the stored policy information, And a determination unit configured to control transmission to the service providing apparatus,
Wherein the stored policy information comprises:
A policy for access right to the service providing apparatus of the service requesting apparatus managed by a software defined infrastructure (SDI) system is received and generated
SDP based access control apparatus. The method of claim 3,
The received policy information may include,
A policy for authentication of the service requesting device with respect to the service providing device, and a policy for setting access authorization to the service providing device for the authenticated service requesting device,
SDP based access control apparatus. The service requesting device sending a request for a network service to a software defined perimeter (SDP) based access control device;
The SDP-based access control apparatus receiving the request and determining a connection-related policy to be applied to the service providing apparatus providing the network service based on pre-stored policy information;
The SDP-based connection control apparatus transmitting the determined policy to the service providing apparatus;
Wherein the SDP-based connection control apparatus transmits information of the service providing apparatus to the service request apparatus,
The pre-
The SDP-based access control apparatus receives a policy for access right to the service providing apparatus of the service requesting apparatus managed in the Software Defined Infrastructure (SDI) system
SDP based access control method. 6. The method of claim 5,
The received policy information may include,
A policy for authentication of the service requesting device with respect to the service providing device, and a policy for setting access authorization to the service providing device for the authenticated service requesting device,
SDP based access control method.

Images