KR20190040834A - Security device and method for virtual network - Google Patents

Abstract

The present invention proposes a security device and a security method for a virtual network which realize a security control technology ameliorating security vulnerabilities and enhancing security in consideration of characteristics of a virtual network environment which is dynamically configured/changed using a common network infrastructure on the network.

Description

TECHNICAL FIELD [0001] The present invention relates to a virtual network security apparatus,

The present invention relates to a virtual network technology, and more particularly, to a virtual network technology in which a security vulnerability can be improved and security can be further enhanced by considering a characteristic of a virtual network environment that is dynamically configured / changed using a common network infrastructure Control technology.

A virtual network is a virtual network constructed on a network, and is typically used for a cloud service that is evolving rapidly in recent years.

Cloud service (or cloud computing) is a technology that provides data service based on a virtual network configured on the network by utilizing Internet technology. It provides various functions (process) such as data classification, calculation, processing and analysis, , Storage space, and so on, as necessary.

Accordingly, the cloud service based on the virtual network is capable of processing a large amount of data that can not be accommodated at the resource level actually possessed by the user at a high speed, and is capable of using the high performance / high speed data service based on this do.

On the other hand, the security method employed in the network is a method of allowing / limiting access based on a security tool (for example, a firewall) in an environment where the visibility and accessibility of network elements are opened.

When applying the conventional general network security method to the virtual network environment, various security vulnerabilities such as exposure of Denial of Service attack on Application access port, risk of losing control of server due to Credential theft, connection hijacking, APT / lateral movement exposure, .

In recent years, a network slicing technology has been emerging that divides a physical common network infrastructure into a plurality of independent virtual networks and provides independent data services adapted to respective service characteristics.

In this network slicing technique, a virtual network is dynamically configured for each data service using a common network infrastructure on a network, so that each segment of the virtual network has an environmental characteristic that is dynamically changed.

Thus, given the environmental characteristics of a virtual network that is particularly dynamically configured / changed, the above-described security vulnerability to each segment of the virtual network can be even more lethal.

Accordingly, the present invention proposes a new security control technique capable of improving the security vulnerability and enhancing the security in consideration of the characteristics of the virtual network environment dynamically configured / changed.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide a security control method capable of improving a security vulnerability and enhancing security by considering characteristics of a virtual network environment dynamically configured / changed using a common network infrastructure Technology.

According to a first aspect of the present invention, there is provided a virtual network security apparatus for managing a virtual network for a specific service using network resources selected on a network, based on a tenants policy defined in the specific service, A network configuration controller; And a network security controller for controlling a dynamic security function implemented for each segment of the virtual network on the basis of the tenant policy and applying individual security for each specific segment of the virtual network to the specific service.

Advantageously, the virtual network may include a core computing node providing a cloud service for the specific service and an edge computing node distributing the cloud service to the core computing node.

Preferably, the dynamic security function is based on an all deny setting for blocking all accesses, and may allow access only to a specific access according to the control of the network security control unit.

Preferably, the network security control unit provides access information required for connection to the specific service to an access subject authenticated to the specific service, and provides dynamic security function implemented by segments of the virtual network configured for the specific service So as to allow access to the access from the accessing entity.

Preferably, the tenant policy is configured to configure a virtual network by setting a data path between segments for each of a plurality of service functions provided by the specific service, and the plurality of service functions Different approaches to each can be allowed differently.

Preferably, the network security control unit notifies the access subject authenticated for the specific service of access information necessary for access to a specific service function that allows access to the level of the access right given to the access subject among the plurality of service functions And only the dynamic security function implemented in the segment for setting the data path of the specific service function among the segments of the virtual network configured for the specific service is controlled to permit access to the access from the access subject .

According to a second aspect of the present invention, there is provided a method for securing a virtual network for a specific service based on a tenants policy defined in a specific service, Configure network configuration steps; And a network security control step of controlling a dynamic security function implemented for each segment of the virtual network based on the tenant policy to apply individual security for each specific segment of the virtual network to the specific service.

Preferably, the dynamic security function is based on an all deny setting for blocking all accesses, and may allow access only to a specific access according to the control in the network security control step.

Preferably, the network security control step may include providing access information required for connection to the specific service to an access subject authenticated for the specific service, and providing dynamic access control information for each specific segment of the virtual network, So that access to the access from the accessing entity can be allowed.

Thus, according to the virtual network security apparatus and the virtual network security method of the present invention, a new security control technique that takes into consideration the characteristics of a virtual network environment that is dynamically configured / changed using a common network infrastructure on a network is realized, Improve security and enhance security.

1 is a block diagram illustrating an example in which a cloud service is implemented based on a virtual network to which the present invention is applied.
FIG. 2 is an exemplary diagram illustrating the configuration and functions of a virtual network security apparatus according to an exemplary embodiment of the present invention. Referring to FIG.
3 is an exemplary diagram illustrating a structure in which a security control technique realized according to the present invention is implemented in a distributed cloud service.
4 is a control flowchart illustrating a virtual network security method according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 1 illustrates an example in which a cloud service is implemented based on a virtual network to which the present invention is applied.

Virtual networks are typically used for cloud services that are evolving rapidly in recent years.

Cloud service (or cloud computing) is a technology that provides data service based on a virtual network configured on the network by utilizing Internet technology. It provides various functions (process) such as data classification, calculation, processing and analysis, , Storage space, and so on, as necessary.

Such a cloud service has evolved rapidly in recent years. As shown in FIG. 1, a cloud service provided on a network is dispersed from the edge of a location close to a user (terminal) to a core network and a core network, A hybrid service environment (hereinafter, a distributed cloud service environment) has emerged.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security control technique for a virtual network constituted on a network, that is, a virtual network.

Accordingly, the present invention proposes a security procedure that can be applied not only to a virtual network in a service environment (hereinafter, referred to as a cloud service environment) provided only in the core network but also to a virtual network in the distributed cloud service environment described above, I want to realize it.

1, a distributed cloud service environment includes a user, that is, a terminal 10 and a core network 1, and performs data operation processing according to an application executed in the terminal 10, A core computing node 200 that is located between the terminal 10 and the core computing node 200 and selectively performs some data operation processing during data operation processing according to an application executed in the terminal 10 And an edge computing node 100 that distributes the cloud service to the core computing node 200.

The core computing node 200 provides a cloud service for a specific service by an application executed in the terminal 10 and the edge computing node 100 distributes the cloud service to and from the core computing node 200 .

Meanwhile, although a general cloud service environment is not shown in FIG. 1, it may be regarded as an environment composed only of the core computing node 200 except for the edge computing node 100 in FIG.

In FIG. 1, the service user (in other words, the access subject) is shown as the user terminal 10, but this is only an embodiment for convenience of explanation and may be a separate server (not shown).

On the other hand, the security method employed in the network is a method of allowing / limiting access based on a security tool (for example, a firewall) in an environment where the visibility and accessibility of network elements are opened.

When applying the conventional general network security method to the virtual network environment, various security vulnerabilities such as exposure of Denial of Service attack on Application access port, risk of losing control of server due to Credential theft, connection hijacking, APT / lateral movement exposure, .

In recent years, a network slicing technology has been emerging that divides a physical common network infrastructure into a plurality of independent virtual networks and provides independent data services adapted to respective service characteristics.

In this network slicing technique, a virtual network is dynamically configured for each data service using a common network infrastructure on a network, so that each segment of the virtual network has an environmental characteristic that is dynamically changed.

Thus, given the environmental characteristics of a virtual network that is particularly dynamically configured / changed, the above-described security vulnerability to each segment of the virtual network can be even more lethal.

Accordingly, the present invention proposes a new security control technique capable of improving the security vulnerability and enhancing the security in consideration of the characteristics of the virtual network environment dynamically configured / changed.

The virtual network security apparatus 300 of the present invention shown in FIG. 1 controls a security function for a virtual network configured to provide a specific service.

In the distributed cloud service environment as shown in FIG. 1, the edge computing node 100 and the core computing node 200 may be referred to as a virtual network. In this case, the virtual network security apparatus 300 may be a virtual network, The security function can be controlled for the node 100 and the core computing node 200.

Hereinafter, the configuration and functions of the virtual network security apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

As shown in FIG. 2, the virtual network security device 300 of the present invention is a virtual network security device that uses a network resource selected on a network, based on a tenant policy defined in a specific service, And a dynamic security function implemented for each segment of the virtual network based on the tenant policy to control the dynamic security function implemented by the segment according to the segment of the virtual network And a network security control unit (hereinafter referred to as a dynamic perimeter security control unit 320) for enabling individual security to be applied.

The dynamic network configuration controller 310 configures a virtual network for the specific service based on the tenant policy defined in the specific service, using the network resources selected on the network.

That is, the dynamic network configuration controller 310 configures a virtual network for providing a specific service on the network.

Specifically, the dynamic network configuration controller 310 selects a necessary network resource (Information Technology resource) from a physical common network infrastructure on the network, based on the tenant policy defined in the specific service, And a virtual network for the network.

At this time, when the implementation of the specific service is determined, the dynamic network configuration controller 310 acquires the tenant policy defined in the specific service. The subject providing the tenant policy is not limited.

Here, the tenant policy basically defines various required configuration information (setting values) for providing a specific service in the form of a cloud service based on a virtual network.

For example, a tenant policy defines whether a virtual network for a specific service is configured as a general cloud service type (environment) or a distributed cloud type service (environment), and a hardware required for the characteristic service (Hereinafter, service setting information) necessary for configuring a virtual network for implementing a specific service, such as the specification information of the software resources, is defined.

In FIG. 2, a typical cloud service environment configured by the core computing node 200 'is shown as an example.

In this case, the dynamic network configuration control unit 310 recognizes that it is configured as a general cloud service type (environment) based on the tenant policy defined in the specific service, recognizes the service setting information, That is, the core computing node 200 '.

Specifically, the dynamic network configuration control unit 310 can select a processor (processing H / W) of a specific processing function fixedly operated in the core computing node 200 '.

For example, the dynamic network configuration control unit 310 can select a specific hardware chip (or card or device) for processing acceleration, for example, a plurality of virtual swithes 210, as shown in FIG.

Alternatively, the dynamic network configuration control unit 310 may select a processor (processing H / W) as a hardware resource that can be dynamically operated in the core computing node 200 'and perform a specific processing function on the selected processor (processing H / W) Can be set.

2, the dynamic network configuration control unit 310 selects a processor (processing H / W) 210 as a hardware resource that can be dynamically operated and selects a processor (processing H / W) The function of the virtual swith for accelerating the processing can be set in the memory 210. [

The dynamic network configuration controller 310 may configure a virtual network for a specific service by setting a software function to be operated on a hardware resource, that is, a Virtual Swith 210. [

For example, the dynamic network configuration control unit 310 allocates a network function and storage 220 for a specific service to the core computing node 200 '.

In other words, the dynamic network configuration control unit 310 may be configured to allow the core computing node 200 'to perform a network function to enable network communication for providing a specific service, a storage function to support network communication and interworking with its own storage .

The dynamic network configuration control unit 310 controls the core computing node 200 'to perform a network function on the selected (and set) hardware resource, that is, a virtual switch 210, and a software function .

Specifically, the dynamic network configuration control unit 310 controls the core computing node 200 'to install a software function 230 that will operate on the network resource 210, that is, the network function on the hardware resource and the storage 230 .

In FIG. 2, as a software function 230, there are installed v EPC (Virtual Evolved Packet Core), FW (Fire Wall), LB (Load Balancing), and most services for providing a specific service.

In this way, the dynamic network configuration controller 310 can determine a virtual network for a specific service, that is, a core computing node (not shown) by using network resources selected on the network (200 ').

The dynamic network configuration controller 310 is a virtual infrastructure manager (VIM) that manages and manages physical / virtual resources based on cloud technology as a node that utilizes hardware / software resources in a physical common network infrastructure and constitutes a virtual network, Or may be a separate node that interfaces with the VIM.

The dynamic network configuration controller 310 dynamically configures a virtual network for a specific service by separating the physical common network infrastructure into a plurality of independent virtual networks and extracts an independent data service corresponding to each service characteristic Based on the network slicing technique.

Therefore, the virtual network configured dynamically by the dynamic network configuration controller 310 according to the network slicing technology, that is, the core computing node 200 ', is dynamically configured only for a specific service using a common network infrastructure on the network, Each segment of the network has an environmental characteristic that changes dynamically.

Accordingly, the dynamic network configuration controller 310 can be defined as a SDN (Software Defined Network) controller.

The dynamic perimeter security controller 320 controls the dynamic security function implemented by each segment of the virtual network, that is, the core computing node 200 'dynamically configured by the dynamic network configuration controller 310, based on the tenant policy defined in the specific service .

More specifically, each segment of the virtual network refers to a unit of a unit in which input / output is performed through a communication port in a virtual network. Referring to FIG. 2, each of the hardware resources Quot;) < / RTI >

As shown in FIG. 2, a dynamic security function is implemented in each segment constituting the virtual network constituted by the dynamic network configuration controller 310, that is, the core computing node 200 '.

Here, the dynamic security function implemented in each segment is based on a specific security setting (all deny setting) for blocking all accesses, and allows access only to a specific access under the control of the network security control unit 310.

For example, as shown in FIG. 2, in each segment corresponding to software resources constituting a virtual network, that is, FW, LB, and Service, a dynamic security function is provided in the form of SDP (Soft Defined Perimeter) , And the dynamic security function can be implemented in the form of an SDP enabled kernel to which SDP is applied in the case of the remaining LB and Service.

As another example, a dynamic security function is implemented in the form of SDP (Soft Defined Perimeter) G / W in front of an access path of a software resource constituting a virtual network, and each segment corresponding to FW, LB, Can be implemented as an SDP Enabled kernel.

This dynamic security function can be implemented in a technique (or a form) suitable for each segment constituting the virtual network constituted by the dynamic network configuration controller 310, that is, the core computing node 200 ' There is no limit to the technique.

The dynamic perimeter security controller 320 determines whether the dynamic security controller 310 is a dynamic security controller that is dynamically configured according to a segment of the virtual network or the core computing node 200 ' Function, so that individual security can be applied to a specific service in a segment unit of the virtual network.

More specifically, for example, in addition to the service setting information described above, all the information (hereinafter, security control information) necessary for allowing / limiting access by each tenant / user can be defined in a tenant policy defined in a specific service.

As an example, a tenant policy may define tenant security control information that allows all accesses to a particular service to an access subject authorized for that particular service.

In this case, the dynamic perimeter security controller 320 provides access information required for access to a specific service to the access subject authenticated for the specific service based on the tenant policy, especially the tenant security control information.

The dynamic perimeter security control unit 320 refers to the user terminal 10 as the access subject. For example, only when the dynamic perimeter security control unit 320 performs the general authentication procedure for the terminal 10 attempting to access the specific service, And provides the terminal 10 with access information necessary for connection to a specific service.

When providing the access information to the terminal 10, the dynamic perimeter security control unit 320 may provide the dynamic security function 240 implemented for each segment of the virtual network configured for the specific service, that is, the core computing node 200 ' So that access to the terminal 10 is permitted.

For example, the dynamic perimeter security control unit 320 controls the security setting of the dynamic security function 240, which is implemented for each segment, so that a pin hole is opened for access from the terminal 10 to permit access.

In this case, the virtual network security device 300 can realize the security control technique (technique) proposed in the present invention by each data service unit, that is, a tenant unit including the aforementioned specific service realized by dynamically configuring a virtual network have.

On the other hand, as another example, in the tenant policy, security control information for each user may be defined that allows access to a specific service differently according to the level of access authority possessed by the access subject to an access subject authenticated for the specific service.

In this case, the tenant policy makes it possible to configure a virtual network by setting a data path between segments for each of a plurality of service functions provided by a specific service, and for each of the plurality of service functions, It is desirable to allow different access.

More specifically, in order to implement a plurality of service functions provided by a specific service, a data path between each segment is set for each service available in the tenant policy defined in the specific service, or more precisely in the service setting information described above Information may be included.

In addition, the tenant policy defined in a specific service, or more precisely, the security control information per user described above, will include information allowing different access to each of a plurality of service functions provided by a specific service by level of access authority.

For example, assuming that the level of access authority is upper / lower / lower, the access level upper level access subject is allowed to access all of a plurality of services provided by a specific service (all access to a specific service is permitted) , The access level of the access right level is allowed to access only the remaining service functions except for the service function related to the information deletion / modification among the plurality of services provided by the specific service, and the access level of the access level is provided to the specific service Only access to service functions related to information information retrieval / retrieval among a plurality of services can be permitted.

In this case, the dynamic perimeter security control unit 320 transmits to the dynamic perimeter security control unit 320 a connection request for access to a specific service function that allows the access subject authorized for the specific service to access the level of the access right granted to the access subject, Provide information only.

The dynamic perimeter security control unit 320 refers to the user terminal 10 as the access subject. For example, only when the dynamic perimeter security control unit 320 performs the general authentication procedure for the terminal 10 attempting to access the specific service, It is possible to provide only the access information necessary for connection to the specific service function that allows access to the level of the access authority granted to the terminal 10. [

For example, if the terminal 10 is at the middle access level, the dynamic perimeter security control unit 320 determines whether or not the terminal 10 has been authorized to access the terminal 10 only when the terminal 10 has been authenticated It is possible to provide only the access information necessary for connection to a specific service function (access to the service functions other than the service function related to deletion / modification of information) which allows access to the middle level of the access authority.

When providing the access information to the terminal 10, the dynamic perimeter security controller 320 sets the data path of the specific service function among the segments of the virtual network configured for the specific service, that is, the core computing node 200 ' Only the dynamic security function implemented in the segment is allowed to access the terminal 10.

For example, the dynamic perimeter security control unit 320 may include a specific service function (a service function related to deletion / modification of information) for permitting access to middle level of the access right given to the terminal 10 by the dynamic security function 240, The security function of the dynamic security function implemented in the segment for setting the data path of the service function except the service function of the terminal 10 is controlled so that the access from the terminal 10 is allowed by opening the pin hole.

In this case, the virtual network security device 300 can realize the security control technique (technique) proposed by the present invention on a user-by-user basis for each data service including the above-mentioned specific service realized by dynamically configuring a virtual network have.

In this manner, the dynamic perimeter security controller 320 can apply the individual security to the specific service based on the tenant policy defined in the specific service, in units of segments of the virtual network.

The dynamic perimeter security controller 320 is a node for controlling a security function for a virtual network, and may correspond to a VIM or may be a separate node linked with the VIM.

As described above, according to the present invention, network segmentation that implements a dynamic security function based on a specific security setting (All deny setting) for each segment of a virtual network dynamically configured based on a tenant policy according to a network slicing technique Under the structure (model), the dynamic security function of each segment is individually controlled based on the tenant policy, and individual security is applied to each segment, so that accessibility to the network element can be prevented.

In particular, each segment of a virtual network that is dynamically configured according to the network slicing technique can be dynamically changed in characteristics. In the present invention, a dynamic security function is implemented for each segment, so that it can flexibly cope with such a segment change situation.

Furthermore, the present invention can not open the visibility to the network element by providing the access subject with minimum access information required only at the time of authentication under the network isolation structure (model) described above.

As described above, according to the present invention, unlike an existing general network security method that opens up visibility and accessibility to network elements, network isolation that implements a dynamic security function based on a specific deny setting for each segment of a virtual network Based on the structure (model), a new security control technology that minimizes exposure while allowing flexibility in response to the characteristics of the virtual network environment, that is, each segment can be dynamically changed without opening the visibility and accessibility, is realized have.

Accordingly, the present invention provides a security vulnerability that may cause a denial of service attack on an application access port, a risk of losing control of a server due to a credential theft, connection hijacking, and APT / lateral movement exposure Thereby improving the security.

On the other hand, FIG. 2 illustrates a case where a core computing node 200 'in a general cloud service type (environment) is configured as a virtual network configured for a specific service.

Alternatively, FIG. 3 schematically shows a case where an edge computing node and a core computing node in a distributed cloud service type (environment) are configured as a virtual network configured for a specific service.

As shown in FIG. 3, in the case of configuring a virtual network in the form of a distributed cloud service (environment), the present invention is applied to the case of configuring a virtual network of the above-described general cloud service type (environment) .

The dynamic network configuration control unit 310 recognizes that the service is configured in a distributed cloud service type (environment) based on a tenant policy defined in a specific service, and recognizes / sets the service setting information for a specific service That is, the edge computing node 100 and the core computing nodes 200A and 200B.

3, the process of configuring the virtual network, that is, the edge computing node 100 and the core computing nodes 200A and 200B is not specifically described and shown, but the SDP G / W, FW, Resource Pool.

The dynamic perimeter security controller 320 controls the virtual network such as the edge computing node 100 and the core computing nodes 200A and 200B based on the tenant policy defined in the specific service, ) To control a dynamic security function implemented for each segment, thereby enabling individual security to be applied to a specific service in a segment unit of a virtual network.

At this time, the virtual network security device 300 can also realize the security control technique (technique) proposed in the present invention by each data service unit, that is, a tenant unit including the above-mentioned specific service realized by dynamically configuring a virtual network And may be realized for each data service on a user-by-user basis.

Hereinafter, a virtual network security method according to a preferred embodiment of the present invention will be described with reference to FIG.

Here, for convenience of explanation, the configuration shown in FIG. 2 will be described with reference to corresponding reference numerals.

According to the virtual network security method of the present invention, when the implementation of a specific service is determined, the virtual network security device 300 acquires a tenant policy defined in a specific service (S100).

Accordingly, according to the virtual network security method of the present invention, the virtual network security device 300 selects necessary network resources (Information Technology resources) in the physical common network infrastructure on the network based on the tenant policy defined in the specific service The selected network resource is used to configure a virtual network for a specific service (S110).

2, the virtual network security apparatus 300 includes a processor (a processing H / W) of a specific processing function fixedly operated in the core computing node 200 'based on a tenant policy defined in a specific service, W) can be selected.

For example, the virtual network security appliance 300 may select a particular hardware chip (or card, or device) for processing acceleration, e.g., multiple Virtual Swith 210, as shown in FIG.

Alternatively, the virtual network security device 300 may select a processor (processing H / W) as a hardware resource that can be dynamically operated in the core computing node 200 'and perform a specific processing function on the selected processor (processing H / W) Can be set.

For example, the virtual network security apparatus 300 selects a processor (processing H / W) 210 as a hardware resource that can be dynamically operated, selects a processor (processing H / W) The function of the virtual swith for accelerating the processing can be set in the memory 210. [

The virtual network security apparatus 300 can configure a virtual network for a specific service by setting a software function to be operated on a hardware resource, that is, a Virtual Swith 210.

For example, the virtual network security appliance 300 allocates network functions and storage 220 for a particular service to the core computing node 200 '.

That is, the virtual network security apparatus 300 includes a network function for allowing the core computing node 200 'to perform network communication for providing a specific service, a storage function for supporting network communication and interworking with its own storage .

The virtual network security apparatus 300 further includes a software function to be operated using the network function and the storage 220 on the selected (and set) hardware resource, that is, the Virtual Swith 210, .

In particular, the virtual network security appliance 300 may be configured to provide the core computing node 200 'with a network function 210, that is, a network function on the hardware resource, and a software function 230 to operate using the storage 230 .

The virtual network security apparatus 300 can set a data path between segments according to a plurality of service functions provided by a specific service based on a tenant policy.

The virtual network security device 300 may implement the dynamic security function 240 for each segment.

In this way, according to the virtual network security method of the present invention, the virtual network security device 300 can securely access the network resources (i.e., hardware / software resources) selected on the network based on the tenants policy defined in the specific service The core computing node 200 'can be configured.

According to the virtual network security method of the present invention, the virtual network security device 300 sets a specific security setting (All deny setting) to block all accesses to the dynamic security function 240 implemented for each segment (S120).

In this case, the dynamic security function implemented in each segment is based on an all deny setting that blocks all accesses, and allows access only to a specific access according to the security control described later.

For example, as shown in FIG. 2, in each segment corresponding to software resources constituting a virtual network, that is, FW, LB, and Service, a dynamic security function is provided in the form of SDP (Soft Defined Perimeter) , And the dynamic security function can be implemented in the form of an SDP enabled kernel to which SDP is applied in the case of the remaining LB and Service.

As another example, a dynamic security function is implemented in the form of SDP (Soft Defined Perimeter) G / W in front of an access path of a software resource constituting a virtual network, and each segment corresponding to FW, LB, Can be implemented as an SDP Enabled kernel.

This dynamic security function can be implemented in a technique (or a form) suitable for each segment of the virtual network, that is, each segment constituting the core computing node 200 ', and does not limit the implementation technique.

In addition, according to the virtual network security method of the present invention, the virtual network security apparatus 300 may be configured to perform a security policy based on a tenant policy defined in a specific service, The dynamic security function is controlled so that individual security can be applied to a specific service in a segment unit of a virtual network.

More specifically, for example, in addition to the service setting information described above, all the information (hereinafter, security control information) necessary for allowing / limiting access by each tenant / user can be defined in a tenant policy defined in a specific service.

Hereinafter, for convenience of explanation, it will be assumed that security control information for each user is defined in the tenant policy.

In this case, the tenant policy defined in the specific service, or more precisely, the security control information for each user described above, will include information for differently allowing access to each of a plurality of service functions provided by a specific service by level of access authority.

For example, assuming that the level of access authority is upper / lower / lower, the access level upper level access subject is allowed to access all of a plurality of services provided by a specific service (all access to a specific service is permitted) , The access level of the access right level is allowed to access only the remaining service functions except for the service function related to the information deletion / modification among the plurality of services provided by the specific service, and the access level of the access level is provided to the specific service Only access to service functions related to information information retrieval / retrieval among a plurality of services can be permitted.

In this case, the virtual network security device 300 transmits to the virtual network access device 300 a connection necessary for access to a specific service function that allows the access subject authorized for the specific service to access the level of the access right granted to the access subject among the plurality of service functions Provide information only.

The virtual network security apparatus 300 refers to the terminal 10 of the user as the accessing entity and only when the virtual network security apparatus 300 performs the general authentication procedure for the terminal 10 attempting to access the specific service, (S140), only the access information necessary for connection to the specific service function that allows access to the level of the access right granted to the user 10 is permitted.

For example, if the terminal 10 is at the middle access level, the virtual network security apparatus 300 may perform the authentication process for the terminal 10, It is possible to provide only the access information necessary for connection to a specific service function (access to service functions other than the service function related to information deletion / modification) allowing access to the middle level of authority.

In this case, in the case of the security control technique (technique) proposed by the present invention, visibility is provided in such a manner that the access subject is provided with the minimum access information required only at the time of authentication, so that the visibility of the network element is not opened to the non- .

When providing the access information to the terminal 10, the virtual network security device 300 sets a data path of a specific service function among the segments of the virtual network configured for the specific service, that is, the core computing node 200 ' Only the dynamic security function implemented in the segment is controlled so that access from the terminal 10 is permitted (S150).

For example, in the dynamic security function 240 implemented for each segment, the virtual network security apparatus 300 may include a service function (information function related to information deletion / modification) that permits access to the middle level of the access authority granted to the terminal 10 Only the security setting of the dynamic security function implemented in the segment for setting the data path of the service function (the remaining service functions except for the service function) is opened, and the access from the terminal 10 is allowed by opening the pin hole.

In this case, in the case of the security control technology (technique) proposed in the present invention, dynamic control is performed for each segment of a virtual network dynamically configured based on a tenant policy according to a network slicing technique, Under the network isolation structure (model) that implements the security function, the dynamic security function of each segment is individually controlled based on the tenant policy. By applying individual security to each segment, the accessibility to the network element can be applied to the unspecified subject You can provide limited accessibility without opening.

In particular, each segment of a virtual network that is dynamically configured according to the network slicing technique can be dynamically changed in characteristics. In the present invention, a dynamic security function is implemented for each segment, so that it can flexibly cope with such a segment change situation.

As described above, according to the present invention, unlike an existing general network security method that opens up visibility and accessibility to a network element, dynamic security that is based on a specific deny setting for each segment of a virtual network Based on the network isolation structure (model) that implements the function, it is possible to create a new virtual network environment that minimizes the exposure while minimizing the exposure while allowing flexibility in response to the characteristic of the virtual network environment, that is, each segment can be dynamically changed without opening the visibility and accessibility. Security control technology is realized.

Accordingly, the present invention provides a security vulnerability that may cause a denial of service attack on an application access port, a risk of losing control of a server due to a credential theft, connection hijacking, and APT / lateral movement exposure Thereby improving the security.

The virtual network security method according to an exemplary embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

According to the virtual network security apparatus and the virtual network security method of the present invention, it is possible to improve the security vulnerability and enhance the security by considering the characteristics of the virtual network environment that is dynamically configured / changed using the common network infrastructure on the network It is not only the use of the related technology but also the possibility of commercialization or operation of the applied device as well as the possibility of being practically possible, .

10: Terminal
100: Edge Computing Node
200: Core Computing Node
300: Virtual network security device

Claims (9)

A network configuration controller configured to configure a virtual network for the specific service using network resources selected on the network based on a tenants policy defined in the specific service; And
And a network security controller for controlling a dynamic security function implemented for each segment of the virtual network on the basis of the tenant policy and applying individual security for each specific segment of the virtual network to the specific service Virtual network security device. The method according to claim 1,
The virtual network includes:
A core computing node providing a cloud service for the specific service; and an edge computing node distributing the cloud service to the core computing node. The method according to claim 1,
The dynamic security function includes:
Wherein all accesses are blocked based on a specific security setting (All deny setting), and access is permitted only to a specific access according to the control of the network security control unit. The method according to claim 1,
The network security control unit,
Providing access information required for connection to the specific service to an access subject authorized for the specific service,
Wherein the control unit controls the dynamic security function implemented for each segment of the virtual network configured for the specific service to permit access to the access from the access subject. The method according to claim 1,
The tenant policy includes:
A data path between each segment is set for each of a plurality of service functions provided by the specific service to configure a virtual network,
Wherein the access control unit permits access to each of the plurality of service functions differently according to the level of access authority given to the access subject. 6. The method of claim 5,
The network security control unit,
Providing only the access information required for access to the specific service function that allows the access subject authorized for the specific service to access the level of the access right granted to the access subject among the plurality of service functions,
Wherein only the dynamic security function implemented in the segment for setting the data path of the specific service function among the segments of the virtual network configured for the specific service is controlled to permit access to the access from the access subject Virtual network security device. A network configuration step of configuring a virtual network for the specific service using network resources selected on the network based on a tenants policy defined in the specific service; And
And controlling a dynamic security function implemented for each segment of the virtual network based on the tenant policy so that individual security can be applied to the specific service in units of segments of the virtual network. How to secure a virtual network. 8. The method of claim 7,
The dynamic security function includes:
Wherein all accesses are blocked based on an all deny setting, and access is permitted only to a specific access according to the control in the network security control step. 8. The method of claim 7,
The network security control step includes:
Providing access information required for connection to the specific service to an access subject authorized for the specific service,
Wherein the control unit controls the dynamic security function implemented for each segment of the virtual network configured for the specific service to allow access from the accessing entity.

Images