KR20190067046A - A security orchestration system - Google Patents

Abstract

According to one embodiment of the present invention, provided is a security orchestration system, which comprises: a tower, which is a logical entity managing the entire infrastructure; guard posts providing security for a plurality of boxes apart from the tower; a keeper connected to the guard posts and tower, and provided with instructions from the guard posts to provide security for the box; and a third party security manager managing only security of the infrastructure by using the guard posts and the keeper.

Description

A security orchestration system {

The present invention relates to a security orchestration system. Specifically, the present invention relates to a layered security orchestration system.

An orchestration is a technology that continuously improves the entire IT infrastructure / service by automating the cycle of "monitoring - data operation - provisioning" according to the policy or profile defined by the infrastructure / service operator.

As the cloud becomes the core technology of the IT infrastructure, the scale of the IT infrastructure is becoming huge / complicated. Orchestration technology, which uses resources more reliably and efficiently by linking monitoring and provisioning procedures by using IT infrastructure as a software tool as day by day becomes more important.

In the case of the existing orchestration technology, a single tower and a plurality of server agents are constituted, and there is a limitation in the scalability. Each agent runs directly on the host operating system of the server, and thus tends to rely heavily on the security / stability of the host operating system. Also, we did not consider the security of the management object by emphasizing only the security of the service resources.

In addition to user authentication for server-user connection, it is also necessary to secure the access point of the server. Therefore, it can be applied equally to the expansion of the IT infrastructure without change and can guarantee security from the manager / server / You need a secure orchestration technique.

It is an object of the present invention to provide a security orchestration system which is improved in economy and flexibility through a security cell independent of the service environment and a keeper disposed in the security cell.

It is another object of the present invention to provide a safe box access control method for blocking infection in a service environment through an authenticated docking point from a non-modifiable hardware chip.

The security orchestration system according to an embodiment of the present invention is connected to a monitoring station, a monitoring station, and a tower that provide security for a plurality of boxes separately from a tower and a tower, which are logical entities that manage the entire infrastructure A keeper for receiving an instruction from the monitoring station and providing security for the box, and a third party security manager for managing only the security of the infrastructure using the monitoring station and the keeper.

The present invention can be improved economically and flexibly through a keeper which is placed in a security cell independent of the service environment and in a security cell.

In addition, the present invention is capable of safe box access control by blocking infection in a service environment through an authenticated docking point from a non-modifiable hardware chip.

1 is a block diagram illustrating the overall concept of a cluster orchestration according to an embodiment of the present invention.
2 shows a multi-layer orchestration structure according to an embodiment of the present invention.
Figure 3 shows the security cell and keeper building steps.

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. It should be understood, however, that there is no intention to limit the invention to the embodiments described below, and that those skilled in the art, upon reading and understanding the spirit of the invention, It is to be understood that this is also included within the scope of the present invention.

The accompanying drawings are merely exemplary and are not to be construed as limiting the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Further, even if specific parts such as installation positions are different, the same names are given when the functions are the same, so that the convenience of understanding can be improved. When there are a plurality of identical configurations, only one configuration will be described, and the same description will be applied to the other configurations, and a description thereof will be omitted.

Before describing the present invention, the main background art relating to the present invention will be described.

IO Visor: A formal project for the Linux Foundation that utilizes the enhance Berkeley packet filter (eBPF) to dynamically insert and execute code that processes box I / O events during Linux execution. Mainly targeting networking, tracing (monitoring) and security

Landlock: A sandbox security technology that enforces the system call that a specific application can call using the Linux kernel's eBPF feature.

Multi-core Hypervisors: Unlike virtualization, containers do not "share" hardware in a box (CPU core, network port, etc.) to multiple virtual machines, but rather create two or more isolated environments within a box and "allocate" Way

Block Chain: A security technique that records all transactions on a public record book and publicly verifies this issue from a number of nodes in the block chain system to prevent counterfeiting and denial of transactions

1 is a block diagram illustrating the overall concept of a cluster orchestration according to an embodiment of the present invention.

The configuration of a cluster orchestration system according to an embodiment of the present invention will be described in turn.

Tower (1) is a logical entity that manages the entire infrastructure centrally. Tower (1) is composed of Provisioning (P) / Orchestration (O) / Visibility (V) / Intelligence (I) / Security (S) centers and utilizes the functions provided by each center to manage and manage the infrastructure do.

As a result, a plurality of centers are connected to each other as a tower 1, and all of the center boxes may be gathered in a specific place (physical tower), and the centers in the distributed box may be logically clustered (logical tower) . Generally, an element providing a single or multiple functions (P / O / V / I / S) is referred to as a center, but the tower 1 in the present invention is a physical / It can be defined as the concept of the obsession of the center in the general sense.

The monitoring post (Post, 2) is an entity that provides security for a large number of boxes, apart from the infrastructure operation / management entity. The tower (1) is constructed and managed by the entity that operates the infrastructure directly, and the monitoring station (2) is constructed and managed by the third party providing the security solution.

Here, the third company is a third party independent of the operational entity of the infrastructure, securing a separate security cell (6) in each box (4), and distributing the keeper (3) . And the third party utilizes the security monitoring and provisioning provided by the keeper 3 to provide the security of the box 4. [

The monitoring station 2 has a cooperation / check relationship with the tower 1 and provides monitoring information collected through the keeper 3 to the tower 1 and at the same time not only the box 4 but also the tower 1 ) In real time.

The monitoring station 2 reports the infection to the security center when the infection of the box 4 is infected and blocks the interaction between the box 4 and the tower 1 via the keeper 3 upon infection of the tower 1, Connect to tower. In this process, the monitoring station 2 may serve as a temporary tower until it is connected to another tower.

Similar to the monitoring point 2 described in the present invention, there is a security operation center provided by a conventional security company. This is a function of updating the solution installed directly in each box, anti-virus solution, Is limited. However, in addition to this passive function, the monitoring station 2 proposed in the present invention is constructed in such a manner that the security cell 6 is built in the remote box 4, and the keeper 3 is simultaneously orchestrated Management. In addition, since the monitoring station 2 of the present invention plays a role of collaborating / checking with the central tower 1, it can be seen that the existing security center is greatly expanded.

The keeper 3 is an entity that directly performs monitoring / provisioning to provide security of the service cell 5. [ The keeper 3 is located in the security cell 6 which is an independent space securely secured in the box and performs monitoring / provisioning for orchestration of the box through interaction with the upper tower 1 / monitoring station 2 .

The keeper 3 is connected to the tower 1 and the monitoring station 2 at the same time, and basically receives an instruction of the monitoring station. The keeper 3 of the present invention is similar to a commonly used agent (acting as a management / operation function in a box) or a security module (monitoring a box or setting a security function) Provides a third party security function that safely protects the box 4 in the security cell 6, which is a space independent of the box in which the service is executed.

The box 4 is a device (for example, an IT device including a server and a switch) in which an external user 9 provides resources for executing an application. The box (4) is the application target of the security technology proposed in the present invention.

The box 4 divides part of the internal resources (for example, CPU, Memory, NIC, peripheral) into independent security cells 6 for the keeper 3. Thereby, the service cell 5 and the security cell 6 are located together in the box 4, and the service cell 5 and the security cell 6 are physically separated.

The infrastructure operator 7 manages a multi-site infrastructure composed of a plurality of boxes and clusters. The infrastructure operator 7 provides infrastructure resources for executing / operating the application (or service) developed by the user 9. Infrastructure Operator (9) operates the infrastructure on an automated basis through towers equipped with various software tools for efficient operation of multi-site infrastructure. The infrastructure operator 9 interacts directly with the tower 1 only.

The third-party security manager 8 manages only the security aspects of the infrastructure separately from the infrastructure operator 7. The provisioning authority for the monitoring station 2 and the box 4 of the keeper 3 is limited to a specific range / command necessary for security and there is no provisioning authority affecting other service environments. On the other hand, the third-party security manager performs provisioning / monitoring on the security side with respect to the box 4 using the monitoring station 2 and the keeper 3, and provides the collected monitoring information to the infrastructure operator 7 do.

The user 9 is a subject who wants to use the infrastructure resources. The user 9 interacts with the operator when the resource is allocated, and directly uses the box resource via the docking point 10 after resource allocation.

Third party security (3 ^rd -party security) monitors and / or provisiones objects outside the managed object (box) through a neutral third party (monitoring station, keeper) different from the tower (1) It is a technique that provides sex.

At this time, the keeper 3 manages a single box, the monitoring station 2 manages a single cluster, which is a set of a plurality of boxes, and the tower 1 manages the entire infrastructure, which is a collection of clusters. The control network between the keeper 3, the supervisory base 2 and the tower 1 are all connected by secure networking. The keeper 3 monitors the service cell 5, the monitoring station 2 monitors the security status of the monitoring station 2 and the tower 1 monitors the security status of the monitoring station 2. [ The tower (1) monitoring station (2) performs mutual cooperation / check simultaneously, so that when the tower (1) or the monitoring station (2) is attacked / infected, Or recovery is possible.

When the third party security technology proposed in the present invention is applied, it can quickly detect and automatically cope with any element such as a box, a keeper, a monitoring station, or a tower as in the embodiment described below.

In one embodiment, when the service cell 5 is infected, the keeper 3 prevents the infection of the service cell 5 and sends an alarm to the monitoring station 2. The monitoring station 2 transmits an alarm to the security center of the tower 1 so that the operator 7 can find it.

In another embodiment, when the keeper 3 is infected, it detects that the watchdog 2 has been infected with the keeper 3 and sends an alarm to the security center of the tower 1. The tower 1 removes the security cell including the keeper 3, builds a new security cell again, and redistributes the keeper 3 via the monitoring base 2.

In another embodiment, when the surveillance station 2 is infected, the security center of the tower 1 detects whether the surveillance station 2 has been infected and sends it to the operator 7 and the third security manager 8 And connects the keeper (3) connected to the infected monitoring station (2) to another monitoring station (2) after the alarm.

In another embodiment, when the tower 1 is infected, the watchdog 2 detects whether the tower 1 is infected and sends it to the operator 7 via the keeper 3 via the keeper 3, And the tower (1).

The docking point 10 is an access path concept for the user 9 to utilize the resources of the box 4. [ The docking point 10 described in the present invention is not limited to simple remote access authentication / encryption but includes authentication, access, user / service rights control, and third party based docking point monitoring / provisioning techniques for docking point 10 . A keeper 3 located in a security cell independent of the service cell, which is an environment where the docking point 10 is located, manages the docking point 10.

The docking point-based box access control method according to an embodiment of the present invention uses remote access authentication / encryption. The remote access authentication / encryption is a technique of confirming that the user 9 who wants to access the box is a legitimate user and encrypting the data transmission with the authenticated user. In general, SSH / PKI and the like are widely used for remote access authentication / encryption, but the docking point itself is not limited to a specific technology.

In addition, the docking point-based box access control method according to an embodiment of the present invention uses an authorized docking point from the hardware chip 11. Based on a non-modifiable hardware chip, the firmware -> boot loader -> extends the chain of trust technology that sequentially authenticates the OS to the docking point. The chain of trust technology referred to herein is a widely used technique for secure OS booting, in that the keeper 3 can detect the modulation of the docking point through the chain of trust when assigning the docking point and does not assign the modulated docking point. Therefore, the hardware chip 11 assures the safety of the docking point itself, which is the connection point.

In addition, the docking point-based box access control method according to an embodiment of the present invention controls resource access authority for each docking point. The docking point 10 allows the user or application to access the resources of the box. At this time, a sandbox security technology (for example, Landlock) technology is applied to restrict the calls that the application can call, and is used for each docking point.

Sandbox security technology is a technology that limits the scope of system calls that an application running on a (Linux) operating system can call. A system call is a function that an application calls to use the functions of the operating system kernel. The term "system call restriction" refers to the hardware (CPU, RAM, network interface card, etc.) This means that we can strongly restrict access to However, the sandbox security technology is applied to an application unit, but the present invention differs from the present invention in that the application is changed to a unit of "user connected through a docking point".

Conventional external access technologies have focused only on authenticating trusted users and providing secure communications, and once authenticated users could not limit their operations within the box. As a result, in the past, hacking or attack was possible inside the box only if authentication passes.

On the other hand, in the case of the present invention, the administrator / security administrator can more strictly restrict the user's behavior through the sandbox security technology. More specifically, not only the trusted user selectively connects, Can be limited.

In addition, the security mechanism can be avoided by forging, modulating, or arbitrarily generating the docking point itself. To prevent this, a chain authentication for stepwise authentication of the boot loader, the operating system, and the docking point is applied from the non-modifiable hardware chip.

In other words, the limitation of the system call is to limit the kernel level commands that can be executed in the box, which can control the effect of the strong control of the resource access authority, thus blocking the abnormal behavior of remote users and applications.

In addition, the docking point-based box access control method according to an embodiment of the present invention controls the docking point through the keeper. The user 9 requests the docking point 10 to the tower 1 / monitoring station 2 and the request is forwarded to the keeper 3. The keeper 3 automatically assigns the docking point 10 of the box managed by the keeper 3 to the user. The keeper 3 can collect security data including docking point assignment contents, docking point status information, and data transmitted and received through the docking point. In other words, the operator 7 and the third-party security manager 8 can confirm the security status of the security cell 6 remotely located via the keeper 3 in real time, and easily assign a docking point to a new user .

A docking point-based box access control method according to an embodiment of the present invention includes remote user authentication and communication encryption, source blocking of docking point and internal box modulation through a chain of trust, , And there is a technical effect to automate the provisioning / monitoring of the docking point through the keeper.

In addition, there are a number of security solutions composed of the existing security center-agent. In this case, since the agent is directly disposed and executed in the service execution environment, the stability of the agent can not be guaranteed when the service environment is infected. However, since the keeper proposed in the present invention operates in a security cell independent of the service cell, the stability of the security cell can be ensured even if the service environment is infected.

Firewall, IDS, and DPI solutions that provide off-box security usually require the purchase, acquisition, and installation of stand-alone dedicated equipment. However, in the case of the orchestration system limited by the present invention, since a portion of the box resource is dynamically allocated as an independent security cell and then the keeper is distributed, purchase of additional equipment is not required. Therefore, economics / flexibility can be greatly improved while maintaining the existing solution mechanism.

2 shows a multi-layer orchestration structure according to an embodiment of the present invention.

2, a multi-layer orchestration structure according to an embodiment of the present invention includes a tower 1, a monitoring station 2, and a keeper 3. Each control entity manages different objects, and each control subject is connected to perform mutual cooperation / check.

Figure 3 shows the security cell and keeper building steps.

As shown in Fig. 3, first, a connection between the monitoring station and the box is configured in accordance with the instruction of the tower. Secondly, a security cell is formed in the box, which is distinguished from the service cell through the monitoring station. Third, a keeper is deployed in the security cell.

The present invention described above can be embodied as computer-readable codes on a medium on which a program is recorded. The computer readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of the computer readable medium include a hard disk drive (HDD), a solid state disk (SSD), a silicon disk drive (SDD), a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, , And may also be implemented in the form of a carrier wave (e.g., transmission over the Internet).

Also, the computer may include a control unit of the terminal. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

Claims (8)

A logical object that manages the entire infrastructure;
A surveillance station providing security for the plurality of boxes separately from the tower;
A keeper connected to the surveillance tower and the tower for receiving security instructions from the surveillance tower to provide security for the box; And
And a third party security manager that manages only the security of the infrastructure using the monitoring station and the keeper
Security orchestration system. The method according to claim 1,
The box includes a security cell for providing security for a service cell and a box in which an application is executed,
The service cell and the secure cell are physically separated
Security orchestration system. 3. The method of claim 2,
The keeper may be located in the secure cell
Security orchestration system. The method according to claim 1,
The keeper monitors the security status of the service cell, the monitoring terminal monitors the security status of the keeper and the tower, and the tower monitors the security status of the monitoring terminal
Security orchestration system. The method according to claim 1,
Further comprising a docking point, the access path for the user to utilize the resources of the box
Security orchestration system. 6. The method of claim 5,
The docking point is sequentially authenticated from a non-modifiable hardware chip via a chain certificate
Security orchestration system. 6. The method of claim 5,
A sandbox security technique is used for each of the docking points,
Security orchestration system. 6. The method of claim 5,
The keeper may assign a docking point of the box upon request
Security orchestration system.

Images