KR20190110719A - Apparatus and method for concealing network - Google Patents

Abstract

A network concealment apparatus and method are disclosed. According to the present invention, the network concealment apparatus comprises: a network control unit including a network replication portion, an interface portion, and a database; and a virtual machine unit. Accordingly, a virtual network can be constructed even with a small number of virtual servers, thereby providing a highly efficient network concealment apparatus and method. In addition, the network concealment apparatus and method can provide a high-performance network concealment apparatus and method capable of effective defense against an attacker by making it difficult to access a network to an actual physical server by creating a large-scale virtual server.

Description

Network concealment device and method {APPARATUS AND METHOD FOR CONCEALING NETWORK}

The present invention relates to network concealment apparatus and method, and more particularly, to a network concealment apparatus and method based on software defined network.

Recently, with the development of network technology, cases of hacking damage such as personal information leakage and large system failure are increasing rapidly.

The conventional communication network model is provided in such a way that the server responds to the client's request when the client knows and approaches the server's address. For example, in the communication model between a web server and a web client in an Internet Protocol (IP) network, a HyperText Transfer Protocol (HTTP) request message is obtained from an address obtained after the web client obtains the IP address of the web server. After sending, the user enters the IP address of the web server directly through the UI of the web client or converts it to IP using the domain name. Then, the client obtains the IP address and then accesses the server.

Accordingly, in the conventional communication network model, since the address of the server is exposed to the client, the probability of hacking damage such as Distributed Denial of Service (DDoS) may be increased, and changing the address to avoid the attack may also change the address to the client. It is difficult to guarantee the continuity of services because it must be informed.

Recently, he has been researching a technology to prevent hacking attacks by attackers using Software Defined Network (SDN).

Software Defined Network (SDN) separates the control plane and data plane of network equipment such as switches and routers as infrastructure, so that the data plane persists in the hardware of the network equipment. The control plane refers to a network structure provided in the form of software in the SDN controller.

A network concealment method using an infrastructure of a software defined network (SDN) includes a technique of allocating a virtual server.

However, the conventional network concealment method requires an expensive construction cost by implementing a virtual network corresponding to the actual network to be concealed as a virtual server.

In addition, these virtual network servers are required to provide a variety of services, such as Web services, File Transfer Protocol (FTP) services, Secure Shell (SSH) services in order to attract the attacker, expensive maintenance costs are required.

An object of the present invention for solving the above problems is to provide a low cost and high efficiency network concealment device.

An object of the present invention for solving the above problems is to provide a low cost and high efficiency network concealment method.

In accordance with an embodiment of the present invention for achieving the above object, in conjunction with a software defined network (SDN) including an SDN control unit for managing the real network environment, provides a virtual network environment corresponding to the real network environment The network concealment apparatus may be configured to generate at least one virtual server at the request of the network controller and the network controller for generating at least one false IP address for connection with the virtual server, and interwork with the IP address of the virtual server. And a virtual machine for transmitting mapping information for allocating at least one false IP address to the SDN controller.

In accordance with an embodiment of the present invention for achieving the above object, in conjunction with a software defined network (SDN) including an SDN control unit for managing the real network environment, provides a virtual network environment corresponding to the real network environment A network hiding method using a network hiding device may include: setting mapping information of the network hiding device, receiving at least one packet data having a false IP address, setting a moving path of the packet data, and Transmitting packet data to the moving path, changing a destination address to the virtual server IP address corresponding to the false IP address based on the mapping information, and transmitting the packet data to the changed virtual server; Including, but the method of setting the mapping information is physical four Receiving walk information, generating the false IP address, generating the virtual server, assigning the false IP address to the virtual server, generating the mapping information, and generating the generated mapping information. Transmitting to the SDN switch.

The apparatus and method for concealing a network according to an embodiment of the present invention creates a large-scale virtual network environment by creating a false IP address and a virtual server by a network replicating unit and a virtual machine unit, thereby reducing the probability of accessing the actual network, thereby improving security. An improved high performance network concealment device can be provided.

In addition, the network concealment apparatus and method can provide a low-cost network concealment apparatus by establishing a virtual network environment with only a few virtual servers (PM) by the virtual machine unit.

1 is a block diagram of a network concealment apparatus according to an embodiment of the present invention.
2 is a conceptual diagram illustrating a method of allocating a false IP address to a virtual server according to an embodiment of the present invention.
3 is a flowchart of a network concealment method according to an embodiment of the present invention.
4 is a flowchart illustrating a step of setting mapping information in a network concealment method according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the drawings, similar reference numerals are used for similar elements.

Terms such as first, second, A, and B may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term “and / or” includes any combination of a plurality of related items or any of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

In the specification of the present invention, a packet may mean data divided into appropriate sizes for data transmission, and traffic may mean an amount of data flowing within a certain time on a specific transmission. In addition, the topology may refer to a form of long-term access to a local area network (LAN), and the protocol may refer to communication rules and appointments for smoothly exchanging information between computers. .

Transmission Control Protocol (TCP) can be used in applications that require reliability by transmitting data after confirming that the connection between the sender and the receiver of the communication has been established. User Datagram Protocol (UDP) is used for the sender and receiver. It can be used in applications that require high speed by sending data unilaterally without checking the connection. The port number may mean a virtual logical communication connection that is used for communication between applications in TCP or UDP. Communication on the Internet may be performed using a port number, which may be used by a corresponding protocol with an IP address, and may range from 0 to 65535.

Software Defined Networks (SDN) is a next-generation networking technology that makes it easy to handle network routing, control, and complex operational management through software programming, which can mean the technology that allows users to control the network with software. SDN is a structure in which a network control function is separated from a physical network, and may be divided into a physical infrastructure layer, a controllable control layer, and an application layer. In other words, the network control function may be separated from hardware such as a conventional switch or router, and may also be separated from the data transfer function.

OpenFlow is an element of SDN and may refer to an open standard interface for communication between a control device and a networking switch. OpenFlow is a programmable application that supports some kind of SDN, allowing you to directly connect to and operate external software, such as controllers, and network equipment such as switches and routers. The controller is located in the control layer of the SDN and transmits a flow table to switches and routers to control traffic on the network. Here, the flow table includes a rule that defines which packet to process, a rule that defines how to process the packet defined by the rule, an action and how many packets are matched in the flow table. It can include stats, an area that shows how big bytes have been sent. In the specification of the present invention, a flow table may be described using the term flow rule. In addition, when the flow table refers to information that the switch and the router have, the open flow controller may install the flow rule on the switch, the router, or the like so that the flow rule may be applied to the flow table.

In-depth packet analysis is a technique used to analyze and authenticate the protocols and applications of packets transmitted or exchanged through an Internet Protocol (IP) network in real time. It examines the payload of the packet as well as the packet header. It may refer to a technology that can confirm the data information of the. In-depth packet analysis may be performed by directly connecting to a network link in hardware form, or may be performed as an application program in software form.

Hereinafter, with reference to the accompanying drawings, it will be described in detail a preferred embodiment of the present invention. In the following description of the present invention, the same reference numerals are used for the same elements in the drawings and redundant descriptions of the same elements will be omitted.

1 is a block diagram of a network concealment apparatus according to an embodiment of the present invention.

Referring to FIG. 1, the network concealment apparatus D may interwork with a software-defined network (SDN) system. Accordingly, the network concealment apparatus D may provide a virtual network environment corresponding to the actual network environment.

According to an embodiment, the network hiding apparatus D may interwork with at least one SDN switch S through the SDN controller C of the software defined network SDN. Accordingly, the network hiding apparatus D may provide the SDN switch S with the IP address FM of the virtual server corresponding to the false IP address FM and the fake IP address FM.

In more detail, the network concealment apparatus D may include a network controller 1000 and a virtual machine 5000.

The network controller 1000 may include a network replication unit 1100, an interface unit 1300, and a database 1500.

The network replicating unit 1100 may generate at least one false IP address FM. In this case, the false IP address FM may be an IP address of a server without an entity. According to an embodiment, the network replicating unit 1100 may generate a false IP address FM of the largest size that can be generated. Thereafter, the network replication unit 1100 may store the generated at least one random IP in the database 1500 to be described later. The database 1500 will be described in more detail below.

In addition, the network replication unit 1100 may request the generation of the virtual server PM to the virtual machine 5000 to be described later through the interface unit 1300 to be described later. At this time, the virtual server (PM) may be a server that duplicates the information of the physical server (not shown) existing in the real network of the software-defined network (SDN). The virtual server PM will be described in more detail in the interface unit 1300.

The network replication unit 1100 may generate mapping information after the virtual server generation of the virtual machine 5000 is completed. In this case, the mapping information may be table information including IP address information of the virtual server corresponding to the at least one false IP address FM.

The network concealment apparatus according to the embodiment of the present invention creates a large-scale virtual network environment by creating and mapping a false IP address (FM) and a virtual server, thereby protecting the actual network from attackers who have accessed for hacking purposes. An improved high performance network concealment device can be provided.

The interface unit 1300 may include a first interface 1310 and a second interface 1350.

The first interface 1310 may interwork with the network replication unit 1100 and the SDN control unit C. Accordingly, the first interface 1310 may transmit and receive at least one data between the components 1100 and C.

According to an embodiment, the first interface 1310 may transmit and receive physical network information. In this case, the physical network information I ₁ may be information requested from the network replication unit 1100 to the SDN controller C. Accordingly, the SDN controller C may transmit the requested at least one physical network information I ₁ to the network replicator 1100.

As described above, the physical network information I ₁ may be information of a physical server (not shown) in a real network based on a software defined network (SDN). The physical network information I ₁ may be utilized when generating the virtual server PM of the virtual machine 5000 to be described later.

According to another embodiment, the first interface 1310 may transmit mapping information I ₂ generated from the network replicating unit 1100 to the SDN switch S. FIG. In more detail, the first interface 1310 may transmit mapping information I ₂ generated from the network replication unit 1100 to the SDN controller C. Thereafter, the SDN controller C may transmit the transmitted mapping information I ₂ to the SDN switch S. FIG. In this case, the mapping information I ₂ may be virtual server IP address information corresponding to the false IP address FM. Therefore, when the traffic received from the outside has a false IP address (FM) as a destination address, the SDN switch (S) switches the destination address of the traffic to the corresponding false IP address (FM) based on the mapping information (I ₂ ). You can translate to the corresponding virtual server IP address.

The second interface 1350 may interwork with the network replication unit 1100 and the virtual machine 5000. Accordingly, the second interface 1350 may transmit and receive at least one data between the components 1100 and 5000.

According to an embodiment, the second interface 1350 may transfer the virtual server creation request message M ₁ transmitted from the network replicating unit 1100 to the virtual machine 5000 to be described later. Accordingly, the virtual machine 5000 to be described below may generate at least one virtual server PM.

According to another embodiment, the second interface 1350 may transmit a plurality of false IP address FM information I ₃ generated from the network replicator 1100 to the virtual machine 5000 to be described later. Accordingly, the virtual machine 5000 to be described later may allocate the plurality of received false IP address FM information I ₃ to the generated at least one virtual server PM.

As described above, the database 1500 may store a plurality of false IP addresses FM generated from the network replicating unit 1100. According to an embodiment, the database 1500 may be provided as a topology database. Accordingly, the database 1500 may reflect the false IP address FM in the virtual network to which at least one node is connected.

The virtual machine 5000 may generate at least one virtual server PM. As described above, the virtual machine 5000 may be generated by the request M ₁ of the network replicator 1100.

Thereafter, the virtual machine 5000 may allocate at least one false IP address FM received by the second interface 1350 to at least one virtual server PM. A method of allocating a false IP address (FM) of the virtual machine 5000 will be described in more detail with reference to FIG. 2.

2 is a conceptual diagram illustrating a method of allocating a false IP address (FM) to a virtual server according to an embodiment of the present invention.

Referring to FIG. 2, the virtual machine 5000 may generate at least one virtual server PM. According to an embodiment, the virtual machine 5000 may include a first virtual server PM ₀ and a second virtual server PM ₁ .

Thereafter, the virtual machine 5000 receives the plurality of false IP addresses FMs FM ₀ , FM ₁ ,... FM _M received from the second interface 1350 and the first and second virtual servers PM _0. , PM ₁ ).

In this case, a plurality of false IP addresses FM may be allocated to each virtual server PM. For example, the first virtual server PM ₀ may be assigned first false IP addresses FM ₀ and FM ₁ , and the second virtual server PM ₁ may be assigned a second false IP address (PM ₀ ). FMs FM ₂ , FM _3, ... FM _M may be assigned.

Therefore, the network concealment apparatus D according to the embodiment of the present invention can provide a virtual network concealment apparatus at low cost by being able to construct a virtual network with only a few virtual servers PM.

The configuration of the network concealment apparatus according to the embodiment of the present invention has been described above. Hereinafter, a network concealment method using the network concealment apparatus according to an embodiment of the present invention will be described.

3 is a flowchart of a network concealment method according to an embodiment of the present invention.

Referring to FIG. 3, the network concealment apparatus according to the embodiment of the present invention may generate mapping information (S1000). Here, the network concealment device may be a device for providing a virtual network environment in association with a software defined network (SDN).

The mapping information may include virtual server IP address information corresponding to the false IP address FM.

Generating mapping information of the network concealment apparatus will be described in more detail with reference to FIG. 4.

4 is a flowchart illustrating a step of setting mapping information in a network concealment method according to an embodiment of the present invention.

Referring to FIG. 4, the network concealment apparatus D according to an embodiment of the present invention may receive at least one physical network information from the SDN controller C (S1100). In this case, the physical network information may be information of at least one real server (not shown) provided on the real network.

Thereafter, a false IP address FM in the network concealment device D according to an embodiment of the present invention may be generated (S1200). According to an embodiment, the network replicating unit 1100 may generate at least one false IP address FM.

The generated false IP address FM may be stored in the database 1500. Here, the database 1500 may be a topology database. Accordingly, the database 1500 may reflect the false IP address FM in the virtual network to which at least one node is connected.

Thereafter, the network concealment apparatus D may generate a virtual server PM (S1300). According to an embodiment, at least one virtual server PM may be generated at the request of the network replicating unit 1100.

The network hiding apparatus D may allocate at least one false IP address FM to at least one virtual server PM (S1400). According to an embodiment, the network concealment apparatus may assign a plurality of false IP addresses FM to an individual virtual server PM. Accordingly, the network concealment apparatus can establish a virtual network even with a small number of virtual servers (PM).

The network concealment apparatus D may generate mapping information by mapping false IP address (FM) information for each allocated virtual server PM. In other words, the mapping information may be table information including at least one false IP address FM and IP address information of the virtual server PM.

The network concealment apparatus may transmit the generated mapping information to the SDN controller C in the software defined network (SDN) (S1500).

The SDN controller C may set a path of the virtual server PM for each SDN switch S based on the received mapping information (S1600). Thereafter, the received mapping information may be transmitted to the SDN switch S. FIG.

Referring back to FIG. 3, after mapping information of the network concealment device D is set, traffic may flow into the first SDN switch S ₁ by a scanning attack of an attacker (S2000). In this case, the traffic may have a false IP address (FM) as a destination address.

The first SDN switch S ₁ may transmit a transmission completion message of packet data in traffic to the SDN controller C (S3000).

The SDN controller C may set a movement path of the packet data based on the mapping information (S4000). In more detail, according to an embodiment, the SDN controller C may perform a virtual server PM corresponding to the fake IP address FM on mapping information based on the false IP address FM of the received packet data. Information can be extracted. Subsequently, the second SDN switch S ₂ connected to the extracted virtual server PM may be extracted, and a packet data movement path may be set between the first SDN switch S ₁ and the second SDN switch S ₂ . have.

Thereafter, the first SDN switch S ₁ may transmit the packet data in the incoming traffic to the movement path set by the SDN controller C (S5000). More specifically, the first SDN switch S ₁ is a second SDN connected to the virtual server PM corresponding to the false IP address FM with packet data having a false IP address FM as a destination address. It can be sent to the switch (S _2).

The packet data transmitted to the second SDN switch S ₂ may change the false IP address FM into an IP address of the virtual server PM. Thereafter, the transmission may be transmitted to the virtual server PM connected to the second SDN switch S ₂ (S6000).

In the above, the network concealment apparatus and method according to an embodiment of the present invention have been described. The network hiding apparatus and method includes a network controller and a virtual machine including a network replication unit, an interface unit, and a storage unit, thereby enabling a virtual network to be constructed with a small number of virtual servers, thereby reducing the cost of a highly efficient network hiding apparatus. It may provide a method.

In addition, the network concealment apparatus and method may provide a high performance network concealment apparatus and method capable of effectively defending from an attacker by making network access to a physical server difficult by creating a large-scale virtual server.

The operation of the method according to an embodiment of the present invention can be embodied as a computer readable program or code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable program or code is stored and executed in a distributed fashion.

In addition, the computer-readable recording medium may include a hardware device specifically configured to store and execute program instructions, such as a ROM, a RAM, a flash memory, and the like. Program instructions may include high-level language code that can be executed by a computer using an interpreter, as well as machine code such as produced by a compiler.

While some aspects of the invention have been described in the context of a device, it may also represent a description according to a corresponding method, wherein the block or device corresponds to a method step or a feature of the method step. Similarly, aspects described in the context of a method may also be indicated by the features of the corresponding block or item or corresponding device. Some or all of the method steps may be performed by (or using) a hardware device such as, for example, a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, one or more of the most important method steps may be performed by such an apparatus.

In embodiments, a programmable logic device (eg, a field programmable gate array) may be used to perform some or all of the functionality of the methods described herein. In embodiments, the field programmable gate array may operate in conjunction with a microprocessor to perform one of the methods described herein. In general, the methods are preferably performed by any hardware apparatus.

Although it has been described above with reference to the preferred embodiment of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the invention described in the claims below. It will be appreciated.

1000: network control unit 1100: network replication unit
1300: interface unit 1310: first interface
1350: second interface 1500: database
5000: virtual machine C: SDN control unit
D: Network stash device S: SDN switch

Claims (1)

In the network concealment apparatus that provides a virtual network environment corresponding to the actual network environment by interworking with a software defined network (SDN) including an SDN control unit for managing the actual network environment,
A network controller configured to generate at least one false IP address for connecting to the virtual server; And
A virtual machine unit configured to generate at least one virtual server at the request of the network controller and to transmit mapping information for allocating at least one false IP address interworking with the IP address of the virtual server to the SDN controller; Network concealment device.

Images