KR20200116773A - Cyber inspection system - Google Patents

Abstract

According to the present invention, an inspection system in a unit network is disclosed. The system comprises: a software defined network (SDN) switch which authenticates at least some of packets flowing into or out of the unit network and distributes traffic; a test station which discards harmful packets by checking whether the packets to be inspected are harmful packets among the traffic-distributed packets, and attaches suspicious tags to suspect packets; and an agent which receives a packet that has been inspected or traffic-distributed packets without inspection.

Description

SN-based inspection system {CYBER INSPECTION SYSTEM}

The present invention relates to a cyber inspection system using SDN (Software Defined Network) technology.

In recent years, numerous security solutions have been applied to the system to control packets in a situation where a large amount of information flows in and out of the saabor network. However, the following limitations exist to protect information using the conventional technology.

First, despite the existence of various information protection solutions, information infringement accidents continue to occur. This is because the complexity of security management for various information protection solutions has increased, and security technologies overlap and vulnerabilities exist at the same time. Since the conventional individual defense-oriented method cannot change the situation in which the attacker is in control, there is a limit to defending against cyber attacks.

In addition, in recent years, a new network environment such as SDN is being built in order to use the network efficiently, and the need for a security technology using SDN has been raised. However, even if the control method is applied, it is impossible to guarantee 100% perfect security, and cyber security technology that can comprehensively manage and protect the network and system characteristics by mutual analysis is required.

It is an object of the present invention to provide a cyber inspection system including software for operating a cyber system, an abnormal state/behavior detection algorithm, and an SQN switch extending the SDN switch.

In order to solve the above-described technical problem, the present invention provides a SDN (Sofrwore Defined Network) switch that authenticates at least some of packets flowing into or out of a unit network and distributes traffic, and an inspection target among traffic distributed packets. It is characterized in that the packet is inspected for harmful packets to discard the harmful packets, and the suspicious packets suspected of being harmful include an inspection station that attaches a suspicious tag and an agent that receives the inspected packets or packets distributed with traffic without inspection.

According to the present invention, there is an effect of overcoming current limitations and securing comprehensive management technology by improving security and improving management convenience through a new method in which security solutions for controlling packets are integrated.

1 is a block diagram schematically showing an SDN-based inspection system according to an embodiment of the present invention;
2 is a detailed block diagram showing in detail an SDN switch of an SDN-based inspection system according to an embodiment of the present invention;
3 is a detailed block diagram showing in detail an inspection station of an SDN-based inspection system according to an embodiment of the present invention;
4 is a flowchart specifically showing the operation of an agent in the SDN-based inspection system according to an embodiment of the present invention;
5 is a detailed block diagram showing in detail an agent manager of an SDN-based inspection system according to an embodiment of the present invention.

Hereinafter, other objects and features of the present invention in addition to the above objects will be clearly revealed through the description of the embodiments with reference to the accompanying drawings, and unless otherwise defined, all terms used herein including technical or scientific terms are It has the same meaning as commonly understood by one of ordinary skill in the art to which the invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

1 is a block diagram schematically showing a cyber inspection system using SDN according to an embodiment of the present invention. As shown in FIG. 1, the cyber inspection system according to an embodiment of the present invention may include an SDN switch 110, a inspection station 120, an agent 130, and an agent manager 140.

In the present specification, the inspection system consisting of the SDN switch 110, the inspection station 120, the agent 130 and the agent manager 140 may be allocated to one unit network, and the entire network includes a plurality of such unit networks. And can be configured collectively. One unit network may be a network unit used for security management of a specific company or a specific organization.

Referring to FIG. 1, the SDN switch 110 may include an SQN switch controller 112 and an SQN switch 114. The SQN switch controller 112 provides a control signal to the SQN switch 114 to control the SQN switch 114 to process packets flowing into or out of the unit network. In the specification, unless otherwise specified, an incoming packet will be described. It will be apparent to those of ordinary skill in the art that the same mechanism can be applied equally to outgoing packets.

The SQN switch controller 112 manages a network flow for traffic distribution of packets flowing into a corresponding unit network. That is, the incoming flow is identified and distributed so that it can be transmitted to the appropriate agent 114. The SQN switch controller 112 identifies whether the incoming packet is an inspection target and transmits it to the inspection station. The inspection target packet may mean a packet in which the state of the packet is unknown because inspection has not yet been performed in not only the current unit network but also another unit network. Once a packet is inspected through the inspection system, an authentication value is assigned to the packet, or the packet has been inspected through a key management protocol, and an identifier capable of identifying the packet may be attached.

Through this identifier, the SQN switch controller 112 identifies the packet to be inspected and transmits the packet to be inspected to the inspection station. In addition, by parsing the final destination of the packet, traffic classification and inspection traffic can be distributedly processed. The SQN switch 114 receives the instruction from the SQN switch controller 112 and transmits the packet to the inspection station 120 or to the agent 130.

The inspection station 120 may include a first inspection component 122 and a second inspection component 124. A detailed description of the first inspection component 122 and the second inspection component 124 is based on FIG. 3 below. The inspection station 120 may detect and discard harmful packets, attach tags to suspicious packets, and detect the safety of the inspection target packet, thereby supporting the establishment of network security. The inspection station 120 may receive a packet outflow from the agent 130 to another unit network and perform an inspection thereon so that it is outflowed to the outside through the SQN switch 114.

The agent 130 is a concept including a plurality of agent terminals 132-1 to 132-n and a virtually partitioned network (VPN), and may be a terminal that actually receives a packet. VPN allows a virtual partitioned network to be assigned to a terminal separately from the physical location of the terminal. That is, if a specific terminal cannot access the desired network due to a locational problem, it is possible to temporarily access the desired network using a VPN, and through this, the input/output port of the desired network belongs to the input/output port of the network at the current location. The network can be logically partitioned according to the needs of a plurality of terminals located in a physically partitioned network.

The agent 130 may include an electronic device equipped with a communication function such as a PC, a portable terminal, a smart phone, a notebook, and a smart TV. It can be assumed that the agent 130 is always clean, and a unit network composed of the clean agent terminals 132-1 to 132-n can also be assumed to be clean. Clean means that there are no terminals infected with harmful viruses, and the security status is also robust.

The agent manager 140 is a server device that manages an agent, and may receive an event signal generated by the agent, analyze the event, establish a policy for security management, and assign it to the agent 130.

2 is a detailed block diagram showing a detailed SDN switch of a cyber inspection system using SDN according to an embodiment of the present invention. Referring to FIG. 2, the SDN switch 210 may include an SQN switch controller 212 and a switch 214.

The SQN switch controller 212 controls the SQN switch 214 that distributes traffic according to the inflow and outflow of an actual packet. The SQN switch 214 may include a plurality of switches 216-1 to 216-n.

The SQN switch controller 212 enhances the security of harmful packets by assigning an authentication value to traffic or managing through a key. The SQN switch controller 212 may prevent external leakage by monitoring specific information (eg, information determined to be sensitive) by an administrator and prevent complex security management in advance. The specific information can be set through a user interface (not shown). The SQN switch controller 212 may individually manage the plurality of switches 216-1 to 216-n.

The SQN switch controller 212 identifies a packet to be inspected without an authentication value and transmits it to the inspection station 220. The inspection station 220 determines whether the packet to be inspected is harmful and discards the packet determined to be harmful, and attaches a suspicious tag to the packet suspected of being harmful. Accordingly, the normal packet is sent to the SQN switch 214 without a special tag. Can be provided. That is, the SQN switch controller 212 may control the switch 214 that has received the normal packet and the suspicious packet from the inspection station 220 so that the corresponding packet can be transmitted to the agent 230. By assigning an authentication value to a packet that has been inspected once, it is possible to induce the inspection of the same packet not to be repeated many times in a clean area.

The plurality of switches 216-1 to 216-n may be arranged in parallel to each individually process incoming packets. The plurality of switches 216-1 to 216-n may perform a basic switching function. The plurality of switches 216-1 to 216-n may classify a received packet into a flow, process the packet according to a rule defined in a flow table, and transmit the packet to a destination port. Here, the flow may refer to packets having a TCP connection, a specific MAC or IP address, and the same VPN (Virtual Private Network) value. The plurality of switches 216-1 to 216-n may be individually controlled by the SQN switch controller 212. At this time, if a failure occurs in one switch (e.g., 216-1), switch to another switch (e.g., 216-2) as quickly as possible, and then update the flow table to the port configuring the new route to prevent traffic delivery. Continuity can be guaranteed.

The plurality of switches 216-1 to 216-n may transmit a normal or suspicious packet received from the inspection station 220 to the agent 230 as a corresponding destination. In addition, the plurality of switches 216-1 to 216-n may transmit a packet that has undergone inspection authentication, that is, that has not passed through the inspection station 220, to the agent 230.

3 is a detailed block diagram showing in detail an inspection station of a cyber inspection system using SDN according to an embodiment of the present invention. As shown in FIG. 3, the inspection station 320 according to an embodiment of the present invention may include a first inspection component 322 and a second inspection component 324. The inspection station 320 may detect network-based attacks, infringements by service type, and malicious codes through traffic pattern analysis and normal state modeling.

Referring to FIG. 3, the inspection station 320 performs an inspection by receiving an unauthorized packet from the SDN switch 310 or a packet flowing out from the agent 330 to another unit network. According to the inspection result, the normal packet and the suspicious packet may be provided to the switch 310 and transmitted to another unit network or may be transmitted to the agent 330.

First, the first inspection component 322 may include a network-based attack detection unit 321, an infringement detection unit 323 for each service type, and a malicious code detection unit 325. The network-based attack detection unit 321 may detect attacks that threaten network security, such as transmission interference, eavesdropping, illegal alteration, and forgery. For example, Syn Flooding attack, SYN/FIN scan attack, IP spoofing attack, Kenini Mitnick attack, Switch Jamming attack, ARP Redirect attack, ICMP Redirect attack, Asychronous Attacks, etc. can be detected.

The infringement detection unit 323 for each service type may analyze a packet to be inspected to define an intrusion attack for each service type, detect an attack corresponding to the defined attack type, and respond to an attack for each type.

The malicious code detection unit 325 analyzes a packet to be inspected to detect whether it is a malicious code. To this, signature detection can be applied, and malicious codes such as zero-day attacks can be detected.

The second inspection component 324 is a component that dynamically detects an attack element included in a packet such as malicious code. The second inspection component 324 may determine whether the malicious code is included in the packet by directly executing the malicious code and examining the operation through the virtual environment. It may include an emulator or a virtualized environment to execute malicious code.

The first inspection component 322 and the second inspection component 324 discards the packet when attack and intrusion elements and malicious codes are clearly detected, and the packets in which the elements are suspected, that is, packets with unclear whether or not they are harmful. Can attach suspicious tags for warning. The suspicious tag may be attached to the header of the packet.

4 is a flowchart specifically showing the operation of an agent in a cyber inspection system using SDN according to an embodiment of the present invention.

Referring to FIG. 4, the agent may receive a packet from the SDN switch (S410). A packet received from the SDN switch to the agent may be a normal packet or a suspicious packet. Therefore, it is determined whether the corresponding packet is a suspicious packet (S420), in the case of a suspicious packet, a separate suspicious process can be operated (S430). The suspicious process is a process that regularly monitors all processes that the suspicious packet passes, and a set time This is a process that monitors whether a malicious code is generated or hacked in a process that is processed when a suspicious packet arrives at intervals. A detailed policy for setting the monitoring time interval and determining whether a specific malicious code or hacking is performed can be received from the agent manager, and is operated accordingly.

According to the operation of the suspicious process, the agent may regularly monitor the process and system abnormalities related to the suspicious packet (S440). This may be performed independently from the system-wide process and status monitoring operation performed entirely within the agent. have. Apart from the suspicious process, that is, even for a normal packet, the entire system process and state monitoring may be performed (S450). Accordingly, the access and leakage of sensitive information of the process may be tracked and monitored. Event information can be generated and transmitted to the agent manager for access and leakage of tracked information. The operation of such an agent can be performed within a number of operating systems and devices, and therefore, the agent manager can have various policies to support multiple operating systems and devices, and provide appropriate policies to the agent.

5 is a detailed block diagram showing in detail an agent manager of a cyber inspection system using SDN according to an embodiment of the present invention. 5, the agent manager 540 according to an embodiment of the present invention may include an event management unit 542, an agent management unit 544, and a policy management unit 546, and a policy database 548 It may further include.

Referring to FIG. 5, the event management unit 542 may receive a monitoring event from the agent 530 and manage the event for each received time. The collected thist information may be managed for each agent 530 through the agent management unit 544, and a security policy may be established by collecting and analyzing events of the agent 530. The establishment of a security policy may be performed by the policy management unit 546. The policy management unit 546 may establish, set, and manage a policy based on policy-related information included in the policy database 548. The policy database 548 may be disposed inside or outside the agent manager device 540. In the policy database 548, information related to an account policy (permission setting content according to a user account, etc.), a local security policy, a public key policy, and the like may be managed for each period, for each agent, or for each traffic flow. The policy management unit 546 can dynamically establish an appropriate policy through the information in the policy database 548 and event information frequently received from the agent 530, and can send the set policy down to the agent 530. .

As described above, in the present invention, specific matters such as specific components, etc., and limited embodiments and drawings have been described, but this is provided only to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , If a person of ordinary skill in the field to which the present invention belongs, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention is limited to the described embodiments and should not be defined, and all those having variations equivalent or equivalent to the claims, as well as the claims to be described later, will belong to the scope of the inventive concept. .

110: SDN switch
120: inspection office
130: agent
140: agent manager

Claims (1)

A SDN (Sofrwore Defined Network) switch for authenticating at least some of packets flowing into a unit network or flowing out to another unit network and performing traffic distribution;
A test station that discards the harmful packet by checking whether the packet to be inspected is a harmful packet among traffic-distributed packets, and attaches a suspicious tag to the suspected packet; And
SDN-based inspection system, characterized in that it comprises an agent for receiving a packet that has been inspected or a packet that has been distributed without inspection.

Images