KR20220115217A - Private cloud computing security customized recommendation system - Google Patents

Abstract

The present invention relates to a private cloud computing security customized recommendation system. The present invention comprises: a storage module in which data is stored; and a cloud module that provides a private cloud service and connects a user terminal and a storage module to an internal network. The cloud module includes an external security server that monitors the cloud module and a security module connected to an external network to provide a security function to the cloud service.

Description

PRIVATE CLOUD COMPUTING SECURITY CUSTOMIZED RECOMMENDATION SYSTEM

The present invention relates to cloud computing.

In general, cloud computing refers to Internet-based computer technology, where the cloud refers to the Internet, a complex infrastructure hidden in a computer network. The cloud computing environment can maximize work efficiency by enabling application programs to be used in each terminal without separate installation.

Such cloud computing can be largely divided into a public cloud and a private cloud according to a service providing medium and a network location of a service user. A public cloud is a service provided by an external cloud computing provider. In contrast, a private cloud is an individual company building a cloud computing environment in its own data center. Public clouds are cost-effective, scalable, and take advantage of next-generation technologies, while private clouds offer increased security through proprietary physical infrastructure.

However, despite the characteristics of the private cloud that security can be strengthened, enterprises feel a lot of difficulty in adopting the private cloud.

One of these reasons is that there are not many security experts who can manage private clouds internally. Even if a company hires a security expert, there is a considerable problem of employment and maintenance costs. In the case of small and medium-sized enterprises (SMEs) with a small sales scale, the current situation is that these problems become more real.

Accordingly, the inventor of the present invention has completed the present invention after a long period of research and trial and error in order to solve such a problem.

An object of the present invention is to provide a system that can easily manage a private cloud even if there is no security expert inside the company in order to solve the above problems.

The technical problems to be achieved in the present invention are not limited to the above technical problems, and other technical problems not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description.

One aspect of the present invention for solving the above-described problems, a storage module for storing data; and

It provides a private cloud service, including a cloud module that connects the user terminal and the storage module to an internal network,

The cloud module is

In order to provide security functions to the cloud service, it is connected to an external security server that monitors the cloud module and an external network, and includes a security module that maintains the security function of the cloud without performing its own security monitoring function of the private cloud service,

The cloud module divides the internal network and the external network with a fire protection function to prevent data transmission/reception between the internal network and the external network, but allows access to the internal network for signals sent by the external security server to the security module. can

In addition, the security module is

The security log generated in at least one of the storage module, cloud module, user terminal, and manager terminal is collected and transmitted to an external security server,

external security server,

If the collected security log is analyzed and determined to be an abnormal behavior, a security warning signal may be generated and transmitted to the security module.

In addition, the cloud module,

A git search module that receives hardware information from at least one or more parts supplier servers connected to an external network, generates a hardware DB, and enables a user terminal or an administrator terminal to search for hardware information through a search engine,

The git search module,

When hardware of a user terminal or manager terminal connected through an internal network is monitored and a set condition is satisfied, hardware replacement information and hardware recommendation information can be transmitted to the user terminal or the manager terminal.

In addition, the cloud module,

and a memory unit for storing access information input from a user terminal or an administrator terminal for access to the cloud service,

security module,

It is possible to periodically receive access information from a user terminal or an administrator terminal connected to the cloud service, periodically match the access information stored in the memory unit, and maintain the access only when the matched information is the same.

In addition, the cloud module,

Including a module amount adjusting unit for reducing the load applied to the security module by increasing the amount of access to the cloud service by adjusting the number of security modules,

The module amount control unit,

When traffic is detected in real time and exceeds a preset first reference amount, the number of security modules is increased,

After the traffic exceeds the first reference amount until it falls below the first reference amount, the internal network is blocked for a plurality of user terminals accessing the cloud service, but at a predetermined time interval individually in the order of accessing the cloud service Block the internal network,

When the traffic falls below the first reference amount, the load on the security module can be reduced by increasing the access amount of the user terminal by allowing the user terminals to access the internal network in the order in which they are blocked from accessing the plurality of user terminals.

In addition, the cloud module,

an access blocking unit for blocking an internal network connected to a user terminal that is additionally attempting to access when the cloud service access traffic of the user terminal exceeds a preset second reference amount; and

When the detected traffic exceeds a preset first reference amount, including at least one of a network control unit for reducing the internal network speed of the previously connected user terminal or the manager terminal,

connection blocker,

When the traffic exceeds the second reference amount, network necessary information for requesting the extension of the internal network may be generated and transmitted to the manager terminal.

The present invention makes it possible to easily manage the private cloud even if the company does not have security experts inside, thereby providing management convenience to the company.

In addition, the present invention enables the management of the private cloud without hiring additional security experts, thereby reducing costs by at least 30% compared to AWS.

On the other hand, even if it is an effect not explicitly mentioned herein, it is added that the effects described in the following specification expected by the technical features of the present invention and their potential effects are treated as described in the specification of the present invention.

1 is a view schematically showing the overall operating principle of an embodiment according to the present invention.
2 is a diagram showing the configuration of a private cloud system.
3 is a diagram schematically showing the principle of operation of the git search module.
※ It is revealed that the accompanying drawings are exemplified as a reference for understanding the technical idea of the present invention, and the scope of the present invention is not limited thereby.

In the description of the present invention, if it is determined that the subject matter of the present invention may be unnecessarily obscured as it is obvious to those skilled in the art with respect to related known functions, the detailed description will be omitted.

The present invention provides a dashboard in the form of an intuitive UI so that an administrator without specialized knowledge can easily manage a private cloud service. The dashboard displays CPU, memory, traffic, storage usage, etc. as information about the overall cloud infrastructure status in an easy-to-view manner.

In addition, the present invention provides a drag-and-drop architecture map design system. The architecture map is designed to optimize the network to reduce operating costs. Furthermore, the cloud migration is simplified by designing the architecture map to facilitate data movement from the data center used by the customer company to the cloud.

A container is a software package that includes all elements necessary to virtualize an operating system and run, and the present invention increases availability by using Kubernetes as an operating system of a cloud service in order to efficiently manage the container. In other words, it improves portability and scalability of cloud services. Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a view schematically showing the overall operating principle of an embodiment according to the present invention. 2 is a diagram showing the configuration of the private cloud system 100 . 1 and 2 , the private cloud system 100 includes a storage module 110 and a cloud module 120 .

The storage module 110 is a place for storing data, and stores data generated in the process of providing a cloud service or data necessary for providing a cloud service.

The cloud module 120 provides a private cloud service, and connects the storage module 110, the user terminal 200, and the manager terminal 300 to an internal network. The cloud module 120 includes a security module 121 to maintain security of the provided cloud service. The security module 121 is connected to the external security server 400 that monitors the cloud module through an external network, and can maintain the security function of the cloud without performing its own security monitoring function of the private cloud service. At the same time, the cloud module 120 prevents data transmission and reception between the internal network and the external network by dividing the internal network and the external network with a fire prevention function. However, the cloud module 120 allows access to the internal network for a signal transmitted from the external security server 400 to the security module 121 . The security module 121 may provide a security function in the form of a SEIM-based 24-hour security control service. SEIM stands for security software that provides real-time analysis of security alerts generated by applications and network hardware.

The security module 121 collects security logs from the storage module 110 , the cloud module 120 , the user terminal 200 , and the manager terminal 300 to provide a security function to the cloud service. Here, the security log means information about access time to a network or an IP address of a host. The security module 121 transmits the collected security log to the external security server 400 to request analysis of the collected security log. The external security server 400 analyzes the received security log to determine whether there is an abnormal behavior. That is, it is determined whether it is an attack action against the system. The external security server 400 mechanizes the security log and analyzes the collected security log using a natural language processing technique. If the analyzed security log does not correspond to a preset normal behavior category, the external security server 400 transmits a security warning signal to the security module 121 .

The cloud module 120 includes an access information storage unit 123 that stores access information input from the user terminal 200 or the manager terminal 300 for access to the cloud service. Here, the access information means an authentication key. The security module 121 generates and transmits a login interface each time the user terminal 200 or the manager terminal 300 accesses the cloud service, and the terminals 200 and 300 input access information to the login interface and access the cloud service. . In this process, the access information generated by the terminals 200 and 300 is transmitted to the access information storage unit 123 . The access information storage unit 123 has an area allocated in the cloud, and may be formed based on volatile memory resources such as cache and RAM memory. Accordingly, the access information storage unit 123 can quickly provide the stored access information.

The security module 121 strengthens security by periodically authenticating the user terminal 200 or the manager terminal 300 accessing the cloud service. The security module 121 periodically receives an authentication key from the accessed user terminal 200 or the manager terminal 300 , and periodically matches the access information stored in the access information storage unit 123 . As a result of matching, if the access information received from both sides is the same, the security module 121 maintains the access of the terminals 200 and 300 . The private cloud system 100 provides security as well as a comfortable network environment of the terminals 200 and 300 by providing quick access information from the access information storage unit 123 .

The cloud module 120 includes a module amount adjusting unit 124 to reduce the load applied to the security module 121 due to a large-scale connection. The module amount adjusting unit 124 reduces the load applied to the security module 121 due to an increase in the amount of access of the user terminal 200 to the cloud service by adjusting the number of security modules 121 . To this end, the module amount adjusting unit 124 detects traffic in real time and increases the number of security modules 121 according to a set ratio when it exceeds a preset first reference amount.

Additionally, after the traffic exceeds the first reference amount until it falls below the first reference amount, the module amount adjusting unit 124 blocks the internal network at regular time intervals in the order in which the user terminal 200 is connected to the cloud service. . In addition, when the traffic falls below the first reference amount, the module amount adjusting unit 124 allows the user terminals 200 access-blocked to access the internal network in the blocked order. Since there is a higher probability that the user terminal connected first in the order of access has sufficiently used the private cloud service, the module amount adjusting unit 124 blocks the connection of the user terminal 200 connected first to maintain a smooth network environment. have.

In addition, the cloud module 120 includes an access blocking unit 125 and a network control unit 126 to avoid network overload due to a large-scale connection of the user terminal 200 .

When the cloud service access traffic of the user terminal exceeds the second reference amount, the access blocking unit 125 does not allow the access of the user terminal 200 attempting to access the user terminal. Here, the second reference amount is a value higher than the first reference amount, and indicates a state in which traffic is increased. If too many user terminals 200 are connected, the entire system may be stopped. In order to prevent such a situation, when the traffic exceeds the second preset reference amount, the access blocking unit 125 blocks the internal network for the user terminal 200 that is accessed after the excess. Further, when the access blocking unit 125 exceeds the second reference amount of traffic, the network necessary information for requesting the extension of the internal network is generated and transmitted to the manager terminal 300 . Accordingly, the manager can prevent a dangerous situation such as exceeding the second reference amount of traffic from occurring in the future.

When the detected traffic exceeds a preset first reference amount, the network control unit 126 reduces the internal network speed of the connected user terminal 200 or the manager terminal 300 . That is, a situation in which additional access of the user terminal 200 is not allowed because the traffic exceeds the second reference amount is prevented in advance.

3 is a diagram schematically showing the principle of operation of the git search module. As can be seen from FIG. 3 , the present invention includes a git search module 122 that connects a networking network with a component supplier built by itself to a private cloud using an internal network. The git search module 122 connects a separate component supplier networking network, which is an external network, to a private cloud, which is a closed networking network, to maintain security in the information provision process.

The Git search module 122 uses a distributed version control system called Git to recommend hardware information or provide a search engine for hardware. Git prevents data from leaking from other devices that can occur during the data overwrite process of devices that are simultaneously connected to the cloud. Accordingly, the git search module 122 guarantees stable hardware information upload of the component supplier server 500 . Hardware information is information including at least price or model names of devices required to build and operate cloud services. Furthermore, the hardware information is a concept that includes both information on new hardware as well as information on used products.

The git searching module 122 receives hardware information from at least one component supplier server 500 connected to an external network and generates a hardware DB. The user terminal 200 or the manager terminal 300 may search for hardware existing in the DB through the provided search engine. The parts supplier server 500 updates the hardware DB using Git provided by the Git search module 122 . A plurality of component supplier servers 500 connected at the same time can update the hardware DB without conflict through a distributed version control system called Git.

The git search module 122 recommends necessary hardware to the user terminal 200 or the manager terminal 300 by monitoring the private cloud system 100 as well as the user terminal 200 or the manager terminal 300 by itself. The git search module 122 monitors hardware of all devices connected to the internal network and transmits hardware replacement information and recommended information to the user terminal 200 or the manager terminal 300 .

The hardware replacement information is information indicating that it is time to replace the hardware of the device, and the git searching module 122 generates hardware replacement information when a preset condition is satisfied for each hardware. For example, if the CPU replacement period of a certain user terminal 200 is from January 1, 2021, the git search module 122 generates CPU replacement information at this time. In addition, the hardware recommendation information is information on hardware recommended based on at least performance and price. If the CPU installed in the user terminal 200 needs to be 3 GHz or higher, the git search module 122 generates recommendation information for a new or used CPU with the lowest price among CPUs of 3 GHz or higher. That is, the git searching module 122 recommends hardware corresponding to the lowest price among hardware that satisfies the set performance information for hardware connected to the internal network and simultaneously satisfies the set performance information.

It is apparent to those skilled in the art that the present invention may be embodied in other specific forms without departing from the characteristics of the present invention. Accordingly, the above detailed description should not be construed as restrictive in all respects but as exemplary. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the equivalent scope of the present invention are included in the scope of the present invention.

Claims (6)

a storage module in which data is stored; and
It provides a private cloud service, including a cloud module that connects the user terminal and the storage module to an internal network,
The cloud module is
In order to provide security functions to the cloud service, it is connected to an external security server that monitors the cloud module and an external network, and includes a security module that maintains the security function of the cloud without performing its own security monitoring function of the private cloud service,
The cloud module divides the internal network and the external network with a fire protection function to prevent data transmission and reception between the internal network and the external network, but allows access to the internal network for signals sent by the external security server to the security module. ,
Private Cloud Computing Security Customized Recommendation System. According to claim 1,
security module,
The security log generated in at least one of the storage module, cloud module, user terminal, and manager terminal is collected and transmitted to an external security server,
external security server,
If it is determined as an abnormal behavior by analyzing the collected security log, it generates a security warning signal and sends it to the security module.
Private Cloud Computing Security Customized Recommendation System. The method of claim 1,
The cloud module is
A git search module that receives hardware information from at least one or more parts supplier servers connected to an external network, generates a hardware DB, and enables a user terminal or an administrator terminal to search for hardware information through a search engine,
The git search module,
Monitoring the hardware of the user terminal or the manager terminal connected to the internal network and sending hardware recommendation information along with the hardware replacement information to the user terminal or the manager terminal when the set condition is satisfied,
Private Cloud Computing Security Customized Recommendation System. According to claim 1,
The cloud module is
and a memory unit for storing access information input from a user terminal or an administrator terminal for access to the cloud service,
security module,
Periodically receiving access information from a user terminal or an administrator terminal connected to the cloud service, periodically matching the access information stored in the memory unit, and maintaining the access only when the matched information is the same;
Private Cloud Computing Security Customized Recommendation System. According to claim 1,
The cloud module is
Including a module amount adjusting unit for reducing the load applied to the security module by increasing the amount of access to the cloud service by adjusting the number of security modules,
The module amount control unit,
When traffic is detected in real time and exceeds a preset first reference amount, the number of security modules is increased,
After the traffic exceeds the first reference amount until it falls below the first reference amount, the internal network is blocked for a plurality of user terminals accessing the cloud service, but at a predetermined time interval individually in the order of accessing the cloud service Block the internal network,
When the traffic falls below the first reference amount, by allowing the internal network access of the user terminals in the order in which the access is blocked for a plurality of user terminals, reducing the load on the security module due to the increase in the amount of access of the user terminal,
Private Cloud Computing Security Customized Recommendation System. 6. The method of claim 5,
The cloud module is
an access blocking unit configured to block an internal network connected to a user terminal that is additionally attempted to access when the cloud service access traffic of the user terminal exceeds a preset second reference amount; and
Comprising at least one of a network control unit for reducing the internal network speed of the previously connected user terminal or the manager terminal when the detected traffic exceeds a preset first reference amount,
connection blocker,
When the traffic exceeds the second reference amount, the network necessary information to request the extension of the internal network is generated and transmitted to the manager terminal,
Private Cloud Computing Security Customized Recommendation System.

Images