KR20230053129A - A control method and the device for internet search engine using security interface - Google Patents

Abstract

Disclosed is a technology for securing network security by securing the security of a subscriber terminal by inducing the installation and operation of a security search engine on the subscriber terminal using a security interface. A security search engine control method and device using a security interface according to the present invention comprise: a first step in which a security management manager of a security interface checks the security search engine attempt of a subscriber terminal; a second step of transmitting a status inquiry message to the subscriber terminal that attempted a security search engine; a third step of installing the security search engine on the subscriber terminal and bypassing the second step when a status response message to the status inquiry message is not received from the subscriber terminal; and a fourth step of allowing the security search engine of the subscriber terminal when the status response message to the status inquiry message is received from the subscriber terminal.

Description

Security search engine control method and device using security interface {A CONTROL METHOD AND THE DEVICE FOR INTERNET SEARCH ENGINE USING SECURITY INTERFACE}

The present invention relates to a method and apparatus for controlling a secure search engine using a security interface, and more particularly, to whether or not a secure search engine is installed and operating state when a subscriber terminal accommodated in an Internet termination device attempts to access a network such as the Internet. It relates to a technology that allows secure network access by checking

The Internet is a global network of networks. There is a variety of information on the Internet, and in some cases, this information may contain both harmful and beneficial information.

For example, harmful information may exist by a user such as a hacker or a cracker. Hackers or crackers cause leakage of personal information of subscribers, intrusion and paralysis of network systems using viruses and malicious codes.

Harmful information that exists on the Internet is very diverse, and the target of attack is also very diverse, such as individual users, Internet service providers, or specific service providers as well as network equipment.

As such, harmful information existing on the Internet causes a lot of damage to subscribers and network equipment, and in the worst case, can make the use of the network impossible. Various security search engines exist to prevent damage from harmful information existing on the Internet.

Normally, a security search engine is installed in a subscriber's terminal to search for various viruses, hacking programs, spyware, and various malicious codes existing on the Internet, and removes them to improve the security status of the Internet and subscriber terminals. keep

When the security of the subscriber terminal is ensured by the presence of a security search engine in the subscriber terminal, the security of the Internet can be secured. In other words, if the security of all subscriber terminals accessing the Internet is provided, the Internet cannot be infected with a virus unless a virus or the like is generated within the Internet itself. Typically, a virus infects other subscriber terminals through a network by a subscriber terminal initially infected with the virus. Therefore, when an infected subscriber terminal does not access the Internet, the virus infection probability of other subscriber terminals is reduced.

Accordingly, when all subscriber terminals are equipped with security search engines and access the Internet, other subscriber terminals can be prevented from being infected, and the security of the Internet can be enhanced.

However, there is a problem that security search engines are not installed in all subscriber terminals. The current security search engine is provided in a form in which a subscriber separately purchases and installs a security search engine as needed. In addition, there is a problem in that a security search engine provided by Internet service providers or other service providers operates after a subscriber terminal accesses the Internet and connects to a web server.

In addition, when using an Internet gateway or an external security search system in this way, its performance is low, which can cause speed degradation, and compared to security search engines installed in subscriber terminals, the size of files to be searched is limited, and in the case of compressed files, search is difficult. It is difficult, and there are problems such as supporting only some protocols used in the Internet.

In addition, even if the security search engine is installed in the subscriber terminal, if an operating system (OS) program such as an operating system is reinstalled due to an error in the operation of the subscriber terminal, security is lowered because the security search engine is not installed temporarily. There are downsides. Security search engines that are usually sold require access to the Internet for license registration after purchase. At this time, the subscriber terminal has a problem in that it accesses the Internet in a state where security service is not provided because the genuine product is not registered even though the security search engine is installed.

KR 10-2011-0002947 A KR 10-2018-0103487 A

An object of the present invention to solve this problem is to check whether a security search engine is installed in the subscriber terminal when the subscriber terminal accesses the Internet, and if not, install the security search engine and then access the Internet. It is to strengthen the security of the subscriber terminal and the Internet.

According to the present invention, a security management manager provided in a security interface and permitting the security search engine only when the security search engine is installed in the subscriber terminal and normally operates by using a status query message when the subscriber terminal attempts the security search engine. A security search engine control device using a security interface and a method of driving the same are provided as means for solving the problem.

A method and apparatus for controlling a secure search engine using a security interface according to the present invention allows access depending on whether a secure search engine is installed and operated when a subscriber terminal accesses a network such as the Internet. It has the effect of securing the security of the network by allowing only subscriber terminals that are installed and operating to access the network so that only subscriber terminals with secured security can access the network. It has the effect of reducing maintenance costs.

In addition, by securing the security of the subscriber terminal, there is an effect of allowing the subscriber to use the subscriber terminal without fear of virus infection.

1 is a connection relationship of the Internet according to the present invention
2 is an internal configuration of a security interface according to the present invention
3 and 4 are message flows between a subscriber terminal and a secure interface in accordance with the present invention;
5 is an operation of a security search engine control method using a security interface
6 is a format of a status query message and a status response message according to the present invention

A secure search engine control method using a security interface of the present invention includes: a first step in which a security management manager of the security interface checks a secure search engine attempt of a subscriber terminal; a second step of transmitting a status query message to a subscriber terminal that has attempted a secure search engine; a third step of installing a security search engine in the subscriber terminal and detouring to the second step when the status response message for the status query message is not received from the subscriber terminal; and a fourth step of permitting the secure search engine of the subscriber terminal when a status response message for the status query message is received from the subscriber terminal.

The security search engine control device using the security interface to achieve this purpose is provided in the security interface, and when the subscriber terminal attempts the security search engine, the security search engine is installed in the subscriber terminal using the status query message and is normally It is characterized by having a security management manager that permits a secure search engine only when it is operating.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing the connection relationship of the Internet 10 according to the present invention.

The subscriber terminals 30a, 30b, ... are connected to the Internet 10 by being connected to the security interface 100, and the security search server 20 is connected to the Internet 10.

The subscriber terminals 30a, 30b, ... are terminals used by subscribers to use the Internet 10 service. The subscriber terminals 30a, 30b, ... include all terminals capable of accessing the Internet 10, such as personal computers and personal digital assistants (PDAs).

The security interface 100 is a type of network equipment provided in the Internet 10 and is provided at the most end of the Internet 10 to connect subscribers to the Internet 10 . Typically, the security interface 100 includes a residential gateway, a router, or an L2/L3 switch.

The security interface 100 according to the present invention checks whether the security search engine is installed or operated in the subscriber terminals 30a, 30b, ..., and detects the security search engine when the security search engine is not installed or does not operate. By installing or reinstalling, the security of the subscriber terminals 30a, 30b, ... is ensured.

The Internet 10 is a global scale network configured by connecting various networks. Numerous subscriber terminals (30a, 30b, ...) access the Internet (10) to access various information existing on the Internet (10), e-mail exchange or P2P (peer to peer) communication between subscriber terminals (30a, 30b, ...) exchange of information, etc. The Internet 10 supports communication between the subscriber terminals 30a, 30b, ... or communication between the subscriber terminals 30a, 30b, ... and information providing devices such as web servers.

The security search server 20 is connected to the Internet 10 and updates the security search engine installed in the subscriber terminals 30a, 30b, ... that access the Internet 10, improves functions such as supporting additional functions, and checks the status. and, when the security interface 100 installs a security search engine in the subscriber terminals 30a, 30b, ..., it supports this.

In the present invention, when a subscriber terminal (30a, 30b, ...) attempts to access the Internet (10), it is checked whether a security search engine is installed, and whether the security search engine is normally operated to connect to the Internet (10). will be. Here, if the security search engine is not installed in the subscriber terminals 30a, 30b, ... or does not operate normally, the security search engine is installed.

Here, the security search engine is installed in the security interface 100 and stored in the security search server 20 in the form of installing the security search engine in the subscriber terminals 30a, 30b, ... when necessary. Various implementations, such as installation in the subscriber terminals 30a, 30b, ..., if necessary, are possible.

2 is a diagram showing the internal configuration of the security interface 100 according to the present invention.

The security interface 100 according to the present invention includes a security management manager 110, a WAN port 111 and a terminal port 112.

The security management manager 110 is a control device for the security search engine 31 provided in the security interface 100 . When the subscriber terminals 30a, 30b, ... attempt access to the Internet 10, the security management manager 110 performs a status query to check whether the security search engine 31 is installed or not and its operation status, and performs a status query for the status query. If a suitable response is received, the connection is allowed.

However, if an appropriate response to the status query is not received or there is no response, the security management manager 110 transfers the security search engine 31 stored in the security search server 20 to the subscriber terminals 30a, 30b, ... install on Here, the security search engine 31 is not stored in the security search server 20 but in the security interface 100 according to the implementation intention of those skilled in the art, and is stored in the subscriber terminals 30a, 30b, ... by the security management manager 110. ) can also be implemented in the form of installation.

The WAN port 111 is a port through which the secure interface 100 is connected to the Internet 10 . The security interface 100 is basically a device for accommodating the subscriber terminals 30a, 30b, ... and connecting them to the Internet 10. The WAN port 111 is a port for connection from the security interface 100 to the Internet 10.

The terminal port 112 is a port for accommodating subscriber terminals 30a, 30b, ... to the security interface 100. A plurality of terminal ports 112 exist in the security interface 100, and the security interface 100 distinguishes subscriber terminals 30a, 30b, ... through port classification.

A security search engine 31 is provided in the subscriber terminals 30a, 30b, .... The security search engine 31 is installed in the subscriber terminals 30a, 30b, ... by the security management manager 110. The security search engine 31 inspects the subscriber terminals 30a, 30b, ... to check whether virus infection, malicious codes and spyware are installed, and to continuously prevent infection.

In addition, when receiving a status query from the security management manager 110, the security search engine 31 responds through a status response. The status response is delivered only when the security search engine 31 is normally installed and operating. Accordingly, if the security search engine 31 does not normally operate even though it is installed, the security search engine 31 is reinstalled by the security management manager 110 . This is because if the subscriber terminals 30a, 30b, ... are infected with viruses or malicious codes, even if the secure search engine 31 is installed, normal operation may be prevented. Therefore, in preparation for such a case, if it does not operate normally, it is to be operated normally through reinstallation.

3 and 4 are diagrams illustrating message flow between subscriber terminals 30a, 30b, ... and the security interface 100 according to the present invention.

3 shows a message flow when the security search engine 31 is installed in the subscriber terminals 30a, 30b, ... and operates normally.

When subscriber terminals 30a, 30b, ... attempt to access the Internet 10, the security interface 100 recognizes it. Recognition of an attempt to access the Internet 10 by the subscriber terminals 30a, 30b, ... in the security interface 100 may differ depending on the implementation form of the Internet 10.

In general, the Internet 10 can be divided into a case of using a dynamic IP (Internet Protocol) address method and a static IP address method.

When using a dynamic IP address, Internet service providers typically use DHCP (Dynamic Host Configuration Protocol). DHCP dynamically allocates IP addresses to subscriber terminals 30a, 30b, ... that access the Internet 10, and is a protocol for efficient use of IP address resources. The operation of DHCP is as follows.

When a terminal desiring to access the Internet 10 requests IP address allocation, a DHCP server managing IP addresses notifies us of available IP addresses, and the terminal selects and notifies an IP address to be used. The DHCP server then assigns an IP address.

During this DHCP operation process, a case in which the subscriber terminals 30a, 30b, ... transmits a message requesting an IP address can be determined as an attempt to access the Internet 10 by the subscriber terminals 30a, 30b, ... .

If you are using a static IP address, you can check access attempts using other methods.

In the Internet 10, ARP (Address Resolution Protocol) is used. In order to transfer information in a network such as the Internet 10, both the physical layer address (MAC address, Media Access Control address) and IP address of the destination must be known. Therefore, the network provides a protocol for obtaining a MAC address corresponding to an IP address, and ARP is a representative example.

ARP supports acquisition of a MAC address corresponding to an IP address or acquisition of an IP address corresponding to a MAC address. When the subscriber terminals 30a, 30b, ... access the Internet 10, the subscriber terminals 30a, 30b, ... require a gateway address for a secure search engine. Since the gateway address is a MAC address, the subscriber terminals 30a, 30b, ... acquire the gateway address through an ARP request.

That is, when the subscriber terminals 30a, 30b, ... make an ARP request for acquiring the MAC address of the gateway, it is determined as an access attempt.

In the present invention, the connection attempt determination of the subscriber terminals 30a, 30b, ... can be implemented in various forms according to the implementation intention of those skilled in the art in addition to the above methods.

When the security interface 100 confirms the access attempt of the subscriber terminals 30a, 30b, ..., it transmits a status query message to check whether the security search engine 31 is installed or not and its operating state. The security search engine 31 is installed in the subscriber terminals 30a, 30b, ..., and in case of normal operation, a status response message of the security search engine 31 is transmitted. When the status response message is transmitted, the security interface 100 allows the corresponding subscriber terminals 30a, 30b, ... to access the Internet 10.

4 shows a message flow when the security search engine 31 is not installed in the subscriber terminals 30a, 30b, ... or does not operate normally.

When the subscriber terminals 30a, 30b, ... attempt to access the Internet 10, the security interface 100 transmits a status query message to the security search engine 31 of the subscriber terminals 30a, 30b, .... At this time, since the security search engine 31 is not installed in the subscriber terminals 30a, 30b, ... or the security search engine 31 does not operate normally, the status response message is not transmitted.

The security interface 100 waits for a predetermined time and waits for a status response message to be transmitted. After a predetermined time has elapsed, the security interface 100 transmits a message requesting installation of the security search engine 31 to the corresponding subscriber terminals 30a, 30b, ... to the security search server 20. Accordingly, the security search server 20 transmits the security search engine 31 to the corresponding subscriber terminals 30a, 30b, ....

When the security search engine 31 is installed in the subscriber terminals 30a, 30b, ..., the security interface 100 transmits a status query message to the subscriber terminals 30a, 30b, .... Since the security search engine 31 is installed, the subscriber terminals 30a, 30b, ... can transmit a status response message to the security interface 100.

Upon receiving the status response message, the security interface 100 allows subscriber terminals 30a, 30b, ... to access the Internet 10.

5 is a flowchart illustrating the operation of a method for controlling the security search engine 31 using the security interface 100.

The security management manager 110 of the security interface 100 is driven to operate the security search engine 31 control function (S2). While the security management manager 110 of the security interface 100 is running, it is confirmed that access to the subscriber terminals 30a, 30b, ... is attempted (S4). At this time, the operation of the security interface 100 may be defined in more detail.

In other words, the security interface 100 is equipment for connecting the subscriber terminals 30a, 30b, ... to the Internet 10. In the security interface 100, the path through which the subscriber terminals 30a, 30b, ... attempt to access the Internet 10 and the path through which communication occurs after the connection attempt is the same. That is, one subscriber terminal 30a connected to one port of the security interface 100 attempts to access the Internet 10 using one path and continuously communicates.

Therefore, numerous packets are transmitted from the subscriber terminal 30a to the security interface 100, and the security interface 100 checks these packets and attempts to access the Internet 10 when DHCP or ARP related packets occur. to judge by

Therefore, when the subscriber terminals 30a, 30b, ... transmit packets other than DHCP or ARP-related packets to the Internet 10, security search is performed because the subscriber terminals 30a, 30b, ... have already completed an access attempt. It does not check whether the engine 31 is installed or not and whether it operates. This implementation can act as a security loophole of the Internet 10 when illegal subscriber terminals 30a, 30b, ... that do not pass through an access attempt occur.

Therefore, a status information list can be added to the security interface 100 by applying the present invention. The status information list checks whether the security search engine 31 is installed and operated when the subscriber terminals 30a, 30b, ... attempt to access, and stores whether the security search engine 31 is normally operated. In the status information list, when the subscriber terminals 30a, 30b, ... have received a status query from the security search engine 31 and have responded normally, these items are recorded in the status information list. Then, when a packet other than an access attempt is generated in the subscriber terminals 30a, 30b, ..., the security interface 100 returns the status of the subscriber terminals 30a, 30b, ... to expand security even though it is not an access attempt. It is to check using the information list.

When access is attempted by checking the status information list, communication is permitted only for the subscriber terminals 30a, 30b, ... that have performed status inquiry and status response procedures.

In the operation of the present invention, the deformable part may be different according to the implementation intention of those skilled in the art, and the part not presented in the above example may be modified.

When a packet is transmitted from the subscriber terminals 30a, 30b, ... to the security interface 100 and the packet is confirmed as an attempt to access the Internet 10 (S4), the security interface 100 sends the subscriber terminals 30a, 30b, ... The status query message is transmitted to (S6).

After transmitting the status query message, the security interface 100 waits for a predetermined time to receive a status response message from the subscriber terminals 30a, 30b, ... (operations up to step S6). However, if the status response message is not transmitted even after the predetermined time has elapsed (if No in step S8), the security interface 100 requests the security search server 20 to install the security search engine 31 to the subscriber terminal. The security search engine 31 is installed in (30a, 30b, ...) (S10).

Upon receiving the security search engine 31 installation request message of the security interface 100, the security search server 20 transmits the security search engine 31 to the corresponding subscriber terminals 30a, 30b, ..., 30b, ...) to be installed. At this time, the security search server 20 may use a program such as Active X control. Active X control is a program that downloads files or software by connecting a specific program with a browser. …) to be installed.

After the security search server 20 installs the security search engine 31 (after step S10), the security interface 100 detours to step S6 and transmits the status query message again.

When the status response message is received from the subscriber terminals 30a, 30b, ... (Yes in step S8), the security interface 100 allows the subscriber terminals 30a, 30b, ... to access the Internet 10. (S12).

6 is a diagram showing the format of a status query message and a status response message according to the present invention.

The status query message and status response message include a Version field, a Length field, a Message ID field, a Type field, and an Option field. The Version field records the protocol and version information used to transmit the status query message and status response message, and the Length field indicates the total length of the message. Distinguish between a status query message and a status response message by using the Message ID field and the Type field, and record the contents of the message. The Option field is a field allocated for extension according to future needs.

In addition, the preferred embodiment of the present invention is for illustrative purposes, and those skilled in the art will be able to make various modifications, changes, substitutions, and additions through the technical spirit and scope of the appended claims, and these modifications and changes, etc. should be considered within the scope.

10; Internet 20; Security search server
30a, 30b, ... ; subscriber terminal 31; secure search engine
100; security interface 110; Security Management Manager
111; WAN port 112; terminal port

Claims (3)

A secure search engine control method using a secure interface configured by connecting a subscriber terminal to a secure interface and connecting to the Internet, and a secure search server connected to the Internet, the method comprising:

A first step in which the security management manager of the security interface checks the security search engine attempt of the subscriber terminal;
a second step of transmitting a status query message to the subscriber terminal that has attempted a security search engine;
a third step of installing a security search engine in the subscriber terminal and detouring to the second step when a status response message for the status query message is not received from the subscriber terminal; and
a fourth step of allowing the security search engine of the subscriber terminal when a status response message for the status query message is received from the subscriber terminal;

The security search engine attempt,
When the subscriber terminal uses a dynamic IP (Internet Protocol) address, determining the IP address request of the subscriber terminal as an access attempt;
When the subscriber terminal uses a fixed IP (internet protocol) address, a security search engine control using a security interface characterized in that the request for a media access control (MAC) address of a gateway of the subscriber terminal is determined as an access attempt. method.
The method of claim 1, wherein the status query message comprises:
Query whether or not the security search engine is installed in the subscriber terminal and its operating state;
The status response message,
When the secure search engine is installed in the subscriber terminal and operates normally, the security management manager is notified that the secure search engine is operating. .
A security search engine control device using a security interface configured by connecting a subscriber terminal to a security interface and connecting to the Internet, and a security search server to the Internet, comprising:

A security management manager provided in the security interface and permitting the security search engine only when the security search engine is installed in the subscriber terminal and normally operates using a status query message when the subscriber terminal attempts the security search engine;
The security management manager,
When the subscriber terminal uses a fixed IP (internet protocol) address, determining a media access control (MAC) address request of a gateway of the subscriber terminal as an access attempt;
The status query message,
inquires whether the security search engine is installed in the subscriber terminal and is normally operating;
The security management manager,
The security search engine control device using a security interface, characterized in that it further comprises a status information list for storing whether the security search engine is installed or not and whether the security search engine is operated for each of the subscriber terminals accommodated in the security interface.

Images