KR20230106857A - Security system, apparatus, method, computer-readable storage medium and computer program for internal network - Google Patents

Abstract

The present invention relates to a network security system, method, computer readable recording medium, and computer program of an internal network, and more particularly, to security of an internal network by applying a rule to a packet flowing into a firewall device based on a MAC address. It relates to a network security system, apparatus, method, computer readable recording medium, and computer program of a managed internal network.

Description

Network security system of internal network, apparatus, method, computer readable recording medium, and computer program

The present invention relates to a network security system, apparatus, method, computer readable recording medium, and computer program of an internal network, and more particularly, to a network security system of an internal network by applying a rule to a packet flowing into a firewall device based on a MAC address. It relates to a network security system of an internal network for security management, a method, a computer readable recording medium, and a computer program.

In the case of a firewall operating in the existing IP layer, it is common to place a basic blocking policy at the lowest priority and a permitted policy at a higher priority.

Specifically, the policy, which means each rule in relation to a general firewall, identifies network packets flowing into the firewall through a combination of source IP, source port, destination IP, destination port, and service with the concept of '5-tuple'.

That is, in the case of a firewall operating in a general IP layer, a packet flowing into the firewall device is analyzed based on 5-tuple and the source and destination are identified by IP address.

However, there may be cases where the IP addresses of clients located on the internal network are not fixed. For example, IP addresses may be allocated when general users connect client host devices to a network, or IP addresses of client host devices of corresponding users may periodically change at regular intervals.

As a method to overcome such an environment, there is a user authentication mechanism, which identifies the user's IP address when the user logs in to connect to the network and dynamically recognizes the user's IP address in the firewall device. It is a function that recognizes the user when packets flow from the corresponding IP to the source.

However, in order to use these functions, additional devices such as captive portal for login are required, and basically, DNS packets for web access or web access packets for captive portal login must be allowed and flowed into the equipment.

Accordingly, there is a need for a technical idea capable of stably identifying and managing host devices of clients located in an internal network regardless of periodic IP address changes.

Republic of Korea Patent No. 10-1948049

Therefore, the present invention has been proposed to solve the above-mentioned problems, and a network security system of an internal network, a method, An object of the present invention is to provide a computer readable recording medium and a computer program.

Objects of the present invention are not limited to those mentioned above, and other objects not mentioned above will be clearly understood by those skilled in the art from the description below.

To achieve the above object, a network security system for an internal network according to an embodiment of the present invention includes at least one host device that transmits and receives data through a network path of the internal network; a database storing a security management table in which a plurality of predetermined security policies for packet transmission for each host device are mapped to the physical address of each host device; and a management device that determines one security policy from among the plurality of security policies based on the source information of the physical address included in the received packet, and executes the determined security policy for transmission of the packet.

A network security device for an internal network according to another embodiment of the present invention includes a security policy management unit that sets a security policy for packet transmission for each host device, and maps and manages the set security policy to a physical address of the corresponding host device; and a security policy executor configured to execute the set security policy for transmission of the packet based on source information of a physical address included in the received packet, wherein the security policy includes source information of a device that transmits the packet. A first policy for determining whether to block or release a firewall based on a firewall, a second policy for executing a predetermined rule for network use of the internal network in response to a corresponding host device when the firewall is determined to be disabled, and for the received packet and at least one of third policies for determining the range limitation of the internal network and/or external network of the packet transmission path based on the included information.

A network security method for an internal network according to another embodiment of the present invention includes receiving a packet; detecting source information of a physical address included in the packet; and a security policy execution step of executing a predetermined security policy for transmission of the packet based on the detected source information.

According to the network security system of the internal network according to an embodiment of the present invention, even if the IP address of the host device is dynamically changed in a network security device such as a firewall, the network security policy of the internal network is rapidly and quickly based on the MAC address. It can be run smoothly and maintenance can be easy.

In addition, a security policy can be quickly updated by notifying an administrator of information about host devices that are blocked in real time.

In addition, there is no need to memorize or find a MAC address that is difficult for a user of the host device to recognize, and it is easy for an administrator to manage MAC addresses of a plurality of host devices.

Effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a conceptual diagram schematically illustrating the configuration of a network security system for an internal network according to an embodiment of the present invention.
2 illustrates an example of a signal transmitted and received during network security of an internal network according to an embodiment of the present invention.
3 is a block diagram showing the configuration of a management device according to an embodiment of the present invention.
4 is an exemplary diagram illustrating an example of a blocking notification page according to an embodiment of the present invention.
5 is a flowchart illustrating a network security method of an internal network according to an embodiment of the present invention.
6 is an exemplary diagram illustrating a computing device employed in an embodiment of the present invention.

Objects and effects of the present invention, and technical configurations for achieving them will become clear with reference to embodiments to be described later in detail in conjunction with the accompanying drawings. In describing the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described later are terms defined in consideration of the structure, role, and function in the present invention, which may vary according to the intention or custom of a user or operator.

However, the present invention is not limited to the embodiments disclosed below and may be implemented in a variety of different forms. Only these embodiments are provided to complete the disclosure of the present invention and to fully inform those skilled in the art of the scope of the invention, and the present invention is described only in the claims. It is only defined by the scope of the claims. Therefore, the definition should be made based on the contents throughout this specification.

Throughout the specification, when a certain component is said to "include", it means that it may further include other components without excluding other components unless otherwise stated.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in more detail.

1 schematically illustrates the configuration of a network security system for an internal network according to an embodiment of the present invention, and FIG. 2 illustrates an example of signals transmitted and received during network security of an internal network according to an embodiment of the present invention. do.

1 and 2, the network security system of the internal network includes a host device 100 of multiple clients constituting the internal network, a management device 200 for security management of the internal network network, and an internal network network. It includes a database 300 that stores information for security management.

In the present invention, the internal network may refer to a communication network of the same domain range, for example, a range including hosts connected to the same medium using a shared medium such as Ethernet, and in particular, in one embodiment of the present invention, a MAC address It can be referred to as a network interface configured to control network access based on An external network connected to the internal network may be the external Internet.

The host device 100 is devices that transmit and receive data through a network path of an internal network, and may include at least one of a desktop, PC, tablet PC, slate PC, and notebook.

The management device 200 may execute at least one corresponding security policy among a plurality of preset security policies for packet transmission based on the source information of the physical address included in the received packet. The management device 200 may include a firewall device, and a detailed role of the management device 200 will be described later with reference to FIG. 3 .

The database 300 may store a security management table in which a plurality of predetermined security policies for packet transmission for each host device are mapped to the physical address of each host device.

As a first embodiment, the security management table may store MAC address information corresponding to each host device 100 . As a second embodiment, the security management table may further store at least one of MAC address information corresponding to each host device 100, a user ID mapped to the corresponding host device 100, a user name, and a department name. there is.

In addition, the security management table is a security policy set for each host device 100 and may include information on at least one condition for using an internal network and/or an external network. The condition information may include at least one of time information, period information, expiration information, and cost information.

In one embodiment, as a mechanism for an administrator to efficiently manage a security policy in a network security system of an internal network according to an embodiment of the present invention, a MAC address list of the host device 100 for each user is converted to LDAP (Lightweight Directory Access). Protocol) or data can be managed by a database such as Active Directory, which manages files in units of files. For example, information about one host device 100 may be stored per one file.

Here, LDAP is an information model that handles information stored in a directory and a hierarchical structure of information. The information model is centered on items (users or groups) and is a collection of fields belonging to users with types and values. Entries are organized in a tree structure called the directory information tree, and entries are organized around real-world concepts, organizations, people, and entities.

As one embodiment, the management device 200 includes a host information acquisition unit 210, a security policy management unit 220, and a security policy execution unit 230, as shown in FIG. Each of the aforementioned configurations may be controlled by software for performing network security executed in the management device 200 . In addition, each component may be formed as an integrated module or provided as one or more modules. Or, conversely, each component may be composed of a separate module.

The host information obtaining unit 210 may collect information related to each host device 100 of the internal network. As information associated with each host device 100, the physical address associated with the host device 100, the MAC address of the host device 100, user ID, user name, department name, security management table registration, security management table for each user ID. It may include at least one of registration or non-registration.

The security policy manager 220 may set the security policy for each host device, map the set security policy to a physical address of the corresponding host device, and manage the security policy.

For example, the security policy management unit 220 may set a security policy allowing network access to the host device 100 stored in the security management table as a basic option. However, as an exception, the security policy allowing access to the network may be selectively applied to the host device 100 that must comply with other policies.

Specifically, the security policy is a first policy for determining whether to block or release a firewall based on source information of a device that transmits a packet, and when determining to release the firewall, a predetermined setting for network use of the internal network corresponding to the corresponding host device. It may include at least one of a second policy that executes a rule and a third policy that determines a range limitation of an internal network and/or an external network of the packet transmission path based on contents included in the received packet.

The security policy management unit 220 may synchronize with the security policy to be executed by the security policy execution unit 230 by bringing security management table information from the database 300 in real time or at regular intervals in conjunction with the database 300 .

The security policy executor 230 may execute at least one of the first to third policies for a corresponding device according to the packet transmission decision.

For example, transmission or blocking of the packet may be performed according to a decision on whether or not to allow transmission of the packet, and when the packet is transmitted, the predetermined security policy may be applied to the corresponding host device.

As an embodiment, the security policy executor 230 may execute a security policy for disabling a firewall to permit transmission of the packet when the source information is stored in the security management table.

Specifically, if the source information included in the packet is stored in the security management table, the firewall may be released to allow the network path of the internal network. Accordingly, packets permitted by the security policy may be applied with the existing IP layer policy.

Here, the range of the internal network and/or the external network of the packet transmission path may be determined based on contents included in the received packet by the third policy. That is, the range in which the packet can be transmitted may be limited to the internal network and/or the external network according to the contents included in the packet.

Conversely, if source information included in the packet is not stored in the security management table, a security policy blocking a firewall to block a network path may be executed.

At this time, as shown in FIG. 4 , the security policy execution unit 230 outputs a message informing that the network path is blocked to the corresponding host device 100 on the blocking notification page, and the network path of the corresponding host device 100 is displayed on the blocking notification page. It is possible to provide a means of requesting access permission to the administrator.

For example, when a user selects and executes a button for requesting permission to access the network provided on the blocking notification page, the MAC address information of the corresponding host device 100 is transmitted to the security policy management unit 220 along with a signal requesting permission to access the network. Then, by the security policy management unit 220 receiving the information, the corresponding host device 100 is recorded in the security management table and security policies are set for each MAC address to manage network use.

In addition, when a network path is blocked, whether a certain device is blocking the network path through notification settings such as text messages or e-mails on the manager terminal (not shown), MAC address information of the device, and whether or not network access is requested through the device etc. can be notified. Here, network access may mean web access.

At this time, when a new host device is registered by the security policy management unit 220 according to a network access permission request, at least one of the physical address, user ID, user name, department name, and condition information of the new host device is stored in the security management table. Then, the security management table is updated, and then the database 300 and the security policy management unit 220 interlock to selectively synchronize newly stored information and security policies in the updated security management table.

Meanwhile, in general, the format of the MAC address is composed of 12 hexadecimal characters such as “01:23:45:67:89:AF”. Since the MAC address is complex, it has not been used for network security purposes in the past, but in an embodiment of the present invention, even if the IP address of the host device is dynamically changed in a network security device such as a firewall, the MAC address is By executing the network security policy of the internal network based on the base, the security policy can be quickly executed. In addition, a MAC address-based network security system may be easier to maintain than an IP address-based security system.

In addition, by notifying the administrator of the information of devices to be blocked in real time, the security policy can be quickly updated.

In addition, there is no need to memorize or find a MAC address that is difficult for a user of the host device to recognize, and it is easy for an administrator to manage MAC addresses of a plurality of host devices.

5 is a flowchart illustrating a network security method of an internal network according to an embodiment of the present invention.

The method shown in FIG. 5 is an embodiment and can be performed by the network management device 200 of the aforementioned internal network.

Referring to FIG. 5, first, the network management device of the internal network receives a packet (S110).

Here, prior to step S110, the step of setting a security policy for each host device, mapping the set security policy to the physical address of the corresponding host device and recording it in a security management table, and storing the security management table in a database are further steps. can include

Here, the security policy is a first policy for determining whether to block or release a firewall based on source information of a device that has transmitted packets. When the firewall is determined to be released, a preset policy for network use of the internal network is set in correspondence with the corresponding host device. It may include at least one of a second policy that executes a rule and a third policy that determines a range limitation of an internal network and/or an external network of the packet transmission path based on contents included in the received packet.

Next, source information of the physical address included in the packet may be detected (S120).

Next, a predetermined security policy for transmission of the packet may be executed based on the detected source information (S130).

To this end, first, the management device 200 may collect information related to each host device of the internal network. Information related to each host device may include at least one of a MAC address of the host device, a user ID, a user name, a department name, whether the host device is registered in the security management table, and whether each user ID is registered in the security management table.

The management device 200 may determine at least one security policy among the plurality of security policies for each host device, and map the determined security policy to a physical address of the corresponding host device for management.

In particular, the management device 200 may synchronize with the security policy by interworking with the database and bringing security management table information from the database in real time or at regular intervals.

According to the decision on whether or not to allow the transmission of the packet in step S130, transmission or blocking of the packet is performed, and when the packet is transmitted, a preset security policy may be applied to the corresponding host device.

That is, the management device 200 may execute at least one of the first to third policies for a corresponding device according to the packet transmission decision.

As an embodiment, the security policy executor 230 may execute a security policy for disabling a firewall to permit transmission of the packet when the source information is stored in the security management table.

Specifically, if the source information included in the packet is stored in the security management table, the firewall may be released to allow the network path of the internal network. Accordingly, packets permitted by the security policy may be applied with the existing IP layer policy.

Here, the range of the internal network and/or the external network of the packet transmission path may be determined based on contents included in the received packet by the third policy. That is, the range in which the packet can be transmitted may be limited to the internal network and/or the external network according to the contents included in the packet.

Conversely, if source information included in the packet is not stored in the security management table, a security policy blocking a firewall to block a network path may be executed.

At this time, as shown in FIG. 4 , the management device 200 outputs a message informing that the network path is blocked to the corresponding host device on a blocking notification page, and a means for requesting permission of the host device to access the network on the blocking notification page. can provide.

For example, when a user selects and executes a button for requesting permission to access the network provided on the blocking notification page, a network access permission request signal and MAC address information of the corresponding host device are transmitted to the management device 200 and received. A management device 200 can manage network use by recording a corresponding host device in a security management table and setting a security policy for each MAC address.

In addition, when a network path is blocked, whether a certain device is blocking the network path through notification settings such as text messages or e-mails on the manager terminal (not shown), MAC address information of the device, and whether or not network access is requested through the device etc. can be notified. Here, network access may mean web access.

At this time, when a new host device is registered by the management device 200 according to a network access permission request, at least one of the physical address, user ID, user name, department name, and condition information of the new host device is stored in the security management table. After the security management table is updated, the database and the management device 200 may be interlocked to selectively synchronize newly stored information and security policies in the updated security management table.

6 is an exemplary diagram illustrating a computing device employed in an embodiment of the present invention.

The illustrated computing environment 10 includes a computing device 12 . In one embodiment, the computing device 12 is a network security device of the internal network, such as, for example, the host information acquisition unit 210, the security policy management unit 220, and the security policy execution unit 230 shown in FIG. It may be one or more components included in.

Computing device 12 includes at least one processor 14 , a computer readable storage medium 16 and a communication bus 18 . Processor 14 may cause computing device 12 to operate according to the above-mentioned example embodiments. For example, processor 14 may execute one or more programs stored on computer readable storage medium 16 . The single programs may include one or more computer-executable instructions, which when executed by processor 14 are configured to cause computing device 12 to perform operations in accordance with an illustrative embodiment. It can be.

Computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. Program 20 stored on computer readable storage medium 16 includes a set of instructions executable by processor 14 . In one embodiment, computer readable storage medium 16 includes memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory. devices, other forms of storage media that can be accessed by computing device 12 and store desired information, or any suitable combination thereof.

Communications bus 18 interconnects various other components of computing device 12, including processor 14 and computer-readable storage medium 16.

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24 . An input/output interface 22 and a network communication interface 26 are connected to the communication bus 18 . Input/output device 24 may be coupled to other components of computing device 12 via input/output interface 22 . Exemplary input/output devices 24 include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touch screen), a voice or sound input device, various types of sensor devices, and/or a photographing device. It may include input devices, and/or output devices such as display devices, printers, speakers, and/or network cards.

The exemplary input/output device 24 may be included inside the computing device 12 as a component constituting the computing device 12, or may be connected to the computing device 12 as a separate device distinct from the computing device 12. may be

In the above, specific embodiments of the present invention have been described in detail. However, the spirit and scope of the present invention is not limited to these specific embodiments, and it is common knowledge in the technical field to which the present invention belongs that various modifications and variations are possible without changing the gist of the present invention. Anyone who has it will understand.

Therefore, since the embodiments described above are provided to completely inform those skilled in the art of the scope of the invention to which the present invention pertains, it should be understood that it is illustrative in all respects and not limiting, The invention is only defined by the scope of the claims.

Claims (19)

at least one host device to transmit and receive data through a network path of an internal network;
a database storing a security management table in which a plurality of predetermined security policies for packet transmission for each host device are mapped to the physical address of each host device; and
And a management device determining one security policy from among the plurality of security policies based on the source information of the physical address included in the received packet and executing the determined security policy for transmission of the packet. Network security system of the internal network. According to claim 1,
The database,
information related to each host device is mapped to the physical address of the corresponding host device and stored in the security management table;
The plurality of security policies,
A first policy for determining whether to block or release a firewall based on source information of a device transmitting a packet, and a second policy for executing predetermined rules for network use of the internal network in response to a corresponding host device when determining to release the firewall. A network security system for an internal network, characterized in that it includes at least one of a policy and a third policy for determining the range limitation of the internal network and/or external network of the packet transmission path based on the content included in the received packet. . According to claim 2,
The management device,
a host information acquisition unit collecting at least one of a physical address, a user ID, a user name, and a department name associated with the host device;
a security policy manager configured to set the security policy for each host device, map the set security policy to a physical address of the corresponding host device, and manage the management; and
and a security policy executor configured to execute at least one of the first to third policies for a corresponding device according to the packet transmission decision. According to claim 3,
The security policy management unit,
The network security system of the internal network, characterized in that interlocking with the database, bringing the security management table from the database in real time or at regular intervals and synchronizing it with the security policy to be executed by the security policy execution unit. According to claim 4,
The security policy execution unit,
When the source information is stored in the security management table, a security policy for disabling a firewall to allow transmission of the packet is executed. According to claim 5,
The security policy execution unit,
and when the source information is not stored in the security management table, a security policy for blocking a firewall to block transmission of the packet is executed. According to claim 6,
The security policy execution unit,
A network security system for an internal network, characterized by providing a means for outputting a message informing that a network path is blocked to a corresponding host device on a blocking notification page, and requesting permission of the host device to access the network from a manager on the blocking notification page. According to claim 1,
The physical address is
Network security system of the internal network, characterized in that the MAC address (MAC Address) address. a security policy manager configured to set a security policy for packet transmission for each host device, and map and manage the set security policy to a physical address of the corresponding host device; and
A security policy executor configured to execute the set security policy for transmission of the packet based on source information of a physical address included in the received packet;
The security policy,
A first policy for determining whether to block or release a firewall based on source information of a device transmitting a packet, and a second policy for executing predetermined rules for network use of the internal network in response to a corresponding host device when determining to release the firewall. and at least one of a third policy for determining a range limitation of an internal network and/or an external network of the packet transmission path based on contents included in the received packet. . receiving packets;
detecting source information of a physical address included in the packet; and
and a security policy execution step of executing a predetermined security policy for transmission of the packet based on the detected source information. According to claim 10,
Prior to receiving the packet,
and storing a security policy preset for the network of the internal network for each host device in a database as a security management table mapped to a physical address of each host device. According to claim 11,
The security policy,
A first policy for determining whether to block or release a firewall based on source information of a device transmitting a packet, and a second policy for executing predetermined rules for network use of the internal network in response to a corresponding host device when determining to release the firewall. and at least one of a third policy for determining a range limitation of an internal network and/or an external network of the packet transmission path based on contents included in the received packet. . According to claim 11,
A network security method of an internal network that interworks with the database and retrieves the security management table from the database in real time or at regular intervals and synchronizes with the security policy to be executed in the security policy execution step. According to claim 13,
In the security policy execution step,
and executing a security policy for disabling a firewall to permit transmission of the packet if the source information is stored in the security management table. According to claim 13,
In the security policy execution step,
When the source information is not stored in the security management table, a security policy for blocking a firewall to block transmission of the packet is executed. According to claim 15,
In the security policy execution step,
A network security method for an internal network, comprising: outputting a message informing that a network path is blocked to a corresponding host device on a blocking notification page, and providing means for requesting permission of the host device to access the network from a manager on the blocking notification page. According to claim 10,
The physical address is
A network security method of an internal network, characterized in that the MAC address address. A computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
receiving packets;
detecting source information of a physical address included in the packet; and
A computer-readable recording medium comprising instructions for causing the processor to perform a method including a security policy execution step of executing a predetermined security policy for transmission of the packet based on the detected source information. A computer program stored on a computer readable recording medium,
When the computer program is executed by a processor,
receiving packets;
detecting source information of a physical address included in the packet; and
A computer program comprising instructions for causing the processor to perform a method comprising a security policy execution step of executing a predetermined security policy for transmission of the packet based on the detected source information.

Images