KR20230149925A - Terminal security system and terminal security method using the system - Google Patents

Abstract

A terminal security system that can safely protect and utilize threat intelligence generated in a terminal and a terminal security method using the same are disclosed. This terminal security system includes a blockchain system and at least one terminal A. The blockchain system includes a plurality of nodes. The at least one terminal A generates threat intelligence using a security threat and transmits the threat intelligence to one of the nodes. Any one of the nodes that have received the threat intelligence creates a block containing the threat intelligence and then transmits it to the nodes and stores it in blockchain form. In this way, threat intelligence generated from an arbitrary terminal can be safely protected by being distributed and stored across multiple nodes in the form of a blockchain.

Description

Terminal security system and terminal security method using the same {TERMINAL SECURITY SYSTEM AND TERMINAL SECURITY METHOD USING THE SYSTEM}

The present invention relates to a terminal security system and a terminal security method using the same. It relates to a terminal security system capable of performing security in a terminal and a terminal security method using the same.

Threat detection technology, which is generally used in firewalls or IDS (Intrusion Detection System), performs detection based on a specific signature value (IOC, Indicator of Compromised) and sends an alert message. It works by informing the analyst. Therefore, there is a disadvantage that only known malicious code or attack packets can be detected, and it is difficult to prevent attacks by unknown or modified malicious code.

In addition, threat detection technology that detects the behavior of malware, such as EDR (Endpoint Detection & Response), determines threats only based on API (Application Programming Interface) usage patterns or information collected at the single device level, so APT (Advanced Persistent Threat) ; Intelligent continuous attack) is not effective in tracking or detecting attacks.

In addition, threat detection technologies such as SIEM (Security Information and Event Management) and ESM (Enterprise Security Management) store and analyze alerts and events in one place, but the correlation analysis between events is connected at the IOC level. There is a problem with the lack of connection meaning and flow between events. In this case, the analyst must directly understand and determine the context of the detected events and the meaning of the detected results, which has the disadvantage of being time-consuming and limiting the detection of unknown APT attacks.

To compensate for these limitations, an APT attack detection concept called threat hunting was proposed. Threat hunting refers to a process in which an analyst uses conventional technology to establish a TTP-based detection hypothesis to detect APT attacks, periodically verifies the hypothesis, and derives APT-related circumstances from a large number of events. Recently, threat hunting has been specified as a procedure to classify the attacker's attack technique (TTP) and perform detection hypotheses and detection based on this. The attack technology classification standard used is primarily the ATT&CK TM presented by MITER, and ATT&CK TM is periodically updated by MITER.

Meanwhile, threat intelligence, which is the result of threat hunting, can be said to be evidence-based information organized and analyzed by cybersecurity experts about cyber attacks. At this time, threat intelligence can be said to be a dynamic concept rather than a static concept, and the infringement indicators and TTPs (Tactics, Techniques, Procedures) contained in the information called threat intelligence indicate the direction or flow of the attack, And it can be viewed as an information asset that contains long-term accumulated history, including relevance. Therefore, it is necessary to utilize threat intelligence while protecting it safely.

Therefore, the present invention is intended to solve this problem, and the problem to be solved by the present invention is to provide a terminal security system that can safely protect and utilize threat intelligence generated in the terminal.

In addition, another problem to be solved by the present invention is to provide a terminal security method using the terminal security system.

A terminal security system according to an embodiment of the present invention includes a blockchain system and at least one terminal A. The blockchain system includes a plurality of nodes. The at least one terminal A generates threat intelligence using a security threat and transmits the threat intelligence to one of the nodes. Any one of the nodes that have received the threat intelligence creates a block containing the threat intelligence and then transmits it to the nodes and stores it in blockchain form.

The terminal security system may further include at least one terminal B that receives the threat intelligence from any one of the nodes and generates a security solution using the threat intelligence. At this time, the terminal B can protect cyber assets from threats occurring in the terminal B using the security solution.

Alternatively, the terminal security system may further include a security solution server that receives the threat intelligence from any one of the nodes and generates a security solution using the threat intelligence. At this time, at least one terminal, including the terminal A, may receive the security solution generated by the security solution server from an external source. Specifically, the security solution server may transmit the security solution to any one of the nodes, and any one of the nodes that received the security solution may send a block containing the security solution. After it is created, it can be transmitted to the nodes and stored in blockchain form, and at least one terminal, including the terminal A, can receive the security solution from any one of the nodes. Afterwards, at least one terminal, including the terminal A, can use the security solution to protect cyber assets from threats currently occurring.

The security solution may include a method of analyzing the threat intelligence to find vulnerabilities of cyber assets to the threats and protecting the cyber self from the threats. Specifically, the security solution analyzes the threat intelligence, first predicts future threats that will occur in the future, finds vulnerabilities in the cyber assets against the threats and the future threats, and detects the threats and the future threats. It may include a method of protecting the cyber assets from.

The threat intelligence may include at least one of log collection information about the threat, infringement indicators, attack patterns, malware information, and history information, and the history information includes log collection information about previous threats, infringement indicators, and attacks. It may include at least one accumulated information of pattern and malicious code information.

Next, the terminal security method according to an embodiment of the present invention includes the steps of generating, by at least one terminal A, threat intelligence using a security threat; transmitting, by the terminal A, the threat intelligence to any one node among a plurality of nodes included in the blockchain system; And a step of one of the nodes receiving the threat intelligence generating a block containing the threat intelligence and then transmitting the block to the nodes and storing it in blockchain form.

The terminal security method includes: receiving, by at least one terminal B, the threat intelligence from any one of the nodes; And the terminal B may further include generating a security solution using the threat intelligence. At this time, the terminal security method may further include the step of the terminal B protecting cyber assets from threats occurring in the terminal B using the security solution.

Differently, the terminal security method includes: receiving, by a security solution server, the threat intelligence from any one of the nodes; And the security solution server may further include generating a security solution using the threat intelligence. At this time, the terminal security method may further include a step where at least one terminal, including the terminal A, receives the security solution generated by the security solution server from an external source. Specifically, the step of receiving the security solution from an external source at least one terminal, including the terminal A, includes: transmitting, by the security solution server, the security solution to one of the nodes; A step of one of the nodes receiving the security solution generating a block containing the security solution and then transmitting the block to the nodes and storing it in blockchain form; and receiving, by at least one terminal including the terminal A, the security solution from any one of the nodes. In addition, the terminal security method may further include the step of protecting cyber assets from currently occurring threats by using the security solution at least one terminal, including the terminal A.

The security solution may include a method of analyzing the threat intelligence to find vulnerabilities of cyber assets to the threats and protecting the cyber self from the threats. Specifically, the security solution analyzes the threat intelligence, first predicts future threats that will occur in the future, finds vulnerabilities in the cyber assets against the threats and the future threats, and detects the threats and the future threats. It may include a method of protecting the cyber assets from.

The threat intelligence may include at least one of log collection information about the threat, infringement indicators, attack patterns, malware information, and history information, and the history information includes log collection information about previous threats, infringement indicators, and attack patterns. and may include at least one accumulated information of malicious code information.

According to the terminal security system according to the present invention and the terminal security method using the same, the threat intelligence generated in an arbitrary terminal is transmitted to the blockchain system and stored in blockchain form in a plurality of nodes, so that the threat intelligence It can be safely protected within the blockchain system.

In addition, as a terminal with access to the blockchain system accesses the blockchain system and receives the threat intelligence, the terminal uses the threat intelligence to protect cyber assets from threats occurring to itself. can do.

Figure 1 is a conceptual diagram illustrating a process of generating threat intelligence in terminal A of the terminal security system according to the first embodiment of the present invention.
Figure 2 is a conceptual diagram to explain the process in which threat intelligence generated in terminal A of the terminal security system of Figure 1 is stored in the blockchain system.
FIG. 3 is a conceptual diagram illustrating the process in which a security solution is created in terminal B after threat intelligence stored in the blockchain system of the terminal security system of FIG. 1 is transmitted to terminal B.
Figure 4 is a conceptual diagram illustrating the process of generating threat intelligence in terminal A of the terminal security system according to the second embodiment of the present invention.
FIG. 5 is a conceptual diagram illustrating the process in which threat intelligence generated in terminal A of the terminal security system of FIG. 4 is stored in the blockchain system and transmitted to the security solution server, and then a security solution is created in the security solution server.
FIG. 6 is a conceptual diagram illustrating a process in which a security solution generated by a security solution server in the terminal security system of FIG. 4 is transmitted to terminal A.

Since the present invention can be subject to various changes and have various forms, specific embodiments will be illustrated in the drawings and described in detail in the text.

However, this is not intended to limit the present invention to a specific disclosed form, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention. Terms such as first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component without departing from the scope of the present invention.

The terms used in this application are merely used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features or It should be understood that this does not exclude in advance the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings.

<Example 1>

Figure 1 is a conceptual diagram illustrating a process of generating threat intelligence in terminal A of the terminal security system according to the first embodiment of the present invention.

Referring to FIG. 1, the terminal security system according to this embodiment may include a blockchain system 100 and a plurality of terminals. At this time, the terminals may include at least one terminal A (200) and at least one terminal B (300).

The blockchain system 100 may include a plurality of nodes 110 connected to each other. The blockchain system 100 is an information sharing system that transmits blocks generated in one of the nodes 110 to other nodes and then forms a blockchain to share information with high security. You can. For example, if one of the nodes 110 collects or generates random information, creates a block through verification, and then propagates the block to the nodes 110 including itself, the node Each of the blocks 110 can form and store a new blockchain by connecting the received block to a previously stored blockchain.

In this embodiment, at least some of the nodes 110 may be directly connected to the terminals wirelessly or wired to perform a distributed intelligence computing function. For example, the blockchain system 100 may include a fog system consisting of at least one node capable of performing intelligent distributed computing.

The terminals can send and receive signals to each other through any wired or wireless network, and can be connected to the nodes 110 to send and receive signals. Each of the terminals may be, for example, a computer system such as a laptop or desktop, or a mobile terminal such as a smartphone or tablet PC. At this time, each of the terminals may have its own terminal security agent installed, which is responsible for its own security.

Hereinafter, a terminal security method for performing security in each of the terminals using the terminal security system described above will be described in detail.

Referring again to FIG. 1, first, the terminal A (200) can generate threat intelligence using security threats.

In this embodiment, the threat intelligence provides actionable advice on areas that may pose a threat to the terminal A (200) itself or IT or information assets on the network including the terminal A (200), such as context, mechanisms, indicators, etc. It may be information presented as . For example, the threat intelligence may include at least one of log collection information about the threat, infringement indicators, attack patterns, malware information, and history information. At this time, the history information may include at least one accumulated information among log collection information about previous threats, infringement indicators, attack patterns, and malware information. The log collection information may include network layer logs, endpoint layer logs, user authentication logs, threat information logs, etc.

Figure 2 is a conceptual diagram to explain the process in which threat intelligence generated in terminal A of the terminal security system of Figure 1 is stored in the blockchain system.

Referring to FIG. 2, after the terminal A (200) generates the threat intelligence, the terminal A (200) connects with any one of the nodes (110) included in the blockchain system (100). By connecting, the threat intelligence can be transmitted to the corresponding node.

Subsequently, one of the nodes 110 that received the threat intelligence may generate a block containing the threat intelligence and transmit it to the nodes 110 to store it in blockchain form. As a result, the threat intelligence can be distributed and stored in the nodes 110 in blockchain form and safely protected from external intrusion.

FIG. 3 is a conceptual diagram illustrating the process in which a security solution is created in terminal B after threat intelligence stored in the blockchain system of the terminal security system of FIG. 1 is transmitted to terminal B.

Referring to FIG. 3, after the threat intelligence is distributed and stored in the nodes 110, the terminal B (300) connects to any one of the nodes 110 and receives the threat intelligence from that node. You can receive it. At this time, the terminal B (300) may have the authority to connect to any one of the nodes (110) and receive the threat intelligence.

Subsequently, the terminal B (300) can create a security solution using the threat intelligence.

Subsequently, the terminal B (300) can use the security solution to protect cyber assets from threats occurring in the terminal B (300).

In this embodiment, the cyber asset may include the terminal B (300) itself or information stored in a network system including the terminal B (300), an operating system, network information, etc.

In this embodiment, the security solution may include a method for analyzing the threat intelligence to find vulnerabilities in cyber assets against the threat, thereby protecting the cyber self from the threat. Furthermore, the security solution analyzes the threat intelligence to first predict future threats that will occur in the future, finds vulnerabilities in the cyber assets against the threats and the future threats, and protects against the threats and the future threats. May include ways to protect cyber assets.

According to this embodiment, as threat intelligence generated in an arbitrary terminal is transmitted to the blockchain system 100 and stored in the nodes 110 in blockchain form, the threat intelligence is transmitted to the blockchain system 100. It can be safely protected within (100).

In addition, as a terminal with access rights to the blockchain system 100 accesses the blockchain system 100 and receives the threat intelligence, the terminal uses the threat intelligence to Protect your cyber assets from threats.

<Example 2>

Figure 4 is a conceptual diagram illustrating the process of generating threat intelligence in terminal A of the terminal security system according to the second embodiment of the present invention.

Referring to FIG. 4, the terminal security system according to this embodiment may include a blockchain system 100, a plurality of terminals including at least one terminal A (200), and a security solution server 400.

The blockchain system 100 may include a plurality of nodes 110 connected to each other. The blockchain system 100 is an information sharing system that transmits blocks generated in one of the nodes 110 to other nodes and then forms a blockchain to share information with high security. You can. For example, if one of the nodes 110 collects or generates random information, creates a block through verification, and then propagates the block to the nodes 110 including itself, the node Each of the blocks 110 can form and store a new blockchain by connecting the received block to a previously stored blockchain.

In this embodiment, at least some of the nodes 110 may be directly connected to the terminals wirelessly or wired to perform a distributed intelligence computing function. For example, the blockchain system 100 may include a fog system consisting of at least one node capable of performing intelligent distributed computing.

The terminals can send and receive signals to each other through any wired or wireless network, and can be connected to the nodes 110 to send and receive signals. Each of the terminals may be, for example, a computer system such as a laptop or desktop, or a mobile terminal such as a smartphone or tablet PC.

The security solution server 400 can be connected to the nodes 110 through any wired or wireless network to exchange signals, and can also be directly connected to the terminals to exchange signals. The security solution server 400 may have its own joint security agent installed to control the security of each terminal.

Hereinafter, a terminal security method for performing security in each of the terminals using the terminal security system described above will be described in detail.

Referring again to FIG. 4, first, the terminal A (200) can generate threat intelligence using security threats.

In this embodiment, the threat intelligence provides actionable advice on areas that may pose a threat to the terminal A (200) itself or IT or information assets on the network including the terminal A (200), such as context, mechanisms, indicators, etc. It may be information presented as . For example, the threat intelligence may include at least one of log collection information about the threat, infringement indicators, attack patterns, malware information, and history information. At this time, the history information may include at least one accumulated information among log collection information about previous threats, infringement indicators, attack patterns, and malware information. The log collection information may include network layer logs, endpoint layer logs, user authentication logs, threat information logs, etc.

FIG. 5 is a conceptual diagram illustrating the process in which threat intelligence generated in terminal A of the terminal security system of FIG. 4 is stored in the blockchain system and transmitted to the security solution server, and then a security solution is created in the security solution server.

Referring to FIG. 5, after the terminal A (200) generates the threat intelligence, the terminal A (200) connects with any one of the nodes (110) included in the blockchain system (100). By connecting, the threat intelligence can be transmitted to the corresponding node.

Subsequently, one of the nodes 110 that received the threat intelligence may generate a block containing the threat intelligence and transmit it to the nodes 110 to store it in blockchain form. As a result, the threat intelligence can be distributed and stored in the nodes 110 in blockchain form and safely protected from external intrusion.

Subsequently, the security solution server 400 may connect to any one of the nodes 110 and receive the threat intelligence from the corresponding node. At this time, the security solution server 400 may have the authority to connect to any one of the nodes 110 and receive the threat intelligence.

Subsequently, the security solution server 400 may create a security solution using the threat intelligence.

FIG. 6 is a conceptual diagram illustrating a process in which a security solution generated by a security solution server in the terminal security system of FIG. 4 is transmitted to terminal A.

Referring to FIG. 6, after the security solution server 400 creates the security solution, at least one terminal, including the terminal A (200), uses the security solution created by the security solution server 400. It can be provided from outside.

Specifically, for example, when the security solution server 400 connects to one of the nodes 110 and transmits the security solution to that node, the nodes 110 that received the security solution After one of the nodes generates a block containing the security solution, it can be transmitted to the nodes 110 and stored in blockchain form. Thereafter, at least one terminal, including terminal A (200), may receive the security solution from any one of the nodes (110). Alternatively, at least one terminal, including terminal A (200), may receive the security solution by directly accessing the security solution server (400).

Subsequently, at least one terminal, including the terminal A, can use the security solution to protect cyber assets from threats currently occurring.

In this embodiment, the cyber asset may include information stored in the terminal itself or a network system including the terminal itself, an operating system, network information, etc.

In this embodiment, the security solution may include a method for analyzing the threat intelligence to find vulnerabilities in cyber assets against the threat, thereby protecting the cyber self from the threat. Furthermore, the security solution analyzes the threat intelligence to first predict future threats that will occur in the future, finds vulnerabilities in the cyber assets against the threats and the future threats, and protects against the threats and the future threats. May include ways to protect cyber assets.

According to this embodiment, when threat intelligence generated in an arbitrary terminal is transmitted to the blockchain system 100 and stored in the nodes 110 in blockchain form, the security solution server 400 As the security solution is created by accessing the blockchain system 100 and receiving the threat intelligence, each of the terminals can safely protect the cyber assets from threats occurring to itself by receiving the security solution. there is.

Although the detailed description of the present invention described above has been described with reference to preferred embodiments of the present invention, those skilled in the art or those skilled in the art will understand the spirit of the present invention as described in the patent claims to be described later. It will be understood that the present invention can be modified and changed in various ways without departing from the technical scope.

100: Blockchain system 110: Node
200: Terminal A 300: Terminal B
400: Security solution server

Claims (20)

A blockchain system including a plurality of nodes; and
It includes at least one terminal A that generates threat intelligence using security threats and transmits the threat intelligence to any one of the nodes,
Any one of the nodes that received the threat intelligence,
A terminal security system characterized by generating a block containing the threat intelligence and then transmitting it to the nodes and storing it in blockchain form. According to paragraph 1,
A terminal security system further comprising at least one terminal B that receives the threat intelligence from any one of the nodes and generates a security solution using the threat intelligence. According to paragraph 2,
The terminal B is
A terminal security system, characterized in that it protects cyber assets from threats occurring in the terminal B using the security solution. According to paragraph 1,
A terminal security system further comprising a security solution server that receives the threat intelligence from any one of the nodes and generates a security solution using the threat intelligence. According to paragraph 4,
At least one terminal, including terminal A,
A terminal security system characterized in that the security solution generated by the security solution server is provided from an external source. According to clause 5,
The security solution server is,
transmitting the security solution to any one of the nodes,
Any one of the nodes that received the security solution,
After creating a block containing the security solution, it is sent to the nodes and stored in blockchain form,
At least one terminal, including terminal A,
A terminal security system, characterized in that the security solution is transmitted from any one of the nodes. According to clause 5,
At least one terminal, including terminal A,
A terminal security system that protects cyber assets from currently occurring threats using the security solution. According to any one of paragraphs 2 and 4,
The security solution is
A terminal security system comprising a method of analyzing the threat intelligence, finding vulnerabilities of cyber assets against the threats, and protecting the cyber itself from the threats. According to clause 8,
The security solution is
Including a method of analyzing the threat intelligence to first predict future threats that will occur in the future, finding vulnerabilities of the cyber assets to the threats and the future threats, and protecting the cyber assets from the threats and the future threats. A terminal security system characterized in that. According to paragraph 1,
The above threat intelligence is
Contains at least one of log collection information, infringement indicators, attack patterns, malware information, and history information about the threat,
The history information is a terminal security system characterized in that it includes at least one accumulated information among log collection information about previous threats, infringement indicators, attack patterns, and malware information. At least one terminal A generating threat intelligence using a security threat;
transmitting, by the terminal A, the threat intelligence to any one node among a plurality of nodes included in the blockchain system; and
A terminal security method comprising the step of having one of the nodes receiving the threat intelligence generate a block containing the threat intelligence and then transmitting the block to the nodes and storing it in blockchain form. According to clause 11,
At least one terminal B receiving the threat intelligence from any one of the nodes; and
A terminal security method further comprising the step of generating, by the terminal B, a security solution using the threat intelligence. According to clause 12,
Terminal security method further comprising the step of protecting cyber assets from threats occurring in terminal B, by terminal B, using the security solution. According to clause 11,
A security solution server receiving the threat intelligence from any one of the nodes; and
A terminal security method further comprising the step of generating, by the security solution server, a security solution using the threat intelligence. According to clause 14,
A terminal security method further comprising receiving, at least one terminal including the terminal A, the security solution generated by the security solution server from an external source. According to clause 15,
The step of receiving, by at least one terminal including the terminal A, the security solution from an external source,
transmitting, by the security solution server, the security solution to any one of the nodes;
One of the nodes receiving the security solution creates a block containing the security solution and then transmits the block to the nodes and stores it in blockchain form; and
A terminal security method comprising the step of receiving, by at least one terminal including the terminal A, the security solution from any one of the nodes. According to clause 15,
A terminal security method further comprising protecting cyber assets from currently occurring threats by using the security solution, at least one terminal including the terminal A. According to any one of claims 12 and 14,
The security solution is
A terminal security method comprising a method of analyzing the threat intelligence, finding vulnerabilities of cyber assets against the threats, and protecting the cyber itself from the threats. According to clause 18,
The security solution is
Including a method of analyzing the threat intelligence to first predict future threats that will occur in the future, finding vulnerabilities of the cyber assets to the threats and the future threats, and protecting the cyber assets from the threats and the future threats. A terminal security method characterized by: According to clause 11,
The above threat intelligence is
Contains at least one of log collection information, infringement indicators, attack patterns, malware information, and history information about the threat,
The history information includes at least one accumulated information of log collection information about previous threats, infringement indicators, attack patterns, and malware information.