KR20230159110A - Data transmitting method via gateway relaying - Google Patents

Abstract

The present invention includes the steps of (A) a user terminal transmitting service request data to a forward gateway to request a service from a service server; (B) a user authentication step to determine whether the user is eligible to use the service; (C) encoding the service request data to correspond to a dedicated protocol; (D) the forward gateway transmitting encoded data to the rear gateway; (E) the rear gateway decoding the encoded data and requesting a service from the service server; and (F) the rear gateway relaying the service provision data provided from the service server and providing the service provision data to the user terminal through the forward gateway. The present invention relates to a data transmission method through gateway relay, comprising: has the effect of transmitting data without exposing the address of the service server.

Description

Data transmission method through gateway relay{DATA TRANSMITTING METHOD VIA GATEWAY RELAYING}

The present invention relates to a data transmission method through gateway relay, and more specifically, by relaying data between a user and a server through an intermediate gateway (GateWay) and processing the data by separating the data channel and the control channel, It concerns a data transmission method that prevents information exposure and transmits data safely.

Due to the recent development of information and communication technology, the development of information provision technology that provides information on various fields in real time to a large number of subscribers through at least one service provision server through a data communication network is actively underway.

Meanwhile, when a user accesses the service providing server using a computer terminal and wishes to exchange communications, the service providing server is a server to be protected, and information security technology is actively being developed to which a security system protected by a security server is applied. Is in progress.

Additionally, for safe access to in-house information servers used by companies or financial institutions, permissions must be restricted in detail by user, task, or role, and loop around connections must be blocked.

In general, when a user requests a connection using a specific protocol such as SSH (secure shell), TELNET, or RDP (remote desktop protocol), the connection port for that protocol is usually statically determined, and the connection is made through that connection port.

However, when connecting to this normal default port, there is a problem in that it is vulnerable to hacking through port scanning or scanning using PING.

In particular, after connecting to a predetermined service server among a plurality of service servers, there has been a problem that a bypass connection is possible from the predetermined service server to another service server.

Patent Document 1: Republic of Korea Patent Publication No. 10-0951716 (2010.03.31) Patent Document 2: Republic of Korea Patent Publication No. 10-1513195 (2015.04.17)

The present invention is intended to solve the problems of the prior art as described above. The purpose of the present invention is to provide a data transmission method that can safely transmit data while blocking access to the internal server from the outside and preventing information exposure of the server. This is what we want to provide.

Another purpose of the present invention is to provide a data transmission method that operates regardless of security equipment such as existing firewalls and VPNs and that does not allow bypass access from a given service server to another service server. .

One aspect of the present invention for achieving the above object is a front gateway that performs a connection and authentication function with a user terminal and a back gateway that performs a connection function with a service server. ) A method of transmitting data between a user terminal and a service server through the relay of a gateway including (A) the user terminal transmits service request data to the forward gateway to provide a service to the service server requesting step; (B) a user authentication step in which the forward gateway determines whether the user who requested the service is eligible to use the service; (C) When the user's service use eligibility is verified, encoding the service request data at the forward gateway to correspond to a dedicated protocol; (D) the forward gateway transmitting the encoded data to the rear gateway; (E) the rear gateway decoding the encoded data and requesting a service from the service server; and (F) the rear gateway relaying the service provision data provided by the service server and providing the service provision data to the user terminal through the forward gateway. will be.

In the data transmission method through gateway relay according to an embodiment of the present invention, the service request data and the service provision data are respectively divided into control data and information data according to the execution function of the data, and the control data is controlled It is transmitted through a channel, and the information data may be transmitted separately through the information channel.

Additionally, the control data may include data on connection state settings between the user terminal and the service server, data including service server operating state information, and data on data transmission blocking and data inspection.

In addition, the information data may be composed of data containing the contents of the service request of the user terminal and data containing the contents of the service provided by the service server.

In addition, the forward gateway includes an encoder for encryption of transmitted data, and the rear gateway includes a decoder for decoding received data, and a circuit for generating the control channel and transmitting and receiving the control data through the control channel. It may be comprised of a circuit breaker.

Additionally, the circuit breaker may create the control channel connected to the front gateway through the rear gateway and control access to the control channel.

Additionally, the circuit breaker may check the status of the service server and transmit status information of the service server to the forward gateway through the control channel.

Additionally, data transmission between the forward gateway and the rear gateway may be performed through a unique channel created for each user.

Additionally, the service request data includes user information, which is information about a user using the user terminal; Device information that is unique information of the user terminal itself; It may be configured to include server connection information, which is information about connection to the service server.

Additionally, the user authentication is performed based on a user network profile, and the user network profile includes user authentication information (AuthToken) that proves that the user is an authenticated user; Device authentication information (DeviceToken) that proves that the user terminal is an authenticated device; It may be configured to include server access authentication information (AccessToken) that proves that the user is a user authorized to access the server.

Additionally, the user authentication information (AuthToken) may be generated by coding using the user ID, access time, and unique value for each user.

Additionally, the device authentication information (DeviceToken) may be generated by coding using the device's unique ID.

Additionally, the server access authentication information (AccessToken) may be generated by coding using the service ID, user information, authentication time, and unique key for each service server.

In addition, the server connection authentication information may include an expiration time (ExpireDate), which is information about the effective time of server connection.

Additionally, the expiration time may be set to be shorter depending on the security level of the service server, as the security level increases.

Additionally, the user network profile may include validity information indicating whether the user network profile is valid.

Additionally, the validity information may be session information indicating a connection session.

In addition, the validity information includes a limited data amount so that the access control server can discard the user network profile when a preset data capacity is provided according to the amount of data provided by the gateway to the user terminal. It may be composed.

Additionally, the server connection port of the rear gateway may be created as a dynamic port and updated and set each time the rear gateway connects to the server.

Additionally, the user terminal connection port of the forward gateway may be created as a dynamic port and updated and set each time the forward gateway connects to the user terminal.

The data transmission method through gateway relay according to the present invention exchanges data through a gateway between a user using the service and a server providing the service. Since only gateway information is provided to the user, server information about the service being used This is effective in protecting against hacking as they are not exposed to users.

In addition, according to the present invention, data is processed by separating data channels and control channels, and information is encrypted using a dedicated protocol, thereby completely blocking access to the service server from the outside.

In particular, according to the present invention, by checking the status of servers during a circuit break and when a problem occurs in the server, information on the server in question is provided to the forward gateway through a control channel, thereby more effectively preventing exposure of server information. It works.

In addition, according to the present invention, the user network profile, which is the basis for authenticating the user's service use authority, is dynamically configured and reflected in real time, thereby reflecting the real-time security policy, which has the effect of more effectively protecting server information.

In addition, according to the present invention, through the use of user network profiles that are differently created depending on conditions (time, session), even if information is exposed, it cannot be used after a period of time, which has the effect of safely protecting server information.

1 is a block diagram of a system implementing a data transmission method through gateway relay according to the present invention.
Figure 2 is a block diagram showing the procedure for transmitting data by the system of the present invention for each device.
Figure 3 is a configuration diagram of a user network profile according to the present invention.
Figure 4 is a block diagram showing the flow of data through a control channel according to the present invention.

Since the present invention can be modified in various ways and have various implementation examples, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all transformations, equivalents, and substitutes included in the spirit and technical scope of the present invention. In describing the present invention, if it is determined that a detailed description of related known technologies may obscure the gist of the present invention, the detailed description will be omitted.

Terms such as first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

The present invention relays data between a user and a server through an intermediate gateway (GateWay), and processes the data by separating the data channel and the control channel, thereby preventing information exposure of the server and safely transmitting data through the gateway relay. It is about data transmission method.

Hereinafter, the reverse network access system using a dynamic port of the present invention will be described in more detail with reference to a preferred implementation example and the accompanying drawings. In this regard, Figure 1 is a block diagram of a system executing the data transmission method through gateway relay according to the present invention, and Figure 2 shows the sequence of the data transmission method by the system of the present invention for each device. It is a block diagram, Figure 3 is a configuration diagram of a user network profile according to the present invention, and Figure 4 is a block diagram showing the flow of data through a control channel according to the invention.

First, referring to Figure 1, the data transmission method through gateway relay of the present invention includes a user terminal 100, a gateway 200, a service server 300, a user management server 400, and a database ( It can be executed by a data transmission system including 500).

The user terminal 100 is a device for a user to use a service provided from a server by requesting a service from the gateway 200. Examples of the user terminal 100 include, but are not limited to, a personal computer (PC) or a mobile phone, and may include various communication devices that can be connected to the service operator's server through a wired/wireless communication network.

The gateway 200 excludes direct connection between the user terminal 100 and the server 300, preventing information about the server 300 from being directly exposed to the user, and transmits data provided from the server 300 to the user terminal. This is to perform the function of relaying to (100).

In the present invention, the gateway 200 includes a front gateway 210 (Front Access Gateway) that performs a connection and authentication function with the user terminal 100 and a rear gateway 220 that performs a connection function with the server. Back Access Gateway), where the front gateway 210 is configured to include an encoder 211, and the rear gateway 220 is configured to include a decoder 221 and a circuit breaker 700. However, their detailed functions will be explained in more detail later.

The service server 300 is a server for providing services that users want to use, and may be configured to collectively include a number of servers requiring security according to the type of service used by the user.

The user management server 400 (API/Management Server) is a server connected to the gateway 200 and the database 500 to manage information about users, and creates and changes a user network profile 600, which will be described later. It performs functions and manages the data required for them.

The database 500 performs the function of storing and updating various data necessary to provide the service of the present invention and providing the information to the user management server 400.

The data transmission method through gateway relay according to the present invention separates the data transmission channel into two channels, a control channel (B) and an information channel (A), in processing data, thereby processing the data from the outside through the control channel. One of the technical features of the invention is that access to (B) can be restricted and server security can be further strengthened.

That is, according to the present invention, the data processed in the present invention is divided into control data and information data according to the execution function of the data, and the control data is transmitted through the control channel (B), and the information data is transmitted through the information channel (A). Each is transmitted separately.

At this time, the control data includes data on the connection state settings between the user terminal 100 and the service server 300, data including information on the operation status of the service server 300, and data on data transmission blocking and data inspection. It can be configured as follows.

Additionally, the information data may include data containing the service request contents of the user terminal 100 and data containing the service contents provided by the service server 300.

Accordingly, according to the present invention, data on general information contents between the user terminal 100 and the service server 300 are transmitted through the information channel (A), and the data between the user terminal 100 and the service server 300 are transmitted through the information channel (A). By transmitting data related to connection through the control channel (B), it is possible to prevent information about the service server 300 from being leaked to the outside.

Hereinafter, the data transmission method through gateway relay according to the present invention will be described in more detail with reference to FIGS. 2 to 4.

First, the user requests a service from the service server 300 by transmitting service request data to the forward gateway 210 using the user terminal 100 (S110). Next, the forward gateway 210 performs user authentication (S211, S212) to determine whether the user who requested the service is eligible to use the service.

Here, the service request data includes user information, which is personal information about the individual user using the user terminal 100, device information, which is unique information about the user terminal 100 device itself, and information about connection to the service server. Information may include server connection information.

The user information may include, for example, information such as the user's name, affiliation, and position. The device information may include a device unique ID. Additionally, the server connection information may include the contents of the service the user wishes to use.

The forward gateway 210, which has received the service request data as described above, authenticates whether the user is legitimately entitled to use the service based on the user network profile 600.

Here, the user network profile 600 includes user authentication information (AuthToken, 610) that proves that the user is an authenticated user, and device authentication information (DeviceToken, 620) that proves that the user terminal 100 is an authenticated device. , It may be configured to include server access authentication information (AccessToken, 630) that proves that the user is a user authorized to access the server.

At this time, the user authentication information (AuthToken, 610) is coded using the user ID, access time, and unique value for each user and is generated in an encrypted form.

In addition, the device authentication information (DeviceToken, 620) is created in an encrypted form using CPU Id, HDD Id, MAC Address, etc. for PCs, and in encrypted form using the device's unique ID for other devices. It is created with

In addition, the server access authentication information (AccessToken, 630) is coded using the service ID, user information, authentication time, and unique key for each service server and is generated in an encrypted form.

Accordingly, according to the present invention, information about users, servers, and terminals is transmitted and received in encrypted form, and access is only possible when an authenticated user (AuthToken) has access rights (AccessToken) to the server from an authenticated device (DeviceToken). Because this is possible, it is possible to fundamentally block users who are not eligible to use the service from accessing the server.

When the user's service use eligibility is verified as described above, the encoder 211 of the forward gateway 210 encodes the service request data to correspond to the dedicated protocol (S213), and the forward gateway 210 encodes the encoded data. Data is transmitted to the rear gateway 220 (S214).

Subsequently, the rear gateway 220 decodes the encoded data by the decoder 221 (S221, S222) and requests a service from the service server 300 (S223), which is provided by the service server 300. The rear gateway 220 relays the service provision data and provides it to the user terminal 100 through the front gateway 210.

At this time, according to the present invention, data transmission between the front gateway 210 and the rear gateway 220 is performed through a unique channel created for each user.

Accordingly, the invention has the effect of completely blocking access to the service server from the outside by encrypting information using a dedicated protocol and creating an independent channel for each user to transmit all data related to the user.

In addition, the circuit breaker 700 of the rear gateway 220 creates a control channel (B) connected to the front gateway 210 through the rear gateway 220 and controls access to the control channel (B). can do.

Additionally, the circuit breaker 700 may check the status of the service server 300 and transmit status information of the service server 300 to the forward gateway 210 through the control channel (B).

That is, the circuit breaker 700 checks the status of the servers and, if a problem occurs with the server, provides status information about the problem server to the forward gateway 210 through the control channel (B), When a request is made by the user terminal 100, the forward gateway 210 checks the status of the server and generates a response.

Here, the status information of the server may include the operating status of the server, for example, whether a failure such as inability to connect has occurred, and information about the risk of overloading the server due to an excessive amount of data.

If this is explained with reference to FIG. 4, the circuit breaker 700, which has received server status information and transmission/reception data from the service server 300 (S220a, S220c), determines that the information is the access restriction requirement (S220b) and the data restriction requirement (S220b). If S220d) is satisfied, the access restriction target is selected (S220e), a connection restriction command is transmitted to the forward gateway 210 (S220f), and the forward gateway 210, which has received the access restriction command (S210a), is connected. The restriction is implemented (S210b).

Meanwhile, according to the present invention, the forward gateway 210 can create a connection port for connecting to the user terminal 100 as a dynamic port. Here, the dynamic port may be updated and set each time the forward gateway 210 connects to the user terminal 100.

Additionally, the rear gateway 220 can create a connection port for connecting to the service server 300 as a dynamic port. Here, the dynamic port may be updated and set each time the rear gateway 220 connects to the service server 300.

Accordingly, according to the present invention, a separate dynamic port is used each time the front gateway 210 and the user terminal 100 and the rear gateway 220 and the service server 300 are connected, preventing hacking of the gateway 200. and information leakage can be blocked and safely protected.

According to one implementation of the present invention, the server connection authentication information 630 of the user network profile 600 may be configured to include an expiration time (ExpireDate), which is information about the effective time of server connection.

As a result, the service is used for the allowed time through control of the expiration time and is continuously changed, so even if the information is exposed, only temporary use is possible.

In particular, according to this implementation, the expiration time may be set to be shorter according to the security level of the service server, as the security level is higher. For example, when using a service by connecting to a server where confidentiality is important, the service usage time is set short and the user authentication process is performed frequently, thereby minimizing information leakage to the service server where security is important.

According to another implementation of the present invention, the user network profile 600 may be configured to include validity information indicating whether the user network profile is valid.

At this time, the validity information may be session information indicating a connection session. For example, the session information may be newly set and updated each time the user accesses the gateway 200.

In addition, the validity information is limited data so that the gateway 200 can discard the corresponding user network profile when a preset data capacity is provided according to the amount of data provided by the gateway 200 to the user terminal 100. It can be configured including quantity. In other words, after the user receives certain data, the connection is interrupted and the connection can be continued only when the user newly enters authentication request information.

Accordingly, according to the present invention, access to the server is controlled using a user network profile that is created differently depending on conditions (time, data amount, session), so even if the server information is exposed, the set conditions, that is, the set time or data amount, are controlled. Alternatively, when the session elapses, access to the server becomes impossible, so continuous use becomes impossible even if server information is temporarily exposed.

Although the preferred embodiments of the present invention have been described above, those skilled in the art can add, change, delete or add components without departing from the spirit of the present invention as set forth in the patent claims. The present invention may be modified and changed in various ways, and this will also be included within the scope of rights of the present invention.

For example, each component described as unitary may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form. The scope of the present invention is indicated by the claims described below rather than the detailed description above, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. do.

The present invention provides a data transmission method that prevents information exposure of the server and transmits data safely by relaying data between the user and the server through an intermediate gateway and processing the data by separating the data channel and the control channel. Regarding this, according to the present invention, server information about the service being used is not exposed to the user, which has the effect of protecting against hacking.

100: user terminal 200: gateway
210: Front gateway 211: Encoder
220: rear gateway 300: service server
400: User management server 500: Database
600: User network profile 610: User authentication information
620: Device authentication information 630: Server connection authentication information
700: Circuit Breaker
A: Information channel
B: control channel

Claims (18)

The user terminal and the service through the relay of the gateway, which includes the front access gateway that performs the connection and authentication function with the user terminal and the back access gateway that performs the connection function with the service server. As a method of transmitting data between servers,
(A) the user terminal transmitting service request data to the forward gateway to request a service from the service server;
(B) a user authentication step in which the forward gateway determines whether the user who requested the service is eligible to use the service;
(C) when the user's service usage eligibility is verified, encoding the service request data at the forward gateway to correspond to a dedicated protocol;
(D) the forward gateway transmitting the encoded data to the rear gateway;
(E) the rear gateway decoding the encoded data and requesting a service from the service server; and
(F) a step of the rear gateway relaying the service provision data provided by the service server and providing the service provision data to the user terminal through the forward gateway.
According to paragraph 1,
The service request data and the service provision data are respectively divided into control data and information data depending on the execution function of the data,
A data transmission method through a gateway relay, characterized in that the control data is transmitted through a control channel, and the information data is transmitted separately through an information channel.
According to paragraph 2,
The control data is,
A data transmission method through a gateway relay, characterized in that it includes data on connection state settings between a user terminal and a service server, data including service server operation state information, and data on data transmission blocking and data inspection.
According to paragraph 3,
The information data is,
A data transmission method through a gateway relay, characterized in that it includes data containing the service request contents of the user terminal and data containing the service contents provided by the service server.
According to clause 3 or 4,
The forward gateway is configured to include an encoder for encryption of transmission data,
The rear gateway is configured to include a decoder for decoding received data, and a circuit breaker for generating the control channel and transmitting and receiving the control data through the control channel. method.
According to clause 5,
The circuit breaker is,
A data transmission method through gateway relay, characterized in that the control channel connected to the front gateway is created through the rear gateway, and access to the control channel is controlled.
According to clause 6,
The circuit breaker is,
A data transmission method through gateway relay, characterized in that the status of the service server is checked and the status information of the service server is transmitted to the forward gateway through the control channel.
In clause 7,
Data transmission between the front gateway and the rear gateway is,
A data transmission method through gateway relay, characterized in that it is performed through a unique channel created for each user.
According to clause 8,
The service request data is,
User information, which is information about the user using the user terminal;
Device information that is unique information of the user terminal itself;
A data transmission method through a gateway relay, comprising: server connection information, which is information regarding connection to the service server.
According to clause 8,
The user authentication is performed based on the user network profile,
The user network profile is,
User authentication information (AuthToken) that proves that the user is an authenticated user;
Device authentication information (DeviceToken) that proves that the user terminal is an authenticated device;
A data transmission method through a gateway relay, comprising: server access authentication information (AccessToken) that proves that the user is a user authorized to access the server.
According to clause 10,
The user authentication information (AuthToken) is,
A method of transmitting data through a gateway relay, characterized in that it is coded and generated using user ID, access time, and unique values for each user.
According to clause 10,
The device authentication information (DeviceToken) is,
A data transmission method through gateway relay, characterized in that it is coded and generated using the device's unique ID.
According to clause 10,
The server access authentication information (AccessToken) is,
A data transmission method through gateway relay, characterized in that it is coded and generated using service ID, user information, authentication time, and unique key for each service server.
According to clause 13,
The server connection authentication information is,
A data transmission method through a gateway relay, characterized in that it includes an expiration time (ExpireDate), which is information about the effective time of server connection.
According to clause 10,
The user network profile is,
A data transmission method through a gateway relay, characterized in that validity information indicating whether the user network profile is valid is included.
According to clause 15,
The validity information is,
A data transmission method through a gateway relay, characterized as session information indicating an access session.
According to clause 8,
The server connection port of the rear gateway is created as a dynamic port,
A data transmission method through a gateway relay, characterized in that the setting is updated each time the rear gateway connects to the server.
According to clause 8,
The user terminal access port of the forward gateway is created as a dynamic port,
A data transmission method through a gateway relay, characterized in that the data transmission method is updated and set every time the forward gateway connects to the user terminal.

Images