WO2011062342A1

WO2011062342A1 - Method and apparatus for controlling a network by analyzing a personal computer network packet

Info

Publication number: WO2011062342A1
Application number: PCT/KR2010/003986
Authority: WO
Inventors: 김광태; 안영택
Original assignee: 주식회사 반딧불
Priority date: 2009-11-18
Filing date: 2010-06-21
Publication date: 2011-05-26
Also published as: KR101090630B1; KR20110054615A

Abstract

Provided are a method and apparatus for controlling a network by analyzing a personal computer network packet. The apparatus for controlling a network comprises: a monitoring unit, which monitors a network packet transmitted via a communication port connected to a personal computer; an analyzing unit, which analyzes the network pattern by comparing the network pattern with a packet pattern; and a connection control unit which controls the connection of the personal computer to a network in accordance with the result of the analysis. Accordingly, the apparatus for controlling a network analyzes the network packet transmitted from the personal computer, and allows or prevents the connection of the personal computer to a network.

Description

Network control method and device through network packet analysis of personal computer

Embodiments of the present invention relate to a network control method and apparatus through network packet analysis between personal computers.

With the development of IT technology, the corporate work environment has become a time when computers and networks are essential. Employees in the company access the corporate network through the personal computer (PC) provided to them, access the server program, perform tasks, and share data with colleagues. These changes in the environment have improved the ability to do business, and the technology is developing more and more.

In addition, as business performance is based on computers and networks, the security of data (critical information of the company) handled has become a social issue, and security devices have been developed. In recent years, technology for determining whether to access a work system (particularly, use of an internal corporate network) according to the safety of computers in an enterprise has been developed.

Accordingly, in one embodiment of the present invention to determine the security of the personal computer in the enterprise through the network packet, and to allow or isolate the network access to the enterprise in accordance with the determination result, the technology for easily controlling the network connection in the enterprise I would like to suggest.

One embodiment of the present invention provides a network control method and apparatus for controlling a network connection of a personal computer through network packet analysis transmitted from the personal computer.

According to an embodiment of the present invention, a network control apparatus includes a monitoring unit for monitoring a network packet transmitted through a communication port connected to a personal computer, an analysis unit for comparing and analyzing the network packet with a packet pattern, and according to the analysis result, And a connection controller for controlling a network connection with the personal computer.

In this case, the communication port is a mirror port that sniffs a network packet transmitted from the personal computer and delivers it to the monitoring unit, or a network packet sniffing a network packet transmitted from the personal computer using a promiscuous mode and delivers it to the monitoring unit. It may be one of the ports.

In this case, the network packet may include at least one of a source IP address, a source port number, a target IP address, or a target port number associated with an essential program. In this case, the analyzer may analyze whether the essential program is operated in the personal computer by comparing the network packet with the packet pattern.

In addition, the connection control unit, (1) when the required program is operated in the personal computer, the connection control unit allows the connection to the communication port connected to the personal computer to continue the network connection with the personal computer, or (2) If the required program does not operate in the personal computer, the connection to the communication port connected to the personal computer may be blocked to isolate the network connection with the personal computer.

In this case, the network control apparatus may further include a packet pattern storage for storing application information, communication protocol information, communication port information, and server address information as packet patterns.

In this case, the analyzer may compare the network packet with the packet pattern to analyze the safety of the network connection with the personal computer, and determine the weight for the analyzed safety. In this case, the connection controller (1) when the determined weight is high, allows the connection to the communication port connected to the personal computer to continue the network connection with the personal computer, or (2) the determined weight is low. In this case, the network connection with the personal computer can be isolated by blocking the connection to the communication port connected with the personal computer.

In addition, according to an embodiment of the present invention, a network control method includes receiving a network packet through a communication port connected to a personal computer, comparing and analyzing the received network packet with a packet pattern, and according to the analysis result, Controlling a network connection with the personal computer.

According to an embodiment of the present invention, the security of the personal computer may be determined through a network packet, and the intra-company network access may be easily controlled by allowing or isolating the intra-company network according to the determination result.

1 is a diagram illustrating an overall network connection relationship between a personal computer and a network control system according to an exemplary embodiment of the present invention.

2 is a diagram illustrating a configuration of a network control apparatus according to an embodiment of the present invention.

3 is a diagram showing fields of a communication protocol used in the packet pattern of the present invention.

4 is a diagram illustrating an example of a packet pattern according to an embodiment of the present invention.

5 is a flowchart illustrating a procedure of a network control method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited or limited by the embodiments. Like reference numerals in the drawings denote like elements.

Referring to FIG. 1, the network control system 100 may include a network switch device 110, a packet analysis device 120, a packet pattern storage 130, and a management console 140.

The network switch device 110 is connected to the

personal computers

150 and 160 through a communication port and monitors network packets transmitted from the

personal computers

150 and 160. The communication port is a mirror port that sniffs a network packet transmitted from the

personal computers

150 and 160 and delivers it to the network switch device 110, or is transmitted from the

personal computers

150 and 160 using a promiscuous mode. It may be any one of general ports that sniff network packets and deliver them to the network switch device 110.

The packet analysis device 120 compares and analyzes the network packet with a packet pattern. That is, the packet analysis apparatus 120 may analyze whether the essential program is operated in the

personal computer

150 or 160 by comparing the packet pattern stored in the packet pattern storage 130 with the network packet.

For example, the network packet may include at least one of a source IP address, a source port number, a target IP address, or a target port number associated with the essential program. The packet pattern may include at least one of application information, communication protocol information, communication port information, and server address information. In an embodiment, the packet pattern store 130 stores the packet pattern. In addition, the packet pattern manager may manage the packet pattern stored in the packet pattern storage 130. That is, the packet pattern manager may register, modify, or delete the packet pattern in the packet pattern storage 130.

The network switch controller may control a network connection with the

personal computers

150 and 160 according to the comparison analysis result. That is, the network switch controller may control the network switch device 110 to allow the connection with the personal computer 160 or block the connection with the personal computer 150 according to the comparison analysis result. In this case, the network switch controller may be configured as software that transmits a command to allow or block the connection with the

personal computers

150 and 160 to the network switch device 110.

In an embodiment, the network switch controller may be connected to the personal computer 160 by allowing access to a communication port connected to the personal computer 160 when the essential program operates in the personal computer 160 as a result of the analysis. Can continue. However, when the required program does not operate in the personal computer 150, the network switch controller may isolate the network connection with the personal computer 150 by blocking the connection to the communication port connected with the personal computer 150. .

In another embodiment, the packet analyzing apparatus 120 may compare the network packet with the packet pattern, analyze the safety of the network connection with the personal computer, and determine a weight for the analyzed safety. In this case, when the determined weight is high, the network switch controller may allow a connection to a communication port connected to the personal computer 160 to continue a network connection with the personal computer 160. However, when the determined weight is low, the network switch controller may isolate the network connection with the personal computer 150 by blocking the connection to the communication port connected with the personal computer 150.

In addition, the management console 140 manages the state of the network switch device 110, and monitors the analysis status in real time. In addition, the management console 140 may register, modify, or delete a packet pattern to be managed in the packet pattern storage 130.

2, the network control apparatus 200 may include a monitoring unit 210, a

communication port

211 and 212, an analysis unit 220, a packet pattern storage 230, and a connection control unit 240. have.

The monitoring unit 210 monitors network packets transmitted through

communication ports

211 and 212 connected to personal computers (first and second personal computers in the drawing).

In this case, the

communication ports

211 and 212 may be 'mirror ports' which sniff network packets transmitted from the personal computer and deliver them to the monitoring unit 210. The mirror port is a port for transmitting a copy of all transmitted network packets to the monitoring unit 210.

Alternatively, the

communication ports

211 and 212 may be one of 'general ports' that sniff network packets transmitted from the personal computer and transmit them to the monitoring unit 210 using a promiscuous mode. The promiscuous mode is a mode for performing the same role as the mirror port when the mirror port is not present, and may sniff all network traffic of each communication port.

The analyzer 220 compares and analyzes the network packet and the packet pattern. Here, the network packet may include at least one of a source IP address, a source port number, a target IP address, or a target port number associated with an essential program.

In general, a communication packet on a network is composed of packets in the form of Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) based on an Internet Protocol (IP) packet. That is, a route is formed using a source IP address and a target IP address of an IP packet, and data is transmitted using TCP or UDP. In particular, TCP or UDP designates a network session of a host to form a communication session. In other words, every application system using IP communication has a unique source IP address and destination IP address, and a source port and a destination port.

Therefore, in order to provide a secure personal computer environment in the enterprise, antivirus products, media control products, and other essential programs for accessing PC security and work systems must be installed on the personal computer. Such a system is manufactured in the form of a communication program of a server / client structure so that it can be centrally controlled, and each program is connected to each server using a specific server address and communication port at the same time. In addition, such a program is composed of a TCP-based communication program.

In conclusion, the operation of essential programs installed in the personal computer attempts to connect to a specific server, which is delivered in the form of packets on the network, and uses the transmitted packets to control whether the essential programs are running on the personal computer. In the device 200, the network packet may be simply identified using the contents of the network packet (source IP address, source port number, target IP address, and target port number).

Accordingly, the analyzer 220 may analyze whether the essential program is operated in the personal computer by comparing the network packet with the packet pattern.

3 is a diagram illustrating fields of a communication protocol used in the packet pattern of the present invention. That is, FIG. 3 is a color-coded part used for pattern analysis in communication protocols (IP, TCP, UDP).

Referring to FIG. 3, the analyzer 220 may compare and analyze portions of different colors among the IP header 310, the TCP header 320, and the UDP header 330 included in the network packet. For example, the analyzer 220 may include a protocol, a source address, a destination address portion of the IP header 310, a source port and a destination port portion of the TCP header 320, and CWR, ECE, URG, ACK, PSH, RST, Packet flag information such as SYN and FIN, source port, destination port, and data portion of the UDP header 330 are extracted from the network packet and compared with the packet pattern stored in the packet pattern storage 230, thereby making it mandatory on the personal computer. You can determine whether the program is running.

Accordingly, as a result of the analysis, when the essential program is operated in the personal computer, the connection controller 240 may allow the connection to the communication port connected to the personal computer to continue the network connection with the personal computer. . However, as a result of the analysis, when the required program does not operate in the personal computer, the connection controller 240 may isolate the network connection with the personal computer by blocking the connection to the communication port connected to the personal computer. . That is, the connection controller 240 may control the monitoring unit 210 to allow or block the connection between the

communication ports

211 and 212 and the personal computer so as to isolate the insecure personal computer from making a network connection. .

Referring to FIG. 4, the packet pattern store 230 stores at least one of application information, communication protocol information, communication port information, and server address information as the packet pattern. The application information is a name (antivirus), version (5.5) for the required program, and the communication protocol is a protocol name used by the required program, such as TCP, UDP, or IP. The communication port information is a communication port number (1010 ~ 1050) that the essential program is used to connect to the server, the server address information is an IP address (192.168.2.1 ~ 192.168.2.10) for the server in the enterprise. In addition, the packet pattern storage 230 may store application-specific packet samples or other additional information.

In an embodiment, the analyzer 220 may compare the network packet with the packet pattern to analyze the safety of the network connection with the personal computer and determine a weight for the analyzed safety. For example, the analysis unit 220 compares a network packet with a packet pattern, and when the version of the required program running on the personal computer is low, determines the weight to be low, and when the version of the required program running on the personal computer is high The weight can be determined high.

In this case, the connection controller (1) when the determined weight is high, allows the connection to the communication port connected to the personal computer to continue the network connection with the personal computer, or (2) when the determined weight is low. The network connection with the personal computer can be isolated by blocking the connection to the communication port connected with the personal computer.

The network control method receives a network packet through a communication port connected to a personal computer (510). At this time, the communication port is a 'mirror port' that delivers a copy of all network packets transmitted from the personal computer, or when there is no mirror port, it uses a promiscuous mode to perform the same role as the mirror port. It may be one of the 'general port' to sniff the network packet transmitted from the personal computer.

The network control method compares and analyzes the received network packet with a packet pattern (520). Here, the network packet may include at least one of a source IP address, a source port number, a target IP address, or a target port number associated with an essential program. In this case, the network control method may analyze whether the essential program is operated in the personal computer by comparing the network packet with the packet pattern.

The network control method controls the network connection with the personal computer by determining whether the analysis result satisfies the safety of the company (530). As a result of the determination, the network control method may perform step 540 when it is satisfied, and may perform step 550 when it is not satisfied.

For example, the network control method may continue network connection with the personal computer by allowing access to a communication port connected to the personal computer when the required program is operated in the personal computer as a result of the analysis (540). ).

However, as a result of the analysis, when the required program does not operate in the personal computer, the network control method may isolate the network connection with the personal computer by cutting off the connection to the communication port connected with the personal computer (550). ).

In an embodiment, the packet pattern store 230 stores at least one of application information, communication protocol information, communication port information, and server address information as the packet pattern. In this case, the network control method is an analysis method of step 520, which compares the network packet with the packet pattern, analyzes the safety of the network connection with the personal computer, and determines the weight for the analyzed safety. As a result of the analysis, the network control method may determine whether the security of the enterprise is satisfied (530). Therefore, when the determined weight is high, the network control method may allow connection to the communication port connected to the personal computer and continue the network connection with the personal computer (540). However, when the determined weight is low, the network control method may isolate the network connection with the personal computer by cutting off the connection to the communication port connected with the personal computer (550).

Finally, when the network connection in the enterprise is normally used, the network control method may terminate the network control apparatus 200 performing the network control method (560).

In addition, embodiments of the present invention include computer-readable media containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions. Therefore, the spirit of the present invention should not be limited to the described embodiments, and all of the equivalents or equivalents of the claims as well as the claims to be described later belong to the scope of the present invention.

Claims

A monitoring unit for monitoring a network packet transmitted through a communication port connected to a personal computer;

An analysis unit comparing the network packet with a set packet pattern and analyzing the network packet; And

A connection controller for controlling a network connection with the personal computer according to the analysis result

Network control device comprising a.
The method of claim 1,

The communication port,

Or a mirror port that sniffs a network packet transmitted from the personal computer and delivers it to a monitoring unit,

And a general port that sniffs a network packet transmitted from the personal computer using a promiscuous mode and delivers it to the monitoring unit.
The method of claim 1,

The network packet,

And at least one of a source IP address, a source port number, a target IP address, or a target port number associated with the required program.
The method of claim 1,

The analysis unit,

And comparing the network packet with the packet pattern to analyze whether a required program is operated in the personal computer.
The method of claim 4, wherein

The connection control unit,

If it is determined that the essential program is operated in the personal computer, the connection to the communication port connected with the personal computer is allowed to continue the network connection with the personal computer,

And if it is determined that the required program does not operate in the personal computer, the network control device is isolated by disconnecting a connection to a communication port connected with the personal computer.
The method of claim 1,

A packet pattern store for storing at least one of application information, communication protocol information, communication port information, and server address information as the packet pattern.

Further comprising a network control device.
The method of claim 1,

The analysis unit,

And comparing the network packet with the packet pattern to analyze a weight value according to a security level for a network connection with the personal computer.
The method of claim 7, wherein

The connection control unit,

If the weight is analyzed to be high, the connection to the communication port connected with the personal computer is allowed to continue the network connection with the personal computer,

And if it is determined that the weight is low, the network control device to isolate the network connection with the personal computer by blocking the connection to the communication port connected with the personal computer.
Receiving a network packet through a communication port connected to a personal computer;

Comparing the received network packet with a set packet pattern and analyzing the received network packet; And

Controlling a network connection with the personal computer according to the analysis result

Network control method comprising a.
The method of claim 9,

Receiving the network packet,

Sniffing and receiving the network packet through a mirror port connected to the personal computer; or

Sniffing and receiving the network packet through a general port connected to the personal computer using a promiscuous mode

Network control method comprising a.
The method of claim 9,

The network packet,

At least one of a source IP address, a source port number, a target IP address or a target port number associated with the required program,

The analyzing by comparing with the packet pattern,

Comparing the network packet with the packet pattern to analyze whether the essential program is operated in the personal computer;

Network control method comprising a.
The method of claim 11,

Controlling the network connection with the personal computer,

If it is determined that the essential program is running in the personal computer, allowing a connection to a communication port connected with the personal computer to maintain a network connection with the personal computer; or

If it is determined that the essential program does not operate on the personal computer, isolating a connection to a communication port connected to the personal computer to isolate a network connection with the personal computer;

Network control method comprising a.
The method of claim 9,

Storing at least one of application information, communication protocol information, communication port information, and server address information as a packet pattern in a packet pattern storage;

The network control method further comprising.
The method of claim 9,

The analyzing by comparing with the packet pattern,

Comparing the network packet with the packet pattern and analyzing a weight value according to a security level for a network connection with the personal computer

Network control method comprising a.
The method of claim 14,

Controlling the network connection with the personal computer,

If it is determined that the weight is high, allowing a connection to a communication port connected to the personal computer to maintain a network connection with the personal computer; or

If the weight is analyzed to be low, isolating a connection to a communication port connected to the personal computer to isolate a network connection with the personal computer;

Network control method comprising a.