WO2015088133A1

WO2015088133A1 - Security apparatus for selectively performing security check and operating method therefor

Info

Publication number: WO2015088133A1
Application number: PCT/KR2014/009797
Authority: WO
Inventors: 홍기훈
Original assignee: 주식회사 시큐아이
Priority date: 2013-12-09
Filing date: 2014-10-17
Publication date: 2015-06-18
Also published as: KR20150066686A

Abstract

A security apparatus according to an embodiment of the present invention comprises: a table management unit that determines a classification group corresponding to a URL of a request packet by receiving, from a web classification database, classification information on the URL of the request packet, and stores a mapping relation between the URL of the request packet and the classification group; and a search engine that returns the classification group when a response packet of a session identical to a session of the request packet is received. Also, whether a security check is performed on the response packet is determined according to the classification group, for which a search has been made.

Description

Security device that selectively performs security check and method of operation thereof

The present invention relates to an electronic device, and more particularly, to a security device for selectively performing a security check and a method of operating the same.

Web services have exploded with the development of Internet network technology, making it the infrastructure of information that almost everyone using the Internet retrieves and collects information through. However, its widespread use makes Web services a major route for most attacks, such as viruses, malware and vulnerability attacks. In particular, most viruses, malware, and vulnerability attacks spread through specific categories of sites. For example, viruses, malware, and vulnerability attacks can be spread through gambling, adult sites, and the like, which are interesting to people.

A security device is a device that inspects the traffic of a web service at the network entry. For example, Unified Threat Management (UTM) performs a variety of security scan functions, including intrusion prevention system (IPS) scans, virus scans, and malware scans, to scan for viruses or malware, and block and allow packets based on the scan results. can do.

However, the web service is an immediate response service that a user terminal requests a specific service from a web server and waits for a response. When a security check is performed on all contents, a large delay takes time and the real-time of the web service is impaired. This may cause inconvenience to web services.

In other words, the security check requires a variety of checks, including HTTP protocol error checks, IPS checks, virus checks, and malware checks on packets. It is difficult to guarantee the immediate response characteristics while performing such checks on packets for all web services.

If a security check is performed on packets corresponding to all sites, it consumes too many resources of the security equipment and increases the response time of the web service provided by each site.

If a security check is performed on packets corresponding to sites where a virus is found by referring to the list of sites collected by various vaccines, the list is limited and the initial response to the new site causing the virus is limited. This is a difficult drawback.

The present invention is to solve the above problems, and to improve the reliability and operation speed of the security check.

According to an aspect of the present invention, there is provided a security apparatus including a receiving unit receiving a request packet transmitted from a user terminal to a web server, and a response packet transmitted from the web server to the user terminal; Receiving classification information on the URL of the request packet from a web classification database to determine the classification group corresponding to the URL of the request packet, and to update the mapping relationship between the URL of the request packet and the classification group in a classification table. A table management unit configured; And a search engine configured to search for the classification group in the classification table when the response packet of the same session as the request packet is received. The classification group determines whether to perform a security check on the response packet.

In an embodiment, the security device may further include a controller for requesting the classification information by transmitting the URL of the request packet to the web classification database when the request packet is received.

In an embodiment, the receiver may receive the classification information from the web classification database through the network and provide the received classification information to the table manager.

In an embodiment, the table manager may map the URL of the request packet to a first classification group or the URL of the request packet to a second classification group according to the classification information.

In an embodiment, the security device may further include a packet buffer connected to the receiver and configured to temporarily store the request packet and the response packet transmitted through the receiver.

In an embodiment, the security device may further include a URL extractor configured to extract a URL of the request packet stored in the packet buffer.

In an embodiment, the URL extractor may provide the extracted URL of the request packet to the table manager.

In an embodiment, the search engine may search the classification group in the classification table according to the URL of the request packet, which is the same session as the response packet when the response packet is received.

In an embodiment, the security apparatus may further include: a security processor configured to selectively perform a security check on the response packet according to the classification group searched by the search engine; And a transmitter configured to transmit the response packet to the outside according to a result of the security check.

Another aspect of the present invention relates to a method of operating a security device connected to a user terminal communicating with a web server via a network. An operating method of a security device according to an embodiment of the present invention includes the steps of receiving a request packet transmitted from the user terminal to the web server; Receiving classification information for the URL of the request packet from a web classification database via the network; Determining a classification group to which the URL of the request packet belongs according to the classification information, and updating a mapping relationship between the URL of the request packet and the classification group in a classification table; Receiving a response packet of the same session as the request packet transmitted from the web server to the user terminal according to the request packet; Searching for the classification group in the classification table; And determining whether to perform a security check on the response packet according to the classification group.

In an embodiment, the method may further include extracting a URL from the request packet when the request packet is received.

In an embodiment, the method may further include requesting the classification information by transmitting the extracted URL of the request packet to the web classification database.

In an embodiment, the searching may include detecting the request packet of the same session as the response packet when the response packet is received, and searching the classification group in the classification table according to the detected request packet. Can be.

In an embodiment, the determining of whether to perform the security check may include performing the security check when the classification group is a first classification group and omitting the security check when the classification group is a second classification group. It may include.

According to an embodiment of the present invention, the reliability and speed of operation of the security device are improved.

1 is a conceptual diagram illustrating a network system.

2 is a block diagram illustrating the security device of FIG. 1.

3 is a diagram illustrating a classification table stored in the classification table of FIG. 2.

4 is a flowchart illustrating a method of operating a security device when a request packet is generated.

5 is a flowchart illustrating a method of operating a security device when a response packet is generated.

6 is a diagram conceptually illustrating a method of operating the security apparatus described with reference to FIGS. 4 and 5.

Advantages and features of the present invention, and methods for achieving the same will be described with reference to embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. However, the present embodiments are provided to explain in detail enough to easily implement the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "indirectly connected" with another element in between. . Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

1 is a conceptual diagram illustrating a network system 100.

Referring to FIG. 1, the network system 100 includes a user terminal 110, first to nth web servers 121 to 12n, a network 130, a security device 140, and a web classification database 150. It includes.

The user terminal 110 is connected to the web servers 121-12n through the network 130 via the security device 140. The user terminal 110 may receive various services by transmitting a request packet to each of the web servers 121 ˜ 12n and receiving a response packet transmitted from the corresponding web server according to the request packet. The user terminal 110 may access a corresponding web page or receive an application while exchanging packets with each of the web servers 121 ˜ 12n. For example, the user terminal 110 may install an application provided from each of the web servers 121 ˜ 12n and communicate with the web server using the installed application to receive content such as music and video. In addition, the installed application can communicate with the web server to receive services such as animation and games.

The first to n th web servers 121 ˜ 12 n are connected to the user terminal 110 through the security device 140 via the network 130, and communicate various web services while communicating packets with the user terminal 110. Can provide.

The security device 140 processes the packets communicated between the web servers 121-12n and the user terminal 110. Security device 140 is configured to monitor packets, perform security checks on some of the packets, and omit security checks on other parts of the packets.

Security device 140 is coupled to web classification database 150 via network 130. Security device 140 communicates with web classification database 150 via network 130. The security device 140 classifies the packets communicated between the web servers 121-12n and the user terminal 110 with reference to the information received from the web classification database 150, and thus selectively applies the packets to the packets. Perform a security check on

In FIG. 1, the security device 140 is shown to be connected between the user terminal 110 and the network 130. However, as an example, unlike FIG. 1, the security device 140 may be connected to any other point in the network system 100 and process packets passing through the point. For example, the security device 140 may be connected between the web servers 121-12n and the network 130.

2 is a block diagram illustrating the security device 140 of FIG. 1. 3 is a diagram illustrating a classification table stored in the classification table 260 of FIG. 2.

Referring to FIG. 2, the security device 140 includes a receiver 210, a controller 220, a packet buffer 230, a URL extractor 240, a table manager 250, a classification table 260, and a search engine ( 270, a security processor 280, and a transmitter 290.

The receiver 210 is configured to receive packets communicated between the user terminal 110 and the web servers 121-12n. The reception unit 210 receives a request packet transmitted from the user terminal 110 to an arbitrary web server, and receives a response packet of the same session as the request packet transmitted from the web server to the user terminal 110 according to the request packet. something to do.

The controller 220 is configured to control overall operations of the security device 140. The controller 220 includes a receiver 210, a packet buffer 230, a URL extractor 240, a table manager 250, a classification table 260, a search engine 270, a security processor 280, and a transmitter. 290 is configured to control.

The control unit 220 controls to transmit the request packet received through the receiving unit 210 and temporarily stored in the packet buffer 230 to the transmitting unit 290 through the security processing unit 280. Alternatively, the controller 220 controls to transfer the request packet temporarily stored in the packet buffer 230 directly to the transmitter 290 without passing through the security processor 280. That is, the security check on the request packet may not be performed.

The packet buffer 230 temporarily stores a request packet received through the receiver 210 and a response packet received through the receiver 210. In an embodiment, the packet buffer 230 may store packets in a first-in first-out (FIFO) manner.

The URL extractor 240 is connected to the packet buffer 230. The URL extractor 240 receives a request packet from the packet buffer 230 and extracts a URL from the request packet.

In addition, the URL extractor 240 provides the table manager 250 to the URL (RURL) of the extracted request packet.

In addition, the URL (RURL) of the extracted request packet is provided to the controller 220. When the URL (RURL) of the request packet is received, the controller 220 passes through the transmission unit 290 to the web classification database 150 (see FIG. 1) through the network 130 (see FIG. 1). Request classification information (CI) for RURL). Accordingly, the web classification database 150 provides the classification information CI to the security device 140. The classification information CI may be received through the receiver 210.

In an embodiment, the classification information CI is information on what kind of service the URL (RURL) of the request packet provides. For example, the classification information (CI) may be any kind of site such as whether the URL (RURL) of the request packet is an adult site, a crime site, a game site, a gambling site, an education site, a government office site, a medical site, or the like. Contains information about cognition. If the URL (RURL) of the request packet is unknown (or unknown) of the site, the classification information (CI) includes information that does not know what kind of service it provides.

Meanwhile, the table manager 250 is connected to the receiver 210 and the URL extractor 240. The table manager 250 receives the URL (RURL) of the request packet from the URL extractor 240.

The table manager 250 receives the classification information CI from the receiver 210. The table manager 250 determines a classification group according to the classification information CI. For example, the table management unit 250 removes the URL (RURL) of the request packet when the classification information CI indicates a kind of site that is assumed to be a high risk category such as an adult site, a crime promotion site, a game site, or a gambling site. It can be decided by 1 classification group. For example, when the classification information CI indicates a type of site assumed to be a low risk category such as an education site, a public office site, or a medical site, the table manager 250 sets the URL (RURL) of the request packet to the second classification group. Can be determined. Whether each kind of site known according to the classification information CI corresponds to the first classification group or the second classification group may be preset by the administrator of the security device 140 and may be changed. If the classification information CI includes information for not knowing what kind of site, the classification group corresponding to the URL RURL of the request packet may be determined as the first classification group.

The table manager 250 updates the classification table 260 with a mapping relationship between the URL (RURL) of the request packet and the classification group.

For example, the table manager 250 may generate a classification table 260 as shown in FIG. 3. Referring to FIG. 3, each URL corresponds to a first classification group Group1 or a second classification group Group2. The first to m th URLs URL1 to URLm correspond to the first classification group Group1, and the m + 1 to k th URLs URLm + 1 to URLk correspond to the second classification group Group2. do.

In an embodiment, the classification table 260 may be stored in a storage medium. In an embodiment, the security device 140 may include one storage medium, and the storage medium may include a storage medium for storing the classification table 260 and a packet buffer 230. In an embodiment, the storage medium storing the classification table 260 and the packet buffer 230 may be separate components.

In an embodiment, the classification table 260 may be stored in a storage medium external to the security device 140. For example, a storage medium external to the security device 140 is connected to the security device 140 via the network 130, and the security device 140 can update the classification table 260 while communicating with the storage medium. Can be. In this case, the table manager 250 may access the storage medium through the network 130 through the transmitter 290.

Referring back to FIG. 2, the search engine 270 is connected to the classification table 260. When the response packet is received, the search engine 270 is configured to search in the classification table 260 the classification group corresponding to the request packet of the same session in response to the control of the controller 220. For example, when a response packet is received, a request packet of the same session as the response packet is extracted from the packet buffer 230 to the URL extractor 240, and the search engine 270 requests from the URL extractor 240. The classification group corresponding to the URL (RURL) of the request packet may be searched by receiving the URL (RURL) of the packet. For example, when the response packet is received and the URL (RURL) of the request packet of the same session as the response packet is URL2 of FIG. 3, the search engine 270 will output the first classification group Group1. .

The security processor 280 is connected to the packet buffer 230 and the search engine 270. The security processor 280 receives a classification group from the search engine 270 and determines whether to perform a security check on the response packet stored in the packet buffer 230. If the first classification group Group1 is received, the security processing unit 280 may perform a security check on the corresponding response packet stored in the packet buffer 230. If it is determined that the response packet is a malicious packet, the security processing unit 280 will drop the response packet. If the response packet is determined to be an allowed packet, the security processing unit 280 may allow the response packet by providing the response packet to the transmission unit 290.

If the second classification group Group2 is received, the security processor 280 skips the security check on the response packet stored in the packet buffer 230 and provides the response packet to the transmission unit 290.

The transmitter 290 transmits the request packet provided from the security processor 280 to the corresponding web server through the network 130 (see FIG. 1), and transmits the response packet provided from the security processor 280 to the user terminal 110 (FIG. 1). Reference).

According to an embodiment of the present invention, it is determined to which classification group the URL of the request packet corresponds, and then whether to perform a security check on the response packet when a response packet of the same session as the request packet is received. By omitting the security check on the response packet according to the classification group, the real-time of the web service is secured and the operation speed of the security device 140 will be improved. In addition, by performing security checks on response packets according to classification groups, it is possible to efficiently perform security checks for communication with web servers that are assumed to be in high risk categories, and more effectively for communication with unknown web servers. The test can be performed.

4 is a flowchart illustrating a method of operating the security device 140 when a request packet is generated.

Referring to FIG. 4, in step S110, a request packet is received by the security device 140. For example, the request packet may be a Hyper Text Transfer Protocol (HTTP) request.

In operation S120, the security device 140 transmits a request packet to a corresponding web server.

In operation S130, the security device 140 extracts a URL from the request packet. In addition, the security device 140 transmits the URL of the extracted request packet to the web classification database 150 and receives classification information corresponding to the URL of the request packet from the web classification database 150.

In an embodiment, before the URL of the extracted request packet is transmitted to the web classification database 150, the search engine 270 may search whether the URL of the request packet exists in the classification table 260. If the URL of the request packet already exists in the classification table 260, the controller 220 may not request classification information from the web classification database 150. For example, if the user terminal 110 has previously accessed the web server previously, the URL of the request packet will already exist in the classification table 260. If the URL of the request packet does not exist in the classification table 260, the controller 220 may request classification information by transmitting the URL of the request packet to the web classification database 150.

In operation S140, the security device 140 determines a classification group according to the classification information. In operation S150, the security device 140 maps the determined classification group and the URL of the request packet and updates the mapping relationship in the classification table 260.

5 is a flowchart illustrating a method of operating the security device 140 when a response packet is generated.

Referring to FIG. 5, in step S210, a response packet is received by the security device 140. For example, the response packet may be an HTTP response. For example, when such a response packet is received by the user terminal 110 (refer to FIG. 1), a screen of a specific web site may be displayed on the user terminal.

In operation S230, the security device 140 searches the classification table 260 to determine a classification group corresponding to the URL of the request packet of the same session as the response packet. For example, the security device 140 may detect a request packet of the same session as the response packet and search for a classification group in the classification table 260 according to the detected request packet.

In operation S240, the security device 140 performs operations S250 to S260 according to whether the classification group is a high risk category. For example, when the classification group is the first classification group (Group1, see FIG. 3), step S250 is performed. If the classification group is the second classification group Group2 (see FIG. 3), step S260 is performed.

In operation S250, the security device 140 performs a security check. In an embodiment, the security device 140 may perform a variety of security checks, such as Unified Threat Management (UTM) scan, intrusion prevention system (IPS) scan, virus scan, and malware scan.

In operation S260, the security device 140 skips the security check and transmits the response packet to the user terminal 110.

As another embodiment, the security device 140 may not omit the security check but may perform only the security check simplified than the operation S250. For example, Unified Threat Management (UTM) can only perform some of the security checks, including intrusion prevention system (IPS) scans, virus scans, and malware scans.

In operation S270, the security device 140 performs operation S280 or S290 according to whether the response packet is a malicious packet.

In operation S280, the security device 140 blocks the response packet. In operation S290, the security device 140 accepts the response packet and transmits the response packet to the user terminal 110.

6 is a diagram conceptually illustrating a method of operating the security device 140 described with reference to FIGS. 4 and 5.

Referring to FIG. 6, it is assumed that the user terminal 110 transmits a request packet to a high risk web server. When the user terminal 110 transmits the request packet, the security device 140 transmits the request packet to the web server, while extracting the URL of the request packet while generating and forwarding the response packet according to the web classification database. Inquiry 150, and determines the classification group (S510).

The security device 140 recognizes from the determined classification group that the web server that is the destination of the request packet is a high risk category web server (S520).

When the corresponding response packet is received, the security device 140 performs a security check on the received response packet (S530).

It is assumed that the user terminal 110 transmits a request packet to a web server of a low risk category. When the user terminal 110 transmits the request packet, the security device 140 transmits the request packet to the web server, while extracting the URL of the request packet while generating and forwarding the response packet according to the web classification database. In step 150, the searcher determines the classification group (S610).

The security device 140 recognizes from the determined classification group that the web server to which the request packet is transmitted is a web server of a low risk category (S620).

Subsequently, when the response packet is transmitted, the security device 140 skips the security check on the response packet.

In the detailed description of the present invention, specific embodiments have been described, but various changes may be made without departing from the scope and spirit of the present invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be defined by the equivalents of the claims of the present invention as well as the following claims.

Claims

In a security device connected to a user terminal communicating with a web server via a network:

A receiving unit for receiving a request packet transmitted from the user terminal to the web server and a response packet transmitted from the web server to the user terminal;

Receiving classification information on the URL of the request packet from a web classification database to determine the classification group corresponding to the URL of the request packet, and to update the mapping relationship between the URL of the request packet and the classification group in a classification table. A table management unit configured; And

A search engine configured to search for the classification group in the classification table when the response packet of the same session as the request packet is received,

And determine whether to perform a security check on the response packet according to the classification group.
The method of claim 1,

And a controller for requesting the classification information by transmitting the URL of the request packet to the web classification database when the request packet is received.
The method of claim 2,

And the receiving unit receives the classification information from the web classification database through the network and provides the received classification information to the table manager.
The method of claim 3, wherein

And the table manager maps a URL of the request packet to a first classification group or a URL of the request packet to a second classification group according to the classification information.
The method of claim 1,

And a packet buffer coupled to the receiver and configured to temporarily store the request packet and the response packet passed through the receiver.
The method of claim 5,

And a URL extractor configured to extract a URL of the request packet stored in the packet buffer.
The method of claim 6,

The URL extractor provides the extracted URL of the request packet to the table manager.
The method of claim 1,

The search engine is configured to search for the classification group in the classification table according to the URL of the request packet, which is the same session as the response packet when the response packet is received.
The method of claim 1,

A security processor configured to selectively perform a security check on the response packet according to the classification group searched by the search engine; And

And a transmitter configured to transmit the response packet to the outside according to a result of the security check.
In the method of operation of a security device connected to a user terminal communicating with a web server via a network:

Receiving a request packet transmitted from the user terminal to the web server;

Receiving classification information for the URL of the request packet from a web classification database via the network;

Determining a classification group to which the URL of the request packet belongs according to the classification information, and updating a mapping relationship between the URL of the request packet and the classification group in a classification table;

Receiving a response packet of the same session as the request packet transmitted from the web server to the user terminal according to the request packet;

Searching for the classification group in the classification table; And

Determining whether to perform a security check on the response packet according to the classification group.
The method of claim 10,

Extracting a URL from the request packet when the request packet is received.
The method of claim 10,

Requesting the classification information by transmitting the extracted URL of the request packet to the web classification database.
The method of claim 9,

And wherein the searching comprises detecting the request packet of the same session as the response packet when the response packet is received and searching the classification group in the classification table according to the detected request packet.
The method of claim 9,

The determining of whether to perform the security check includes performing the security check when the classification group is a first classification group and omitting the security check when the classification group is a second classification group. .