WO2021020918A1

WO2021020918A1 - Method for providing logical internal network, and mobile terminal and application for implementing same

Info

Publication number: WO2021020918A1
Application number: PCT/KR2020/010090
Authority: WO
Inventors: 김찬우; 최성준
Original assignee: 스콥정보통신 주식회사
Priority date: 2019-07-30
Filing date: 2020-07-30
Publication date: 2021-02-04
Also published as: KR102211238B1

Abstract

The present invention relates to a method for providing a logical internal network by an application installed on a mobile terminal, the method comprising the steps in which the application: carries out the authentication of a user received thereby; requests, to a connected policy server, network access right information in accordance with the authentication of the user, and receives the network right information of the user; when the access right of the user is approved, receives a connection request from at least one terminal corresponding to the authentication of the user; requests the result of an integrity check to the terminal, and when the integrity of the terminal is confirmed, issues an IP to the terminal; collects connection request information or access information of the terminal which is accessing via the issued IP, and shares same with the policy server; and encrypts and transmits packets generated from the terminal, and decrypts received encrypted packets and forwards same to the terminal.

Description

Method of providing logical internal network, mobile terminal and application implementing the same

It relates to a technology for implementing a logical internal network with an application installed in a mobile terminal.

Recently, the demand for networks is increasing exponentially due to the increase in used data, such as the growth of multimedia contents, the expansion of the Internet of Things (IoT), the rapid increase in cloud computing, and the influence of the increasing mobile usage.

The necessity for a change in network structure is increasing in order to cope with various business models that change with the increasing demand of the network.

In particular, due to the need for stable network speed and security, organizations and companies have built and utilized internal networks. However, the internal network (intranet) requires a lot of cost and time to be built with complex configurations such as firewall-only devices, routers, wireless LAN controllers, and redundancy of switches, and a lot of manpower costs to operate them. In addition, in an IoT environment where network-managed devices such as desktops, laptops, tablets, PCs, NAS, Internet phones, printers, etc. are gradually increasing inside the enterprise, management in terms of efficiency and stability increases as the number of devices using the internal network increases. Is having difficulty.

Accordingly, it is possible to consistently manage regardless of the complexity of the changing network structure or network policy, and technology development is underway to minimize manpower costs required for the construction and operation of the internal network while providing stable speed and security aspects. .

Moreover, in recent years, as 5G mobile networks are provided, fast and high-quality communication services can be used by multiple mobile terminals through high bandwidth.

Therefore, by implementing an internal network through a mobile terminal that does not need to be fixed in a specific place based on a 5G network, there is a need for an internal intranet construction technology that performs and controls the user's authentication for internal security while replacing the existing internal network. do.

An object to be solved by the present invention is to provide a technology for implementing an internal network through an application installed in a mobile terminal and allowing access to the internal network to a terminal that has performed authorization authentication.

The problem to be solved by the present invention is to provide a technology for setting a policy level differently for each mobile terminal on which an application is installed, and allowing or blocking network access between mobile terminals based on the policy level.

In addition to the above tasks, it can be used to achieve other tasks not specifically mentioned.

According to an embodiment of the present invention, in a method of providing a logical internal network to terminals connected to an application installed in a mobile terminal, the application performs the authentication of the inputted user, and the authentication of the user from the linked policy server Requesting network access authority information according to the user's network authority information and receiving the user's network authority information, receiving a connection request from one or more terminals corresponding to the user's authentication when the user's access authority is approved, and requesting an integrity check result to the terminal When the integrity of the terminal is verified, issuing an IP to the terminal, collecting connection request information or access information for the terminal connected to the issued IP and sharing it with the policy server, and encrypting and transmitting packets generated by the terminal. And decrypting the received encrypted packet and forwarding it to the terminal.

The policy server may manage authentication information for applications of a plurality of mobile terminals, set access rights, and established network policies, and record access authority request information and terminal information received from each mobile terminal in a database.

The policy server, upon receiving a request for permission to access a network according to user authentication, may provide accessable terminal information including information on a different mobile terminal that can be connected or a terminal that has connected to the mobile terminal, along with whether to allow network access.

Receiving a packet to be transmitted to the destination terminal from the terminal connected with the issued IP, checking whether the destination terminal is included in the accessible terminal information, and if the access right to the destination terminal is confirmed, the mobile to which the destination terminal is connected The method may further include forwarding a corresponding transport packet to an application of the terminal and transmitting a response packet received in response to the transport packet to the terminal.

In the step of checking whether the information of the accessible terminal is included in the information of the accessible terminal, if the destination terminal is not included in the accessible terminal information received from the policy server, it is possible to check whether access is permitted by requesting the access right of the destination terminal to the policy server.

In the step of transferring to the terminal, if the access right to the destination terminal is not approved, a packet may be dropped and a drop message may be transmitted to the terminal.

The terminal includes a network access control client that performs integrity access and monitoring, and the step of issuing an IP to the terminal is to transmit the network policy shared from the existing policy server to the terminal, and the integrity based on the network policy. You can request to perform one or more of the scans for access, essential software installation, and malicious software installation.

In the step of issuing an IP to the terminal, when the integrity of the terminal is confirmed, tethering is performed for access to the terminal, and an IP address that is not duplicated may be issued for each terminal.

Collecting tracking data on the traffic and usage history of each terminal based on the IP issued for each terminal, sharing the collected tracking data with the policy server, and controlling the traffic usage of the terminal or between specific sites or different terminals. It may further include controlling the access.

According to another embodiment of the present invention, as an application executed by a computing device and stored in a computer-readable recording medium, the step of synchronizing driving rights and user information of the application by interlocking with a policy server and a network, and providing an interface. Upon receiving user authentication information through the user authentication information, requesting network access authority information according to the user authentication information to the policy server, receiving network access authority information, and providing tethering to detect one or more terminals requesting connection, the corresponding terminal Checking the integrity of the network, issuing a non-overlapping IP to the corresponding terminal in response to the checked integrity, and receiving packets generated from the terminal connected to the IP, and the packets based on the network access authority information. It contains instructions that execute the step of determining whether to forward.

Receiving the network access right information, from the policy server that manages the authentication information for the application, the set access right, and the established network policy, whether or not to allow network access, different accessible mobile terminals or terminals connected to the mobile terminal. Accessible terminal information including information may be received.

In the step of issuing a non-overlapping IP to a corresponding terminal, integrity can be checked by receiving an integrity connection and monitoring result through a network access control client included in the terminal.

Commands to execute the steps of collecting tracking data on the traffic and usage history of each terminal based on the IP issued for each terminal, controlling the usage of the terminal traffic below the standard value, or controlling access between specific sites or different terminals It may contain more.

Determining whether to forward packets is the step of checking whether the destination terminal is included in the accessible terminal information when a packet to be transmitted from the terminal to the destination terminal is received. If the destination terminal can be accessed but is connected to a different mobile terminal, a different It may include instructions for performing the step of forwarding a corresponding transport packet to an application of the mobile terminal, and transmitting a response packet corresponding to the transport packet from an application of a different mobile terminal to the terminal.

Determining whether to forward packets may include encapsulating and forwarding a transport packet, and receiving an encapsulated response packet from an application of a different mobile terminal.

According to one embodiment of the present invention, a point-to-point connection control method (VPN) in an existing network, a router for transmitting packets to a destination, a switch for a hub function that connects a MAC bridge and a network unit, etc. By replacing it with a logical network, it is possible to minimize the construction cost of the internal network.

According to one embodiment of the present invention, connection through high transmission speed and ultra-delay technology is implemented by implementing an internal network by utilizing the maximum advantages of 5G, which are data transmission speed, delay time, and terminal capacity, without additional network equipment. Loss of connection due to delay can be prevented.

According to one embodiment of the present invention, in security that may become vulnerable as the usable bandwidth increases, encryption of all signal traffic, advanced encryption algorithms, and security keys are used, and devices and networks can be mutually confirmed. By building an internal network including a secure ID management function, it is possible to manage and control a wide range of internal networks by enhancing the security aspect.

According to an embodiment of the present invention, by establishing an internal network through an application of a mobile terminal that does not need to be fixed in a specific place, the utilization of the internal network is improved, and an independent internal network for each mobile terminal is established based on a set policy level. By configuring, complex network policies can be implemented more conveniently and conveniently.

1 schematically illustrates a system implementing a logical internal network according to an embodiment of the present invention.

2 is a block diagram showing a mobile terminal, a policy server, and a terminal implementing an internal network according to an embodiment of the present invention.

3 is an exemplary diagram for explaining a network connection according to a policy between groups of mobile terminals according to an embodiment of the present invention.

4 is a flowchart illustrating communication of a terminal through mobile terminals implementing an internal network according to an embodiment of the present invention.

5 is a flowchart illustrating a process of controlling a network between terminals by implementing an internal network by a mobile terminal according to an embodiment of the present invention.

6 is an exemplary diagram showing a database of a policy server according to an embodiment of the present invention.

Embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. The present invention may be implemented in various different forms and is not limited to the embodiments described herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and the same reference numerals are used for the same or similar components throughout the specification. Also, in the case of well-known technologies, detailed descriptions thereof will be omitted.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated.

Hereinafter, the mobile terminal and the terminal are computing devices including hardware such as a processor, memory, display, and communication module. The processor runs the application in cooperation with the hardware. The display may display a user interface screen provided by an application and receive a user input (eg, a touch input). In addition to the touch input, the terminal may receive a user input through a keyboard. The communication module is connected to the communication network. Through the communication network, the application and the server transmit and receive data.

In the specification, a mobile terminal is a terminal in which an application implementing an internal network is installed, and the terminal refers to a device that accesses and communicates with an internal network using an application of the mobile terminal. The mobile terminal and the terminal are classified according to whether or not an application is installed, but the implemented form may be the same.

For example, a terminal can be implemented in various forms, and generally described by taking a mobile terminal as an example, but it will be implemented in the form of various types of computers such as a pad-type terminal such as a smart pad, a laptop computer, a wearable device, and a TV terminal. I can.

In addition, the application is software stored in a computer-readable storage medium, and includes instructions and data for executing the operation of the present invention. The application is installed on the terminal, executed on the terminal, communicates with a designated policy server through a communication network, and can implement a logical internal network.

As shown in FIG. 1, the policy server 100 for managing a network policy and the mobile terminals 200 installed with the internal network implementation application are connected through a communication network, and each mobile terminal 200 has a separate terminal 300 ) Are connected, and data communication between the corresponding terminals 300 is performed.

Here, the communication network connected between the policy server 100 and the mobile terminals 200 may include all types of communication networks that transmit data, such as a wired communication network, a short-range or long-distance wireless communication network, and a mixed network thereof. It can be implemented in the form of a private network built using.

The policy server 100 sets and manages a policy for managing a network environment, and collects and manages information of the mobile terminals 200 connected to the network.

In addition, the policy server 100 may store and manage the access management policy in the network system as a database. The access management policy relates to whether or not to access a network, and may include information on an access authority level as well as whether to access an internal network.

For example, when the access authority level is formed from step 1 to step N, the policy server 100 can access a destination terminal that is below the access authority level of the target terminal, but has the access authority level or higher of the target terminal. The access authority level can be managed so that access to the destination terminal is impossible. (N is a natural number)

The policy server 100 may manage individual access rights for the terminals 300 connected to the mobile terminal 200 in addition to access rights assigned to the mobile terminals 200.

This policy can be reset by the network administrator in one embodiment, and can be changed and set according to the network environment later.

The mobile terminal 200 executes an application that implements an internal network and communicates with the policy server 100 through a communication network. In the description, it is described that the mobile terminal 200 accesses the policy server 100 using a 5G network and receives access to the input ID, but it is also possible through a 3G/LTE (Long Term Evolution) network. I can.

In addition, the mobile terminal 200 may be a mobility terminal of various types and uses, such as a portable terminal, a notebook computer, an IoT terminal, a vehicle terminal, and a display terminal.

The application installed in the mobile terminal 200 provides a kind of user interface screen, and a user ID and a password according to the user ID may be input through the corresponding user interface screen. In detail, in order to implement an internal network, the application installed in the mobile terminal 200 checks the user authority according to the network policy based on the input user ID, connects one or more terminals according to the identified user ID, and each terminal Performs the function of transmitting the packet generated in.

Such an application may be installed in the mobile terminal 200 designated in advance in a separate user authentication process or a security program.

For reference, for convenience of explanation, the network-implemented application may be described as a subject of the operation, or the mobile terminal 200 running the installed network-implemented application may be described as the subject of the operation.

The terminal 300 is a device that transmits and receives packets by accessing a network implemented by an application installed in the mobile terminal 200, and may be implemented in the same or various forms as the mobile terminal 200, for example, a smart pad. It may be implemented in the form of various types of computers, such as pad type terminals, laptop computers, wearable devices, and TV terminals.

The terminal 300 communicates with each other through an internal network provided by an application of the mobile terminal 200 and may also communicate with different terminals connected to other mobile terminals.

In addition, the terminal 300 includes a network access control client that performs integrity access and audit.

Here, the network access control client may perform integrity and audit based on a network policy received from an application, and may perform role-based access control (RBAC), a security policy compliance check, and media control such as USB.

For convenience, the terminal transmitting the packet is referred to as the target terminal 300-1, and the receiving terminal of the packet is referred to as the destination terminal 300-2.

For example, the target terminal 300-1 connects to the mobile terminal A 200-A and uses an internal network through a network implementation application installed in the mobile terminal A 200-A. At this time, when the target terminal 300-1 wants to access the destination terminal 300-2, the mobile terminal A 200-A to which the target terminal 300-1 is connected and the destination terminal 300-2 Communication between the connected mobile terminals N (200-N) is performed.

At this time, the target terminal 300-1 and the destination terminal 300-2 are connected only when access between mobile terminal A (200-A) and mobile terminal N (200-N) is allowed to each other, and on the same internal network. Unlimited network use is possible.

Hereinafter, each component of a system implementing an internal network will be described in detail.

As shown in Figure 2, in response to the access permission policy set in the policy server 100, the application 210 of the mobile terminal 200 checks whether the access right to the internal network, and establishes a connection with the terminal 300. To transmit and receive packets.

The policy server 100 checks the authority requested from the mobile terminal 200 and returns a policy management unit 110 to the mobile terminal 200 and a database 120 that stores information on the network policy or the mobile terminal 200. ).

The policy management unit 110 searches for a preset database 120 based on a corresponding user ID through communication with the mobile terminal 200 and checks the matched ID for the database 120.

When the policy management unit 110 has the requested authority for the matched ID information, it transmits the feedback on the authorization approval to the mobile terminal 200, and if it does not have the requested authority, the feedback on the authorization disapproval is sent to the mobile device. It can be transmitted to the terminal 200.

In addition, the policy management unit 110 collects data such as login information (ID/Password), issued IP address and MAC address, and access authority level from the connected mobile terminal 200 in real time, and stores the data in the database 120 in the form of a table. Can be stored and managed.

In addition, the policy management unit 110 includes basic information, unique numbers, IP addresses, MAC addresses, S/N [signal-noise ratio], traffic information, and usage history information of terminals 300 connected to a plurality of connected mobile terminals 200. Etc. can be collected and stored. For example, the policy management unit 110 may perform real-time communication with the mobile terminals 200 to receive various pieces of information collected by the mobile terminals 200, and record and manage them in the database 120.

Based on such information, the policy management unit 110 may individually recognize the terminals and apply an individual policy set for each terminal. For example, some different access rights from the connected mobile terminal 200 may be applied to the terminal 300.

In detail, the policy management unit 110 provides a user ID for access rights to an internal network implemented through an application of the mobile terminal 200 or access rights to a terminal 300 connected to a different mobile terminal 200. The authority can be checked based on the authority and a response corresponding thereto can be provided.

In the database 120, a network policy database in which network access rights, access rights to other mobile terminals, etc. are set based on a user ID, and a database storing information of a mobile terminal connected in real time may be separately constructed.

In addition, the policy server 100 and the mobile terminal 200 are closely connected through a network to synchronize the driving rights and user information of the application installed in each mobile terminal 200.

The application 210 of the mobile terminal 200 includes a policy management unit 211, a packet reception unit 212, a terminal management unit 213, and a packet forwarding unit 214 for managing network access rights.

The policy management unit 211 connects to the policy server 100 in real time based on the user ID and password input by executing the application to check the access authority of the user.

In other words, the policy management unit 210 receives an access permission response through the policy server 100 and an access permission query in order to authenticate the permission to access the internal network in a mobile network environment.

Here, the policy management unit 211 pre-registers IDs for users who can use the mobile terminal, separately manages a user authentication database to check whether the user ID input from the application matches the password, and then uses only the user ID. The policy server 100 can check whether access is authorized.

In this case, the method used for user authentication is described with a user ID and password, but is not limited thereto, and authentication may be performed using a user's human body authentication method (iris, fingerprint, etc.) or pattern recognition.

In this case, the policy management unit 211 searches for a user having a feature point extracted through the authentication method in the user authentication database to determine whether it is matched, and when the user authentication is confirmed in the user authentication database, the policy management unit 211 responds to each user. The authentication code that is used may be transmitted to the policy server 100 to receive access authorization.

The packet receiving unit 212 receives all packets generated from a terminal to access a network implemented by an application. The packet receiving unit 212 receives an access packet, a data transmission/reception packet, a control signal packet, and the like from the terminal 300 located in a certain short distance.

The terminal management unit 213 checks the integrity connection of the terminal 300 in response to the Wi-Fi access request from the terminal 300 and then performs Wi-Fi tethering.

The terminal management unit 213 may request an integrity check result from the terminal 300 that has transmitted the connection request, and check the integrity check result transmitted through the packet receiving unit 212.

In addition, the terminal management unit 213 may manage a list of available IPs to issue an available IP to the terminal 300 requesting a Wi-Fi connection.

Since the issued IP is not duplicated, tracking of the traffic and history of the terminal 300 can be controlled or inquired through the issued IP.

Hereinafter, Wi-Fi tethering will be described, but the present invention is not limited thereto, and USB tethering, Bluetooth tethering, and the like may be performed according to an applied situation.

The terminal management unit 213 may create a list in which an IP issued to connect and manage one or more terminals 300 and a unique number for each terminal 300 are associated. Accordingly, the terminal management unit 213 may collect the connection request information of the terminal 300 and record it in the database in association with the connection request information of the terminal 300 and the issued IP address, which is then transferred to the policy server 100. Can be transmitted.

In detail, the terminal management unit 213 may collect tracking data on traffic and usage history based on the IPs of the terminals.

When the received packet is an access request packet to a specific terminal, the packet forwarding unit 214 transmits the packet to the specific terminal or transmits the packet received from the connected terminal 300 to the terminal 300.

Meanwhile, the packet receiving unit 212 and the packet forwarding unit 214 may perform encryption/decryption of a packet.

For example, when receiving an encrypted packet, the packet receiving unit 212 decodes the packet to check the destination of the packet, and if the destination is the terminal 300 to which the destination is connected, the packet forwarding unit 214 decrypts the packet. One packet may be transmitted to the terminal 300. In addition, if the destination of the received packet is a terminal connected to another mobile terminal and communication with the destination is possible, the packet forwarding unit 214 may encrypt the packet received and transmit it to the destination.

In other words, when a packet is transmitted/received through communication between different mobile terminals 200, the packet receiving unit and the packet forwarding unit may respectively perform encryption and decryption on the packet. Hereinafter, encryption and decryption steps are performed in transmitting/receiving packets even if the process of encryption and decryption is not separately described.

The terminal 300 wirelessly accesses an IP issued through an internal wireless Internet module (Wi-Fi) and performs communication through an internal network implemented in the mobile terminal 200.

The terminal 300 may include a network access control client, and check and monitor integrity access through the network access control client.

For example, one or more of a variety of tests for checking the integrity of a terminal, such as a required software installation scan and a malicious software installation scan, may be tested.

As shown in FIG. 3, the mobile terminals 200 are provided with an internal rule including a level of access authority assigned to an authenticated user ID, a department corresponding to the user ID, a title, a title, etc. It can be grouped as G10, G20, and G30 based on policies, etc.

Here, an unlimited network can be used without a separate connection availability confirmation procedure between mobile terminals in the same group, but a procedure for access authority must be performed between mobile terminals in different groups.

For example, if the terminal 300 connected to the mobile terminal A belonging to G10 wants to perform data communication to a terminal that does not belong to the same group, the mobile terminal A accesses the policy server 100 to access the terminal to communicate with. After checking, you can transmit and forward the packet.

At this time, since the terminal belonging to the G10 group has access right to the terminal belonging to the G20 group or the G10 group, if the access right is approved from the policy server 100, an unlimited network can be used.

However, a terminal belonging to the G20 group can freely communicate with a terminal belonging to the G10 group, but network use is limited with a terminal belonging to the G30 group.

In addition, a terminal belonging to the G30 group may receive a packet from the G10 group, but may be configured to limit data transmission to the outside. In this case, the terminal belonging to the G10 group can transmit the packet to the terminal belonging to the G30 group and check only the response packet that has been transmitted.

In this way, by grouping mobile terminals and applying different network usage between groups, an independent intranet for each group can be formed even on the same internal network.

The group policy can be easily changed and set by an administrator later, and communication between various terminals connected to a specific mobile terminal can be managed differently according to the policy.

For example, in addition to the access rights of the mobile terminal, individual access rights can be set based on unique values (IP, S/N, MAC, etc.) of the terminal connected to the mobile terminal. Among terminals 1 and 2 connected to the mobile terminal, terminal 1 may be set to have access rights according to the access rights of the mobile terminal, and terminal 2 may be set to have access rights different from the access rights of the mobile terminal.

Accordingly, the terminal 2 can be set so that the mobile terminal cannot connect to the accessible terminals, and conversely, the mobile terminal can be set to allow access to some specific terminals among the terminals to which the mobile terminal is not accessible.

In this way, a policy can be applied to terminals that access the mobile terminal as a standard, or access can be controlled through policies individually set for the terminals.

As described above, in the case of the individual policy of the terminal, a code for performing an individual policy may be additionally described or a policy level may be set differently and managed by the mobile terminal 200 and the policy server 100.

Hereinafter, communication between terminals connected to different mobile terminals will be described in detail.

In FIG. 4, the terminal 300-1 is connected to the mobile terminal A 200-A with an IP issued through ID authentication, and the terminal 300-2 has an ID on the mobile terminal B 200-B. Communication is being performed through each internal network while connected to the IP issued through authentication.

At this time, the terminal 300-1 transmits a destination access packet destined for the terminal 300-2 to the mobile terminal 200-A. The mobile terminal 200-A checks whether the destination terminal 300-2 for the destination access packet is a terminal connected to the same group.

For example, the mobile terminal 200-A may check whether it is a different terminal connected to the mobile terminal 200-A or a terminal connected within a group including the mobile terminal 200-A. This is because the mobile terminal 200-A manages information on the connected terminal, it is possible to check whether there is matching information between the information of the terminal connected in the same group and the destination terminal 300-2.

If the terminal is not connected within the same group, the mobile terminal 200 -A may access the policy server 100 to check access information of the destination terminal 300-2 and request access permission.

Accordingly, in the case of a packet for which access is permitted, a destination access packet is transmitted from the packet forwarding unit 214 of the mobile terminal A 200-A to the mobile terminal B 200-B corresponding to the access information of the destination terminal 300-2. Can be transmitted. At this time, the mobile terminal A (200-A) may transmit a destination access packet by adding a security code indicating a packet for which access is permitted.

In this case, the destination access packet may be encapsulated and transmitted to the mobile terminal B 200-B.

Encapsulation refers to a technique that hides information within an object and provides external access that allows other objects to interact with that information, but does not allow direct access to it.

And when the destination access packet is received by the packet receiving unit 212 of the mobile terminal B 200-B, the encapsulated destination access packet is checked (Encapsulation), and the terminal management unit 133 recognizes that the destination terminal is one of the connected terminals. Confirm. Then, after checking whether the packet is a packet received from the terminal 300-1 to which access is permitted, the corresponding destination access packet is transmitted to the destination terminal 300-2.

For example, the mobile terminal B (200-B) may access the policy server 100 to check whether the connection of the terminal 300-1 is allowed, or check the security code added to the packet itself.

The destination terminal 300-2 transmits a destination response packet according to the received destination access packet, which is transmitted from the mobile terminal B 200-B to the mobile terminal A 200-A in the same manner as described above, This is transmitted to the terminal 300-1 again.

In this case, a packet transmitted/received between terminals 300 connected to the mobile terminal 200 and a packet transmitted/received between different mobile terminals may be encrypted and decrypted through different methods.

Hereinafter, a process of performing communication between terminals using an internal network implemented through an application of a mobile terminal will be described with reference to FIGS. 5 and 6.

5 is a flowchart illustrating a process of controlling a network between terminals by implementing an internal network by a mobile terminal according to an embodiment of the present invention, and FIG. 6 is an exemplary diagram showing a database of a policy server according to an embodiment of the present invention.

As shown in FIG. 5, the mobile terminal 200 performs user authentication by driving an application (S110).

For example, the mobile terminal 200 may perform login by checking an ID and password input from a user through an interface screen provided by the application 210.

Then, the mobile terminal 200 checks the access authority for the user authentication information (S120).

The mobile terminal 200 requests the policy server 100 for permission to access the ID. Accordingly, the policy server 100 stores the access permission request information received from the mobile terminal 200 in a database, and searches for information matching the access permission request information with previously established policy information. Through this, the policy server 100 may transmit permission information or approval for a corresponding access permission request.

In addition to the access right information to the internal network, the authority information further includes reference information for grouping, policy information between groups, accessible terminal information or access authority level including information of different mobile terminals that can be accessed or terminals that have accessed the mobile terminal. Can include.

Next, when the access right is confirmed, the mobile terminal 200 activates the hotspot (S130).

The mobile terminal 200 activates a hotspot at the same time as accessing the application of the terminal, and through this, the terminal requests permission to access Wi-Fi.

The mobile terminal 200 performs connection approval for the connection request of the terminal corresponding to the corresponding ID and issues an IP to the terminal (S140).

The application running on the mobile terminal 200 collects and records Wi-Fi connection request information of the terminal 300, and requests an integrity connection check and monitoring result to the terminal 300. Accordingly, if integrity is verified from the terminal 300, an available IP is issued to establish a Wi-Fi connection to allow the terminal 300 to use the network. The mobile terminal 200 may share the collected information of the terminal 300, access request information, integrity check information, issued IP, and the like with the policy server 100.

Then, the terminal 300 can access the network through the connected Wi-Fi and use the Internet.

Next, the mobile terminal 200 receives an access packet to be transmitted to the destination terminal from the terminal connected with the issued IP (S150).

The mobile terminal 200 receives all packets generated by the terminal 300 and checks whether forwarding is performed.

Accordingly, the mobile terminal 200 checks whether connection with the destination terminal is possible (S160).

The mobile terminal 200 may check whether a destination terminal is connected within the same group in order to check a group to which the destination terminal belongs, and may request permission from the policy server 100 to the destination terminal.

The policy server 100 may compare terminal information shared from the mobile terminals 200 to check a group to which the destination terminal belongs, and check a policy between the corresponding terminal 300 and the destination terminal 300-1.

As such, the policy server 100 may check detailed policies indicating individual access rights of terminals 300 connected to each mobile terminal in addition to policies between mobile terminals.

When it is determined from the policy server 100 that the terminal 300 does not have access rights to the destination terminal 300-1, the mobile terminal 200 drops an access packet and transmits a drop message to the terminal (S170).

On the other hand, when the terminal 300 is authorized to access the destination terminal 300-1 from the policy server 100, the access information indicating the mobile terminal to which the destination terminal 300-1 is accessed is displayed together with the access permission approval. Receive.

On the other hand, when the mobile terminal 200 receives an access packet including the IP of the destination terminal 300-1 from the terminal 300, the mobile terminal 200 checks whether access to the destination terminal 300-1 is possible using the IP. Alternatively, the policy server 100 may request access authority confirmation. Accordingly, when the access authority is granted, the mobile terminal 200 forwards the access packet to the corresponding IP, so that different mobile terminals managing the IP may receive the access packet.

As described above, if the mobile terminal 200 can access the destination terminal, it transmits a packet to another mobile terminal connected to the destination terminal, receives a response packet, and delivers it to the terminal (S180).

Step S180 of transmitting and receiving packets between the terminal 300 and the destination terminal 300-2 through packet communication between the mobile terminals 200 has been previously described in FIG. 4, and thus a redundant description will be omitted.

Meanwhile, as shown in FIG. 6, the policy server 100 stores and manages access information between the mobile terminal 200 and the terminal 300 in the database 120.

Based on user ID and password (PWD), connected terminal information, IP address, MAC address, and each set network policy are stored and managed in a table. In addition, tracking data on the traffic and usage history of each terminal, and a control plan for the application accordingly, can be stored and managed in connection with each application.

Through this, the policy server 100 searches for access information of the destination terminal and access rights of the terminals, and transmits permission approval feedback only to the matched terminals, thereby controlling access of unauthorized terminals and implementing an independent intranet in the network. .

As described above, according to the present invention, a system implementing a logical internal network constructs an internal network by replacing the complex configuration of essential items (firewall (VPN) router, core switch, distribution switch) constituting the existing internal network through a mobile application. You can minimize the cost of doing it.

In addition, access control for the source IP/MAC address and destination IP included in the packet generated by a terminal such as a PC connected to the mobile terminal is performed, and communication between groups of the internal network is performed by grouping mobile terminals implementing the network through an application. By implementing control, it is possible to conveniently and conveniently implement the existing complex network policy.

In addition, since there is no need to use separate network equipment, a network can be constructed using the maximum advantages of 5G, such as data transmission speed, delay time, and terminal capacity. For example, a network with a maximum transmission speed of 20 Gbps can be established. While in use, it is possible to prevent loss of connection due to connection delay between mobile and terminal through ultra-low delay technology.

The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The medium may be specially designed and configured, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floppy disks, and ROM, RAM, flash memory, and the like. Hardware devices specially configured to store and execute the same program instructions are included. Here, the medium may be a transmission medium such as an optical or metal wire or a waveguide that transmits a signal specifying a program command or a data structure. Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although one preferred embodiment of the present invention has been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention defined in the following claims are also provided. It belongs to the scope of the present invention.

Claims

In a method of providing a logical internal network to terminals connected to an application installed in a mobile terminal,

The application is a step of performing authentication of the input user,

Requesting network access authority information according to authentication of the user from an interlocked policy server, and receiving network authority information of the user,

Receiving a connection request from at least one terminal corresponding to the user's authentication when the user's access right is approved,

Issuing an IP to the terminal when requesting an integrity check result from the terminal and the integrity of the terminal is confirmed,

Collecting connection request information or access information for a terminal connected to the issued IP and sharing it with the policy server; and

Encrypting and transmitting packets generated in the terminal, decrypting the received encrypted packet, and forwarding it to the terminal

A method of providing a logical internal network comprising a.
In claim 1,

The policy server,

A method for providing a logical internal network that manages authentication information for applications of a plurality of mobile terminals, set access rights, and established network policies, and records access rights request information and terminal information received from each mobile terminal in a database.
In paragraph 2,

The policy server,

A method for providing a logical internal network for providing accessable terminal information including information on a different mobile terminal accessible or a terminal connected to the mobile terminal, along with whether or not to allow network access, when a network access authority is requested according to the user authentication.
In paragraph 3,

Receiving a packet to be transmitted to a destination terminal from a terminal connected to the issued IP,

Checking whether the destination terminal is included in the accessible terminal information, and

If the access right to the destination terminal is confirmed, forwarding a corresponding transmission packet to an application of the mobile terminal to which the destination terminal has accessed and transmitting a response packet received in response to the transmission packet to the terminal,

A method of providing a logical internal network further comprising a.
In claim 4,

The step of checking whether it is included in the information of the accessible terminal,

If the destination terminal is not included in the accessible terminal information received from the policy server, a method for providing a logical internal network to check whether access is permitted by requesting access rights of the destination terminal to the policy server.
In clause 5,

The step of transferring to the terminal,

If the access right to the destination terminal is not approved, the packet is dropped and a drop message is delivered to the terminal.
In claim 1,

The terminal includes a network access control client that performs integrity access and monitoring,

Issuing an IP to the terminal,

A method for providing a logical internal network for requesting to perform one or more tests among integrity access, essential software installation inspection, and malicious software installation inspection based on the network policy while transmitting the network policy shared from the policy server to the terminal.
In clause 7,

Issuing an IP to the terminal,

When the integrity of the terminal is verified, tethering is performed for access to the terminal, and an IP address that is not duplicated is issued for each terminal.
In clause 8,

Collecting tracking data on the traffic and usage history of each terminal based on the IP issued for each terminal, and sharing the collected tracking data with the policy server, and

The method of providing a logical internal network further comprising the step of controlling the traffic usage of the terminal or controlling access between a specific site or different terminals.
An application executed by a computing device and stored in a computer-readable recording medium,

The step of synchronizing the driving authority and user information of the application by interlocking with the policy server and the network

Upon receiving user authentication information through the provided interface, requesting network access authority information according to the user authentication information to the policy server, and receiving the network access authority information,

When detecting one or more terminals requesting connection by providing tethering, verifying the integrity of the corresponding terminal, and issuing a non-overlapping IP to the corresponding terminal in response to the checked integrity, and

Receiving packets generated from a terminal accessing the IP, and determining whether to forward the packets based on the network access authority information,

An application containing instructions to execute.
In claim 10,

Receiving the network access right information,

From the policy server that manages authentication information, set access rights, and established network policies for the application, accessable terminal information including information on whether to allow network access, different accessible mobile terminals or terminals connected to the mobile terminal is provided. Application to receive.
In clause 11,

Issuing the non-overlapping IP to the corresponding terminal,

An application that checks integrity by receiving integrity access and monitoring results through a network access control client included in the terminal.
In claim 12,

Collecting tracking data on the traffic and usage history of each terminal based on the IP issued for each terminal, and controlling the usage of the traffic of the terminal below a reference value, or controlling access between a specific site or different terminals

The application further includes instructions to execute.
In claim 13,

The step of determining whether to forward the packets,

When receiving a packet to be transmitted from the terminal to the destination terminal, checking whether the destination terminal is included in the accessible terminal information,

If the destination terminal can be accessed but is connected to a different mobile terminal, forwarding the transmission packet to the application of the different mobile terminal, and

When a response packet corresponding to the transport packet is received from an application of the different mobile terminal, transmitting it to the terminal

An application containing instructions to execute.
In clause 14,

The step of determining whether to forward the packets,

An application that encapsulates and forwards the transport packet, and receives an encapsulated response packet from an application of the different mobile terminal.