WO2023211104A1 - Système permettant de contrôler un accès au réseau basé sur un dispositif de commande, et procédé associé - Google Patents

Système permettant de contrôler un accès au réseau basé sur un dispositif de commande, et procédé associé Download PDF

Info

Publication number
WO2023211104A1
WO2023211104A1 PCT/KR2023/005573 KR2023005573W WO2023211104A1 WO 2023211104 A1 WO2023211104 A1 WO 2023211104A1 KR 2023005573 W KR2023005573 W KR 2023005573W WO 2023211104 A1 WO2023211104 A1 WO 2023211104A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
data packet
data
node
packet
Prior art date
Application number
PCT/KR2023/005573
Other languages
English (en)
Korean (ko)
Inventor
김영랑
Original Assignee
프라이빗테크놀로지 주식회사
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 프라이빗테크놀로지 주식회사 filed Critical 프라이빗테크놀로지 주식회사
Publication of WO2023211104A1 publication Critical patent/WO2023211104A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • Embodiments disclosed in this document relate to a system and method for controlling controller-based network access.
  • Networks may include public networks such as the Internet as well as private networks such as intranets.
  • IP Internet Protocol
  • TCP Transmission Control Protocol
  • Firewall technology is commonly used.
  • Firewall technology identifies IPs assigned to nodes or network nodes and performs access control for inbound or outbound data packets between network boundaries, thereby blocking unauthorized IPs from accessing unauthorized destination networks.
  • IP-based firewalls may cause problems where IP-based control is difficult in the case of nodes in the Internet band where IP allocation and control are difficult, or when private IP bands are created by configuring subnetworks with routers and gateways.
  • firewalls are used as a minimum security device.
  • data packets transmitted between nodes and servers or gateways are encrypted, or connectivity controls such as tunneling technology or security sessions are used to prevent forgery and alteration and to allow unique access only to authorized subjects.
  • connectivity controls such as tunneling technology or security sessions are used to prevent forgery and alteration and to allow unique access only to authorized subjects.
  • Technology is being used.
  • VPN Virtual Private Network
  • tunneling technology created at the terminal level has a vulnerability that allows unauthorized or insecure applications to access unauthorized destination networks through tunneling that is always connected after initial authentication when used.
  • VPN technology is experiencing an increase in security incidents caused by various malware and ransomware infiltration.
  • a node includes a communication circuit, a processor operatively connected to the communication circuit, and a memory operatively connected to the processor and storing a connection control application and a target application,
  • the node detects a network connection event through the access control application and confirms the existence of a data flow authorized from an external server that corresponds to the data packet that the target application wants to transmit, Check the type of the data packet, allow transmission of the TCP SYN packet based on whether the TCP SYN packet can be transmitted based on the type of the data packet, and do not require inspection of the TCP SYN packet after creating a TCP session or Stores instructions for performing a network connection authentication check and processing subsequently transmitted data packets based on the results of the authentication check, and whether the data flow will basically allow transmission of the TCP SYN packet. May contain information.
  • a method of operating a connection control application installed in a node includes detecting a network connection event, detecting the existence of a data flow authorized from an external server corresponding to a data packet to be transmitted by the target application, Confirming, confirming the type of the data packet, allowing transmission of the TCP SYN packet based on whether the TCP SYN packet can be transmitted if the data packet is a TCP SYN packet, and if the data packet is an authentication data packet If so, performing a network connection authentication check, and dropping the data packet if the data packet is not the TCP SYN packet and the authentication data packet, and the data flow basically involves transmission of the TCP SYN packet. It may include information about whether to allow it or not.
  • application connectivity control technology that allows only permitted safe applications to access the permitted network is applied to identify the application that is the fundamental communication subject and prevent access to unauthorized applications in advance.
  • various malware and ransomware can be prevented from accessing unauthorized destination networks, and at the same time, various currently occurring network security problems can be effectively solved.
  • communication in modules or functional units can be controlled in a more detailed unit than the application, and data or data held by the data provider
  • the network access can be controlled so that the permitted module transmits only data permitted by the data owner or permitted by policy in advance.
  • the results of AI calculations centered on Data Centric Networking overlaid on a conventional IP-based network and countless processed valuable data stored in the server are transmitted to the consumer and provide actual value. It can be used as a base technology for granting.
  • a lower level than an application that cannot be identified in the operating system (Kernel Level) is used.
  • Kernel Level an additional identification layer can be inserted when connecting to a network in the target application (User Level), providing a method to control network access at the module or data level.
  • the target application when a module or function in the target application (User Level) that cannot be identified in the operating system (Kernel Level) connects to the network and transmits data, the target application transmits data when connected to the network. It is possible to provide a structure that allows or disallows network access depending on whether to allow network access containing the identification information by checking each identification information included in one authentication data packet with the controller.
  • whitelist-based network access is permitted for each identification unit according to the authentication policy of the controller set in advance, or a third party (e.g., data owner) is allowed to access the network of the corresponding identification unit.
  • a third party e.g., data owner
  • By additionally checking whether to allow access it is possible to provide a structure that allows network access only with third-party approval. Since network access for each identification unit is recorded, it is possible to inquire what data was transmitted by which module and when. We can provide a way to do this.
  • the data owner's credit information data is approved by the entrusted credit institution.
  • the data permitted by the user can be created at the time of data provision to other organizations permitted by the permitted data supply agency, and the network connection can be disconnected at the end of data provision. Because it can provide technology that can be used, it can provide a way to reach the actual purpose of My Data.
  • various authentication information e.g., public key-based encryption and decryption key and certificate
  • data information signed based on the authentication information e.g., approved data propagation on a blockchain network
  • It is always connected to the network, such as transmission, personal information stored in the cloud, etc., but it connects to the Internet only when remote storage containing information that must be isolated from the Internet is required, thereby blocking external risks coming from the Internet.
  • By transmitting only permitted data it is possible to block unauthorized subjects from transmitting unauthorized data (e.g., when personal information is arbitrarily leaked by a thief).
  • Figure 1 shows an environment including multiple networks.
  • Figure 2 shows architecture within a network environment according to various embodiments.
  • Figure 3 is a functional block diagram showing a database stored in a controller according to various embodiments.
  • Figure 4 shows a functional block diagram of a node according to various embodiments.
  • Figure 5 is a diagram showing the structure of an authentication data packet according to various embodiments.
  • Figure 6 is a diagram showing an operation for controlling transmission of data packets according to various embodiments.
  • Figure 7 shows a signal flow diagram for connecting a node to a controller according to various embodiments.
  • Figure 8 shows an operation flowchart for network connection of a node according to various embodiments.
  • FIG. 9A shows a signal flow diagram for checking network connectivity of a node according to various embodiments.
  • FIG. 9B shows a signal flow diagram for checking network connection authentication of a node according to various embodiments.
  • Figure 10 shows a signal flow diagram for transmitting a data packet of a node according to various embodiments.
  • Figure 11 shows a signal flow diagram for controlling reception of data packets by a gateway according to various embodiments.
  • Figure 12 shows a signal flow diagram for updating the control flow of a node according to various embodiments.
  • Figure 13 shows a signal flow diagram for disconnection of a node according to various embodiments.
  • Figure 14 shows a signal flow diagram for termination of application execution of a node according to various embodiments.
  • Figure 15 shows an operation flowchart of a method of operating an access control application installed in a node according to various embodiments.
  • One (e.g., first) component is said to be “coupled” or “connected” to another (e.g., second) component, with or without the terms “functionally” or “communicatively.”
  • second component e.g., any of the components can be connected to the other components directly (e.g. wired), wirelessly, or through a third component.
  • Each component (eg, module or program) described in this document may include singular or plural entities. According to various embodiments, one or more of the corresponding components or operations may be omitted, or one or more other components or operations may be added. Alternatively or additionally, multiple components (eg, modules or programs) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each component of the plurality of components in the same or similar manner as those performed by the corresponding component of the plurality of components prior to the integration. .
  • operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or , or one or more other operations may be added.
  • module used in this document may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example.
  • a module may be an integrated part or a minimum unit of the parts or a part thereof that performs one or more functions.
  • the module may be implemented in the form of an application-specific integrated circuit (ASIC).
  • ASIC application-specific integrated circuit
  • Various embodiments of this document may be implemented as software (e.g., a program or application) including one or more instructions stored in a storage medium (e.g., memory) that can be read by a machine.
  • the processor of the device may call at least one instruction among one or more instructions stored from a storage medium and execute it. This allows the device to be operated to perform at least one function according to the at least one instruction called.
  • the one or more instructions may include code generated by a compiler or code that can be executed by an interpreter.
  • a storage medium that can be read by a device may be provided in the form of a non-transitory storage medium.
  • 'non-transitory' only means that the storage medium is a tangible device and does not contain signals (e.g. electromagnetic waves), and this term refers to cases where data is semi-permanently stored in the storage medium. There is no distinction between temporary storage cases.
  • Computer program products are commodities and can be traded between sellers and buyers.
  • a computer program product may be distributed in the form of a machine-readable storage medium (e.g. compact disc read only memory (CD-ROM)) or through an application store or between two user devices (e.g. smartphones). It may be distributed in person or online (e.g., downloaded or uploaded). In the case of online distribution, at least a portion of the computer program product may be at least temporarily stored or temporarily created in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store server, or a relay server.
  • a machine-readable storage medium such as the memory of a manufacturer's server, an application store server, or a relay server.
  • Figure 1 shows an environment including multiple networks.
  • the first network 10 and the second network 20 may be different networks.
  • the first network 10 may be a public network such as the Internet
  • the second network 20 may be a private network such as an intranet or VPN.
  • the first network 10 may include the data provider network 210 of FIG. 2
  • the second network 20 may include the data consumer network 220 of FIG. 2.
  • the first network 10 may include a source node 101.
  • the 'source node' may be various types of devices capable of performing data communication.
  • the source node 101 may be a portable device such as a smartphone or tablet, a computer device such as a desktop or laptop, a multimedia device, a medical device, a camera, a wearable device, or a virtual reality (VR) device. , or home appliances and is not limited to the above-mentioned devices.
  • the source node 101 may include a server or gateway that can transmit data packets through an application.
  • the source node 101 may also be referred to as an ‘electronic device’ or a ‘terminal’.
  • the destination node 102 may include the same or similar device as the above-described source node 101.
  • the destination node 102 may be substantially the same as the destination network.
  • the source node 101 may attempt to access the second network 20 and transmit data to the destination node 102 included in the second network 20.
  • the source node 101 may transmit data to the destination node 102 through the gateway 103 and tunnel 105.
  • the data is not limited to this, and the source node 101 may transmit data to the destination node 102 through various paths such as tunnels, security sessions, and channels.
  • the source node 101 can communicate with all servers included in the first network 10, and therefore the source node 101 is malicious. ) may be exposed to program attacks.
  • the source node 101 may be infected with malicious code 110c, as well as trusted and/or secure applications such as Internet web browsers 110a and business applications 110b. ) It is possible to receive data from untrusted or unsecured applications, such as the business application 110d.
  • the source node 101 infected by a malicious program may attempt to connect to the second network 20 and/or transmit data. If the second network 20 is formed based on IP, such as a VPN, it may be difficult for the second network 20 to individually monitor a plurality of devices included in the second network 20, and application at the OSI layer may be difficult. Security at the layer or transport layer may be vulnerable. Additionally, if the source node 101 includes a malicious application after the channel has already been created, the data of the malicious application will be transmitted to another electronic device (e.g., the destination node 102) within the second network 20. You can.
  • IP such as a VPN
  • Figure 2 shows architecture within a network environment according to various embodiments.
  • the number of nodes 201, gateways 203, destination networks 204, data provider networks 210, and data consumer networks 220 is not limited to the number shown in FIG. 2.
  • a plurality of nodes may have network access controlled by the controller 202, and the controller 202 may communicate with a plurality of gateways and control transmission of data to a plurality of destination networks.
  • Node 201 may include a connection control application 211 and a target application 221.
  • the access control application 211 checks whether a connection is possible from the controller 202 when a network connection occurs, and only if a connection is possible, connects to the destination through the gateway 203 based on the data flow generated by the controller 202.
  • Data packets may be transmitted to the network 204.
  • the gateway 203 may include a first gateway 213 that exists at a network boundary on the node 201 side and a second gateway 223 that exists on a network boundary on the destination network 204 side.
  • Data flow-based connectivity control technology provides a structure in which communication is possible only when a data flow authorized by the controller 202 exists for the node 201 to access the destination network 204, and when no data flow exists, If not, a structure in which the node 201 cannot communicate may be provided.
  • the access control application 211 may restrict transmission of data packets of the target application 212 when a data flow does not exist.
  • Controller 202 may be a server (or cloud server).
  • the controller 202 may perform network access control for the destination network 204 of the node 201.
  • the controller 202 transmits and receives control data packets with the node 201 to perform various operations (e.g., registration, approval, authentication, renewal, termination) associated with the network connection of the node 201. You can.
  • the flow through which control data packets are transmitted may be referred to as a control flow.
  • the controller 202 can provide an environment in which access to the destination network 204 of unauthorized nodes can be blocked.
  • the gateway 203 may include a first gateway 213 and a second gateway 223.
  • the gateway 203 may provide technology to safely transmit data packets in a network section through a secure channel.
  • the gateway 203 checks whether the data packet received from the access control application 211 is actually transmitted by the permitted node 201, and detects the data packet transmitted by bypassing the access control application 211. It can play a blocking role.
  • the gateway 203 can enable a secure network configuration at all times throughout the data provider network 210 and the data consumer network 220.
  • Data owner 206 may communicate with controller 202.
  • the controller 202 can allow whitelist-based network access for each identification unit according to the authentication policy, and additionally checks whether the data owner 206 will allow network access for the corresponding identification unit, so that the data owner (206) 206) can provide a structure that allows network access only with approval. Additionally, since network access can be recorded for each identification unit, the data owner 206 can inquire when and where which module transmitted what data.
  • FIG. 3 is a functional block diagram showing a database stored in a controller according to various embodiments.
  • the controller includes a communication circuit for performing communication with an external electronic device (e.g., the communication circuit 430 in FIG. 4) and a processor for controlling the overall operation of the controller (e.g., FIG. It may further include 4 processors 410).
  • the administrator can connect to the controller 202 and set a connection-critical policy to control the connection between the application and the server, so it can provide security such as existing NAC (Network Access Control) and firewalls that simply perform access control based on IP. Network access control is possible in more detail than the technology and is more secure from a network access perspective.
  • NAC Network Access Control
  • the access policy database 311 may include information about networks and/or services to which an identified network, node (e.g., node 201 in FIG. 2), user, unidentified user, or application can access. For example, when connection to a destination network is requested from a node, the controller identifies the network (e.g., the network to which the node belongs), node, user (e.g., user of the node), and And/or it may be determined whether the application (application included in the node) can connect to the destination network.
  • node e.g., node 201 in FIG. 2
  • application application included in the node
  • the authentication policy database 312 identifies the access target at a more detailed level than the application, which is the minimum unit of access control in the access policy (e.g., information included in the access policy database 311), and identifies the access target to which the identified target can access. May include service information. For example, when a network access request exists with the corresponding identification information, the authentication policy database 312 determines whether to always allow access to services accessible by policy or to other systems or third parties connected to the controller (e.g. : Can include whether to allow access only when approved by the data owner).
  • the authentication policy database 312 determines whether to continuously allow network access after network access is permitted or determines whether certain conditions (e.g., TCP SYM Packet, TCP FIN Packet, and the amount of transmitted data packets are related to the data flow). This can include whether to release the network connection and re-perform data packet authentication if rules such as exceeding the amount of included data packets or including update processing characters for data packets included in the data flow are met. there is. Additionally, the authentication policy database 312 may include whether to perform data packet authentication only upon initial network connection or whether to check data packet authentication at every data packet transmission.
  • certain conditions e.g., TCP SYM Packet, TCP FIN Packet, and the amount of transmitted data packets are related to the data flow. This can include whether to release the network connection and re-perform data packet authentication if rules such as exceeding the amount of included data packets or including update processing characters for data packets included in the data flow are met. there is.
  • the authentication policy database 312 may include whether to perform
  • the authentication policy database 312 may include a method for extracting and inspecting identification information included in an authentication data packet (eg, authentication information generation and inspection algorithms such as One time Password, HMAC, etc.).
  • the authentication policy database 312 may provide an authentication policy that includes information about whether it is possible to transmit a data packet without additional authentication and information about changing the authentication status of the data flow when the update conditions of the data flow are met. It may contain information for generating information. That is, the controller 202 may generate authentication information based on the authentication policy database 312.
  • the blacklist policy database 313 may include policies for permanently or temporarily blocking access to nodes.
  • the blacklist policy database 313 provides information (e.g., node, IP address, media access control) address, or at least one of the user ID).
  • the blacklist database 314 may include a list of at least one of nodes, IP addresses, MAC addresses, or users blocked by the blacklist policy database 313. For example, if a node requesting access to the destination network is included in the blacklist database 314, the controller may isolate the node from the destination network by rejecting the node's connection request.
  • the control flow table 315 is an example of a session table for managing the flow (e.g., control flow) of control data packets generated between a node and a controller.
  • control flow information can be generated by the controller.
  • the control flow information may include at least one of control flow identification information, an IP address identified when connecting to and authenticating the controller, a node ID, or a user ID.
  • the controller can retrieve control flow information through the control flow identification information received from the node, and use the IP address, node ID, or user included in the retrieved control flow information.
  • a control flow may have an expiration time.
  • the node must update the expiration time of the control flow, and if the expiration time is not updated within a certain period of time, the control flow (or control flow information) may be removed. Additionally, if it is determined that immediate connection blocking is necessary according to security events collected from the node, the controller may remove the control flow according to the node's connection termination request. If the control flow is removed, the previously created data flow is also removed, so the node's connection may be blocked.
  • the data flow table 316 is a table for managing the flow (eg, data flow) in which detailed data packets are transmitted between a node, a gateway, and a destination network. Data flows can be created as TCP sessions on a per-node or per-IP basis, applications on a node, or on a more granular basis.
  • the data flow table 316 includes data flow identification information, control flow identification information if the data flow is dependent on the control flow, an application ID to identify whether the data packet transmitted from the node is an authorized data packet, and source network identification information. , may include destination network identification information and/or service port.
  • the data flow table 316 determines whether to continuously allow network access after network access is permitted or determines under certain conditions (e.g., TCP SYM Packet, TCP FIN Packet, the amount of transmitted data packets is the amount of data packets included in the data flow). If it exceeds , it may contain authentication information including whether to release the network connection and re-perform data packet authentication if rules such as including update processing characters of data packets included in the data flow are met. . Depending on the embodiment, the authentication information may include whether to perform data packet authentication only upon initial network connection or whether to check data packet authentication at every data packet transmission. In addition, the data flow table 316 contains data flow status information (including whether data flow authentication has been completed and transmission is possible, authentication is required, or authentication is not required and network connection is possible without authentication. or authentication status information of the data flow).
  • the data flow table 316 may be equally included in a node (eg, node 201 in FIG. 2) and a gateway (eg, gateway 203 in FIG. 2).
  • Figure 4 shows a functional block diagram of a node according to various embodiments.
  • a node may include a processor 410, memory 420, and communication circuit 430. According to one embodiment, the node may further include a display 440 to interface with the user.
  • the processor 410 can control the overall operation of the node.
  • the processor 410 may include one processor core (single core) or may include a plurality of processor cores.
  • the processor 410 may include multi-core, such as dual-core, quad-core, or hexa-core.
  • the processor 410 may further include a cache memory located internally or externally.
  • the processor 410 may be configured with one or more processors.
  • the processor 410 may include at least one of an application processor, a communication processor, or a graphical processing unit (GPU).
  • GPU graphical processing unit
  • processor 410 is electrically or operatively coupled to other components within the node (e.g., memory 420, communication circuitry 430, or display 440). It can be (coupled with) or connected to.
  • the processor 410 may receive commands from other components of the node, interpret the received commands, and perform calculations or process data according to the interpreted commands.
  • the processor 410 may interpret and process messages, data, commands, or signals received from the memory 420, the communication circuit 430, or the display 440.
  • Processor 410 may generate new messages, data, instructions, or signals based on received messages, data, instructions, or signals.
  • Processor 410 may provide processed or generated messages, data, instructions, or signals to memory 420, communication circuit 430, or display 440.
  • the processor 410 can process data or signals generated or generated by a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may record (or store) or update instructions, data, or signals to the memory 420 in order to execute or control a program.
  • the memory 420 may store commands for controlling nodes, control command codes, control data, or user data.
  • the memory 420 may include at least one of an application program, an operating system (OS), middleware, or a device driver.
  • OS operating system
  • middleware middleware
  • device driver a device driver
  • Memory 420 may include one or more of volatile memory or non-volatile memory.
  • Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). It can be included.
  • Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, etc.
  • the memory 420 uses non-volatile media such as a hard disk drive (HDD), solid state disk (SSD), embedded multi media card (eMMC), and universal flash storage (UFS). More may be included.
  • HDD hard disk drive
  • SSD solid state disk
  • eMMC embedded multi media card
  • UFS universal flash storage
  • the memory 420 may store some of the information included in the controller's memory (eg, memory 330 in FIG. 3).
  • memory 420 may store data flow table 316 described in FIG. 3 .
  • Communication circuitry 430 may support establishment of a wired or wireless communication connection between a node and an external electronic device (e.g., controller 202 of FIG. 2), and performing communication through the established connection.
  • the communication circuit 430 may be a wireless communication circuit (e.g., a cellular communication circuit, a short-range wireless communication circuit, or a global navigation satellite system (GNSS) communication circuit) or a wired communication circuit (e.g., a local area network (LAN) ) communication circuit, or power line communication circuit), and using the corresponding communication circuit, a short-range communication network such as Bluetooth, WiFi direct, or IrDA (infrared data association) or a long-distance communication such as a cellular network, the Internet, or a computer network It can communicate with external electronic devices through a network.
  • the various types of communication circuits 430 described above may be implemented as one chip or may be implemented as separate chips.
  • the display 440 can output content, data, or signals.
  • the display 440 may display image data processed by the processor 410.
  • the display 440 may be configured with an integrated touch screen by being combined with a plurality of touch sensors (not shown) capable of receiving touch input, etc.
  • a plurality of touch sensors may be placed above the display 440 or below the display 440.
  • a server may include a processor 410, memory 420, and communication circuit 430.
  • the processor 410, memory 420, and communication circuit 430 included in the server may be substantially the same as the processor 410, memory 420, and communication circuit 430 described above.
  • a gateway (eg, gateway 203 in FIG. 2) may include a processor 410, a memory 420, and a communication circuit 430.
  • the processor 410, memory 420, and communication circuit 430 included in the gateway may be substantially the same as the processor 410, memory 420, and communication circuit 430 described above.
  • Figure 5 is a diagram showing the structure of an authentication data packet according to various embodiments.
  • Existing data packets can be composed of a data packet structure that includes an IP header and payload containing 5 Tuples (source, destination information, etc.) information, which is a unit that can be identified in OSI (Open System Interconnection) during IP communication. .
  • Tuples source, destination information, etc.
  • OSI Open System Interconnection
  • target applications e.g. : You may need to know whether the minimum identification unit (unit defined at the user level) within the target application 212 in FIG. 2 is connected to the network.
  • the target application (e.g., target application 212 in FIG. 2) is an authentication data packet (e.g., a single authentication data packet) containing information that can identify the included module or function, and data to identify that element when connected to the network. (510) and a data packet (520) using an authentication data packet as a header can be transmitted.
  • the network access control application e.g., the access control application 211 in FIG. 2 that controls network access in the node's operating system (kernel level) can check the received authentication data packets 510 and 520, Authentication information is extracted from the authentication data packets 510 and 520 and transmitted to a controller (e.g., controller 202 in FIG. 2) to check whether network access is permitted based on the authentication information, and A structure that allows network access can be provided based on whether network access is allowed.
  • a controller e.g., controller 202 in FIG. 2
  • the authentication information in the authentication data packets 510 and 520 can identify a level that cannot be identified by the operating system (kernel), and is the minimum identification unit for which the target application requests network access permission when connecting to the network in order to control network access.
  • the identification unit may include information such as a module, function, or data, and the identification unit may be assigned according to the intention of the target application developing and operating.
  • the authentication information may include an authentication information generation algorithm specified by the controller to double check the network connection of the target application.
  • a single authentication data packet 510 may include an IP header and payload.
  • the payload of a single authentication data packet 510 may include an authentication data packet.
  • the single authentication data packet 510 may be structured for initial network connection authentication.
  • the data packet 520 using the authentication data packet as a header may include an IP header, a payload including the authentication data packet, and a payload including the actual transmitted data packet.
  • the data packet 520 using the authentication data packet as a header may be a data packet for checking consecutive data packets.
  • authentication data packets 510, 520 may include one or more pieces of authentication information.
  • Figure 6 is a diagram showing an operation for controlling transmission of data packets according to various embodiments.
  • the node 201 is blocked at the kernel level of the network driver and operating system in the case of an unauthorized data packet for which no data flow exists among the data packets transmitted to the destination network 204 after connecting to the controller 202. You can. Accordingly, node 201 may not transmit any data packets that do not pass through access control application 211 to destination network 204 .
  • the access control application 211 must access the controller 202 to perform identification and authentication of a node or one or more identification information and applications, modules and functions included in the application, and data. After performing authentication, the access control application 211 queries the controller 202 for access network information when accessing the destination network 204 of the target application 212 to check whether access is possible, and determines whether the connection is possible, including the modules and functions of the authorized application, It can be controlled so that only objects such as data can access the network.
  • Unauthorized nodes or applications, modules, functions, and data included in the application are basically unable to access the destination network 204, and are sent from the controller 202 to the target application 212 and the modules included in the target application 212. And if the data flow information including connection information such as functions and data is not delivered to the first gateway 213 or the second gateway 223, the first gateway 213 or the second gateway 223 transmits the data packet. Because forwarding is blocked, the node 201 cannot reach the destination network 204, that is, it is in an isolated state.
  • Figure 7 shows a signal flow diagram for connecting a node to a controller according to various embodiments.
  • the access control application 211 of the node 201 requests the controller 202 to create a control flow, thereby creating a node ( 201), you can try to connect to the controller.
  • connection control application 211 of the node 201 may request controller connection from the controller 202 in operation 705.
  • the connection control application 211 may perform a controller connection request to create a control flow with the controller 202.
  • the controller connection request may include information about the node 201 or the connection control application 211.
  • the controller 202 may check whether the connection control application 211 is in a state in which connection is possible according to the connection policy based on the connection request information.
  • the information requested for access by the access control application 211 may include the type of node 201, location information, environment, network in which the node 201 is included, and information about the access control application 211. there is.
  • the controller 202 controls the access control application ( 211), connection inaccessibility information may be transmitted (operation 725).
  • the controller 202 may create a connection control application 211 or a control flow between the node 201 and the controller 202.
  • the controller 202 may generate control flow identification information in the form of a random number, and enter the identification information of the node 201 and/or the network to which the node 201 belongs in a control flow table (e.g., the control flow in FIG. 3). It can be stored in the table 315).
  • control flow identification information and/or control flow information stored in the control flow table is used to authenticate the user of the node 201, update the information of the node 201, check the policy for network access of the node 201, and/ Or it can be used for validation.
  • the controller 120 may generate whitelist information for accessible applications in a connection policy that matches the node 201.
  • the controller 202 may create a whitelist of accessible applications based on an access policy matched with identification information of the node, user, and source network.
  • a whitelist When a whitelist is created, the controller 202 provides control flow identification information (e.g., ID) to identify the control flow when the connection is completed as a result of the connection and subsequent node user authentication requests and continuous update of node information are required.
  • the application whitelist may be transmitted to the access control application 211 of the node 201 (operation 725).
  • the controller 202 may check whether to allow data packets for which authentication has not been performed based on an authentication policy (e.g., the authentication policy database 312 of FIG. 3). In this case, the controller 202 can check information on whether unauthenticated network access is possible to determine whether the node 201 will allow network access without data packet authentication based on the authentication policy, and unauthenticated network access is possible. Availability information may be transmitted to the node 201 (operation 725).
  • an authentication policy e.g., the authentication policy database 312 of FIG. 3
  • Availability information may be transmitted to the node 201 (operation 725).
  • the controller 202 may transmit a response to the controller connection request to the connection control application 211 of the node 201.
  • the controller 202 may transmit the generated control flow identification information to the access control application 211.
  • the controller 202 may transmit accessible application whitelist information to the access control application 211.
  • the access control application 211 may perform a check on the application.
  • the access control application 211 may perform a check on applications based on a whitelist of accessible applications received from the controller 202.
  • the access control application 211 can check whether the application exists (installed) on the node 201 based on the accessible application information, and in the case of the existing application, the integrity and stability are checked according to the validation policy ( Above the application, tampering inspection, code signing inspection, and fingerprint inspection) can be performed.
  • the access control application 211 may transmit the application check result to the controller 202.
  • the access control application 211 may transmit information on applications existing in the node 201 and the results of validation to the controller 202.
  • the controller 202 may check whether the application is valid based on the received application information. If the application included in the received application information is a valid application, the controller 202 sets the gateway 203 where the node 201 is located in the access policy to allow access to the node 201 connected to the network including the application. You can check, and in the authentication policy, you can create a data flow so that the application can pre-allow data packet transmission without data packet authentication. For example, a data flow can be created based on source IP, destination IP, and port information.
  • the controller 202 may check in the authentication policy whether to allow data packets for which authentication has not been performed. For example, the controller 202 determines whether the node 201 can connect to an unauthenticated network to determine whether to allow network access without data packet authentication or whether to basically allow transmission of TCP SYN packets. It may be transmitted to the control application 211 (operation 745).
  • the controller 202 may transmit the generated data flow to the gateway 203. For another example, if the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203.
  • the controller 202 may transmit the generated data flow to the node 201. For another example, if the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203.
  • the access control application 211 of the node 201 may process the result of the response received from the controller 202.
  • the connection control application 211 may store the received control flow identification information and display a user interface screen to the user indicating that the controller connection is complete.
  • the network connection request for the destination network of the node 201 can be controlled by the controller 202.
  • controller 202 may determine that node 201 is unreachable. For example, if the identification information of the node 201 and/or the network to which the node 201 belongs is included in the blacklist database, the controller 202 may determine that the node 201 is inaccessible. In this case, the controller 202 may not generate a control flow in operation 715 and may transmit a response indicating that controller connection is not possible in operation 725. Additionally, in this case, operations 730 to 750 may not be performed. Depending on the embodiment, if a retry of controller connection is required, the connection control application 211 may perform operation 705 again.
  • the access control application 211 can update the data flow of the node 201 when a data flow received from the controller 202 exists and transmit data packets based on a pre-allowed data flow when connecting to the network. Data flow can be managed so that
  • operations 730 to 750 may not be performed when the access control application 211 determines that inspection of the application is not necessary.
  • Figure 8 shows an operation flowchart for network connection of a node according to various embodiments. Depending on the embodiment, the operations shown in FIG. 8 may be performed through the access control application 211 of the node 201 shown in FIG. 2.
  • the destination network may need to check whether network access is possible or authenticate network access from the controller 202 in order to communicate.
  • the connection control application 211 of node 201 may detect a network connection event.
  • the connection control application 211 may detect a network connection event for the destination network of the target application.
  • the access control application 211 may detect a network connection event by detecting a data packet that the target application wants to transmit.
  • the connection control application 211 may inspect the data flow. For example, the access control application 211 can confirm the existence of a data flow authorized by the controller 202 and corresponding to the data packet that the target application wants to transmit. For another example, the access control application 211 may check whether a data flow corresponding to the identification information of the target application 211 and the identification information of the destination network exists. Depending on the embodiment, if a data flow exists but is not valid, the connection control application 211 may drop the data packet (operation 840). According to another embodiment, if a data flow exists and the data flow is authenticated, or if authentication is not required, the access control application 211 may transmit a data packet (act 815).
  • the access control application 211 may check whether the data packet is a TCP SYN packet for TCP session creation. Depending on the embodiment, when the data packet is a TCP SYN packet, the connection control application 211 may perform a network connection check (operation 825) related to whether the TCP SYN packet can be transmitted. For another example, when the data packet is a TCP SYN packet, the connection control application 211 may allow transmission of the TCP SYN packet based on whether the TCP SYN packet can be transmitted.
  • the connection control application 211 can check whether transmission of the TCP SYN packet is allowed based on whether the TCP SYN packet can be transmitted.
  • the process of checking whether transmission of the TCP SYN packet is permitted may be performed through a network connection test. For example, a network connectivity check may be performed through the operations shown in FIG. 9A. If the data packet is not a TCP SYN packet, in operation 830, the access control application 211 may check whether the data packet is an authentication data packet. Depending on the embodiment, if the data packet is not an authentication data packet, the access control application 211 may drop the data packet (operation 840).
  • the access control application 211 may perform a network connection authentication check related to whether the authentication data packet can be transmitted. For example, a network connection authentication check may be performed through the operations shown in FIG. 9B.
  • FIG. 9A shows a signal flow diagram for checking network connectivity of a node according to various embodiments.
  • the node 201 may transmit a TCP SYN packet and perform a 3 Way Handshake procedure to create a TCP session.
  • Node 201 may be in a state capable of transmitting actual data packets after a TCP session is created. Due to the nature of TCP communication, in order to authenticate data packets, the node 201 must have a TCP session created in advance, and the controller 202 must check whether network access is possible at the time of creating the TCP session, and after creating the TCP session, At the time of data packet authentication, the controller 202 may need to confirm whether network access is possible.
  • the network connection of the node 201 may have the disadvantage of requiring a lot of time to round trip and actually transmit the data packet.
  • the connection control application 211 of the node 201 basically allows the creation of a TCP session, but then checks whether network access is possible at the time of data packet authentication and actual data packet transmission. The process of receiving confirmation from the controller 202 can be reduced to once.
  • the access control application 211 may detect a network connection check event.
  • the access control application 211 may detect a network connection check event through operation 825 of FIG. 8.
  • the connection control application 211 may check whether the TCP SYN packet is inspected. For example, if the connection control application 211 does not need to check the TCP SYN packet, it can create a TCP session by sending the TCP SYN packet to the destination network. For another example, the connection control application 211 may previously allow TCP SYN data packets, i.e., if the data packet has not been authenticated, but a data flow exists that can transmit the TCP SYN data packet, the TCP SYN packet You can create a TCP session by sending it to the destination network. Depending on the embodiment, operation 915 may be performed when a TCP SYN packet needs to be checked or when there is no data flow capable of transmitting a TCP SYN data packet.
  • the access control application 211 may request a network connection to the controller 202.
  • the network connection request may include at least one of control flow identification information previously created with the controller 202, identification information of the target application, and identification information of the destination network.
  • the controller 202 may confirm an access policy matching the identified node 201, user, and source network information based on the control flow identification information. For example, the controller 202 determines whether the connection request identification information (e.g., identification information of the target application, identification information of the destination network) is included in the access policy and whether the destination network corresponding to the identification information is accessible. You can check it. Depending on the embodiment, when network access is not possible, the controller 202 may transmit a result of network access failure to the access control application 211 in operation 935.
  • the connection request identification information e.g., identification information of the target application, identification information of the destination network
  • the controller 202 may process the data flow. For example, the controller 202 provides data flow information that can be accessed with identification information of the destination network based on a data flow table (e.g., data flow table 316 in FIG. 3) to allow the node 201 to access the network. You can check whether exists. Depending on the embodiment, if an accessible data flow exists in the data flow table, the controller 202 may transmit the data flow to the node 201 (operation 935).
  • a data flow table e.g., data flow table 316 in FIG. 3
  • the controller 202 may create a data flow based on the source IP and destination network identification information so that the target application can connect to the destination network, and the generated Data flows may be transmitted to node 201 and gateway 203 (operations 930 and 935).
  • the access control application 211 may process a result of the response received from the controller 202. For example, when the connection control application 211 receives a result of network connection not being possible, it may drop a data packet. For another example, when a data flow is received, the connection control application 211 may transmit a data packet (TCP SYN packet) based on the received data flow. there is. Depending on the embodiment, the access control application 211 of the node 201 may update the data flow based on the received data flow.
  • TCP SYN packet data packet
  • the access control application 211 of the node 201 may further perform validation before performing operation 915.
  • the access control application 211 may perform a check on the integrity and stability of the target application (application forgery check, tampering check, code signing check, fingerprint check, etc.) according to the validation policy.
  • the access control application 211 may perform operation 915.
  • the access control application 211 may drop the data packet (TCP SYN packet).
  • FIG. 9B shows a signal flow diagram for checking network connection authentication of a node according to various embodiments.
  • the node 201 When the node 201 needs to communicate with a destination network, it needs to check whether authentication has been completed in order to communicate with the destination network.
  • the access control application 211 may detect a network connection authentication check event.
  • the access control application 211 may detect a network connection authentication check event through operation 835 shown in FIG. 8.
  • the access control application 211 may request network access authentication from the controller 202.
  • the access control application 211 may request network connection authentication including control flow identification information, target application identification information, identification information of the destination network to be connected, and authentication data packet information to the controller 202.
  • the controller 202 may confirm an access policy that matches the identified node 201, user, and source network information based on the control flow identification information. For example, the controller 202 determines whether the connection request identification information (e.g., identification information of the target application, identification information of the destination network) is included in the access policy and whether the destination network corresponding to the identification information is accessible. You can check it. Depending on the embodiment, when network access is not possible, the controller 202 may transmit a result of network access failure to the access control application 211 in operation 980.
  • the connection request identification information e.g., identification information of the target application, identification information of the destination network
  • the controller 202 checks whether the authentication data packet transmitted by the node 201 is valid based on an authentication policy (e.g., the authentication policy database 312 of FIG. 3). You can. For example, in order to check the validity of an authentication data packet, the controller 202 checks whether the transmittable identification information included in the authentication policy is the same as the identification information transmitted by the node, and determines whether network access is possible with the identification information. For network access authentication, it is possible to determine whether the authentication information is valid through the authentication information generated through the authentication information generation algorithm and the authentication information inspection algorithm included in the authentication policy.
  • an authentication policy e.g., the authentication policy database 312 of FIG. 3
  • controller 202 may allow network access with the approval of a third party (e.g., the data owner 206 in FIG. 2) matched based on the identification information of the node 201, Authentication data packet validity can be checked through third-party authentication confirmation. Through the above confirmation, third parties can safely manage the data they own and check records of data use.
  • a third party e.g., the data owner 206 in FIG. 2
  • the controller 202 configures a data flow table (e.g., data flow table 316 in FIG. 3) to allow node 201 to access the network. You can check whether accessible data flow information exists using the identification information of the destination network.
  • a data flow table e.g., data flow table 316 in FIG. 3
  • the controller 202 If there is no valid data flow information in the data flow table, the controller 202 generates data including the source IP, destination network identification information, and authentication information generated according to the authentication policy so that the target application can connect to the destination network. You can create flows.
  • the authentication information may be information including whether it is possible to always transmit data packets without additional authentication renewal and the time of authentication renewal.
  • authentication information may be used to determine whether to continue to allow network access after network access has been granted, or to determine whether to allow network access under certain conditions (e.g., TCP SYM Packet, TCP FIN Packet, the amount of data packets transmitted is the amount of data packets included in the data flow).
  • TCP SYM Packet TCP FIN Packet
  • the amount of data packets transmitted is the amount of data packets included in the data flow.
  • the authentication information may include information that sets the authentication status of the data flow to an authentication required state when the data flow update conditions are satisfied.
  • the controller 202 may transmit the generated data flow to the gateway 203. For another example, if the generated data flow does not exist, the controller 202 may not transmit the data flow to the gateway 203.
  • the controller 202 may transmit a response to the network connection authentication request (operation 955) of the access control application 211. For example, if a generated data flow exists, the controller 202 may transmit the generated data flow to the access control application 211. For another example, if there is a data flow that can be accessed in the data flow table, the data flow can be transmitted to the node 201. For another example, if the network connection of the target application of the node 201 is not possible or authentication fails, the controller 202 may transmit a result of the inability to connect.
  • the access control application 211 may process the result of the response sent from the controller 202. For example, when the access control application 202 receives a data flow from the controller 202, it updates the data flow of the node 201 with the received data flow and drops or transmits an authentication data packet according to the authentication information. It can be handled. For another example, the access control application 211 may drop a data packet when receiving an authentication failure result or a connection inaccessibility result from the controller 202.
  • the access control application 211 may perform a validation check on the target application according to a validation policy. For example, the access control application 211 may further perform an integrity and stability check of the target application (application forgery check, tampering check, code signing check, fingerprint check, etc.). The access control application 211 may perform operation 955 if the validation result is successful.
  • Figure 10 shows a signal flow diagram for transmitting a data packet of a node according to various embodiments.
  • the access control application 211 of the node 201 can check whether the data packet is authenticated and whether renewal is necessary before transmitting the data packet, and can control not to transmit the data packet if authentication is not performed or renewal is required. there is.
  • the access control application 211 may detect a data packet transmission event. For example, the access control application 211 may detect an operation of another application included in the node 201 (eg, the target application 212 in FIG. 2) transmitting a data packet.
  • the access control application 211 may detect an operation of another application included in the node 201 (eg, the target application 212 in FIG. 2) transmitting a data packet.
  • the access control application 211 may perform a data packet authentication check. For example, the access control application 211 may check authentication information included in the data flow corresponding to the destination network identification information of the data packet requested to be transmitted. The access control application 211 can check whether or not each data packet contains an authentication data packet based on the authentication information, and can perform a data packet test when it is necessary to check whether or not the authentication data packet is included. In this case, the access control application 211 may drop the data packet if the authentication data packet included in the data packet does not exist or if the authentication information included in the data packet is different from the authentication information included in the data flow. For another example, if it is not necessary to check whether the authentication data packet is included, the access control application 211 may perform operation 1015.
  • the access control application 211 may perform a data packet update check. For example, the access control application 211 may check whether data packet inspection for authentication renewal is necessary based on authentication information included in the data flow. For example, when inspection of a data packet for authentication renewal is required, the access control application 211 may inspect the data packet requested to be transmitted according to the authentication renewal method included in the authentication information.
  • the connection control application 211 when the data packet requested to be transmitted is a TCP SYN Packet or a TCP FIN Packet, and the amount of transmitted data packets exceeds the amount of data packets included in the data flow, the connection control application 211 If the data flow update conditions are met according to a series of rules included in the authentication information, such as including the update processing character (Suffix) of the data packet included in the flow, the data flow update procedure can be performed. For example, the access control application 211 can change the update status of the data flow to update required, transmit information about the data flow to the controller 202, and request update of the data flow (operation 1020).
  • the controller 202 may update the data flow based on information about the data flow received from the access control application 211.
  • the controller 202 may transmit the updated data flow to the gateway 203.
  • operations 1020 to 1030 may not be performed if update of the data flow is not necessary.
  • the access control application 211 may transmit and process the data packet. Additionally, when authentication renewal is completed, the access control application 211 can transmit and process data packets. Additionally, the access control application 211 may transmit the data packet when the inspection of the data packet is completed through operation 1010 or operation 1015. Depending on the embodiment, the access control application 211 may drop the data packet if the inspection of the data packet fails in operation 1010 or operation 1015.
  • Figure 11 shows a signal flow diagram for controlling reception of data packets by a gateway according to various embodiments.
  • the gateway 203 can check whether the data packet is authenticated and whether renewal is necessary before forwarding the data packet, and can control not to forward the data packet if it is not authenticated or requires renewal. there is.
  • gateway 203 may detect a data packet reception event.
  • the gateway 203 may detect data packets transmitted from the access control application 211 of the node 201.
  • the gateway 203 can check the source IP and identification information of the destination network of the received data packet, and check whether a data flow corresponding to the source IP and the identification information of the destination network exists. Depending on the embodiment, if there is no data flow corresponding to the identification information of the source IP and destination network, the gateway 203 may drop the data packet.
  • the gateway 203 may perform a data packet authentication check. For example, the gateway 203 may check authentication information included in the data flow corresponding to the destination network identification information of the received data packet. The gateway 203 can check whether each data packet contains an authentication data packet based on the authentication information, and can perform a data packet test when it is necessary to check whether the authentication data packet is included. In this case, the gateway 203 may drop the data packet if the authentication data packet included in the data packet does not exist or if the authentication information included in the data packet is different from the authentication information included in the data flow. For another example, if it is not necessary to check whether the authentication data packet is included, the gateway 203 may perform operation 1120.
  • the gateway 203 may perform a data packet update check. For example, the gateway 203 may determine whether data packet inspection for authentication renewal is necessary based on authentication information included in the data flow. For example, when inspection of a data packet for authentication renewal is necessary, the gateway 203 may inspect the received data packet according to the authentication renewal method included in the authentication information. Depending on the embodiment, the gateway 203 includes the received data packet in the data flow if the received data packet is a TCP SYN Packet or a TCP FIN Packet and the amount of the received data packet exceeds the amount of data packets included in the data flow.
  • the gateway 203 includes the received data packet in the data flow if the received data packet is a TCP SYN Packet or a TCP FIN Packet and the amount of the received data packet exceeds the amount of data packets included in the data flow.
  • the data flow update procedure can be performed.
  • the gateway 230 may change the update status of the data flow to need to be updated, transmit information about the data flow to the controller 202, and request an update of the data flow (operation 1125).
  • the controller 202 may update the data flow based on information about the data flow received from the gateway 203.
  • operations 1125 and 1130 may not be performed if update of the data flow is not necessary.
  • the gateway 203 may forward the data packet. Additionally, when authentication renewal is completed, the gateway 203 may forward the data packet. Additionally, the gateway 203 may forward the data packet when the inspection of the data packet is completed through operation 1115 or operation 1120. Depending on the embodiment, the gateway 203 may drop the data packet if the inspection of the data packet fails in operation 1115 or operation 1120.
  • Figure 12 shows a signal flow diagram for updating the control flow of a node according to various embodiments.
  • the access control application 211 maintains information about the control flow and data flow of the node 201, and periodically checks the control flow to receive an updated data flow from the controller 202 or check whether the control flow is valid. You can request renewal.
  • the access control application 211 may detect a control flow update event.
  • the access control application 211 may request a control flow update from the controller 202 based on control flow identification information.
  • the controller 202 may check whether a control flow exists in a control flow table (e.g., control flow table 315 of FIG. 3) based on the received control flow identification information.
  • a control flow does not exist (e.g., when the connection is disconnected by another security system, when the connection is disconnected due to its own risk detection, etc.)
  • the controller 202 determines that the connection of the node 201 is valid. Since this is not done, a connection failure result can be transmitted to the access control application 211 (operation 1220).
  • the controller 202 may update the update time when a control flow exists in the control flow table (e.g., the control flow table 315 in FIG. 3). In this case, the controller 202 may transmit the updated identification information of the control flow to the access control application 211 (operation 1220).
  • the control flow table e.g., the control flow table 315 in FIG. 3
  • the controller 202 may transmit the updated identification information of the control flow to the access control application 211 (operation 1220).
  • the controller 202 if re-authentication is required among data flows dependent on the identified control flow, or if there is a data flow that is no longer accessible, the controller 202 sends information about the data flow to the access control application ( 211) (operation 1220).
  • the access control application 211 of the node 201 may process the result of the response received from the controller 202. For example, the access control application 211 may block all network connections of the application when the control flow update result is impossible. For another example, the access control application 211 may update the data flow if the control flow update result is normal and updated data flow information exists.
  • Figure 13 shows a signal flow diagram for disconnection of a node according to various embodiments.
  • the node 201 terminates the node 201, terminates the connection control application 211, terminates the target application, no longer uses the network connection, and collects information identified from the interworking system. Based on , at least one of the connection termination requests can be detected. In this case, in operation 1310, the node 201 or the access control application 211 may request the controller 202 to remove the control flow.
  • the controller 202 may remove the identified control flow based on the received control flow identification information.
  • the controller 202 may remove all data flows dependent on the removed control flow. Accordingly, node 201 can no longer connect to the destination network based on the removed data flow.
  • the controller 202 may request the gateway 203 to remove all data flows dependent on the removed control flow.
  • Figure 14 shows a signal flow diagram for termination of application execution of a node according to various embodiments.
  • the access control application 211 of the node 201 can check in real time whether the running application is terminated and detect an application execution termination event.
  • the access control application 211 may check whether a data flow corresponding to the terminated application identification information and PID (Process ID and Child Process ID Tree) information exists. If a data flow exists, the access control application can delete the data flow. Depending on the embodiment, the access control application 211 may check whether the terminated application exists in the running process list in order to track termination of multiple executable applications, and if not, identify the terminated application. All data flows corresponding to can be deleted.
  • PID Process ID and Child Process ID Tree
  • the access control application 211 may request deletion of the deleted data flow from the controller 202.
  • the controller 202 may delete the data flow for which deletion has been requested. Additionally, the controller 202 may request the gateway 203 to remove a deleted data flow. Accordingly, data packets corresponding to the source network, destination network, and port information included in the deleted data flow can no longer be transmitted.
  • Figure 15 shows an operation flowchart of a method of operating an access control application installed in a node according to various embodiments.
  • the operation shown in FIG. 15 may be performed through the access control application 211 installed on the node 201 of FIG. 2.
  • the access control application 211 may detect a network connection event.
  • the connection control application 211 may detect a network connection event by detecting a data packet that the target application wants to transmit to the destination network.
  • the access control application 211 may confirm the existence of a data flow authorized from an external server and corresponding to the data packet that the target application wants to transmit.
  • the access control application 211 may check the type of data packet. For example, the connection control application 211 can determine whether a data packet is a TCP SYN packet, an authentication data packet, or neither a TCP SYN packet nor an authentication data packet.
  • the connection control application 211 may allow transmission of the TCP SYN packet based on whether the TCP SYN packet can be transmitted.
  • the access control application 211 may perform a network connection authentication check related to whether the authentication data packet can be transmitted.
  • connection control application 211 may drop the data packet.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Le présent document divulgue, selon un mode de réalisation, un nœud qui stocke des instructions pour détecter un événement d'accès au réseau au moyen d'une application de contrôle d'accès, pour confirmer la présence d'un flux de données, qui correspond à un paquet de données à transmettre par une application cible et qui est appliqué à partir d'un serveur externe, pour confirmer le type du paquet de données, pour permettre la transmission d'un paquet SYN TCP sur la base du fait que le paquet SYN TCP peut être transmis sur la base du type du paquet de données, pour réaliser une vérification d'authentification d'accès au réseau après la génération d'une session TCP ou s'il n'est pas nécessaire de vérifier le paquet SYN TCP, et pour traiter des paquets de données transmis par la suite sur la base du résultat de vérification d'authentification, le flux de données pouvant comporter des informations indiquant s'il faut autoriser fondamentalement la transmission du paquet SYN TCP.
PCT/KR2023/005573 2022-04-25 2023-04-24 Système permettant de contrôler un accès au réseau basé sur un dispositif de commande, et procédé associé WO2023211104A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR10-2022-0050926 2022-04-25
KR1020220050926A KR102495369B1 (ko) 2022-04-25 2022-04-25 컨트롤러 기반 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법

Publications (1)

Publication Number Publication Date
WO2023211104A1 true WO2023211104A1 (fr) 2023-11-02

Family

ID=85224484

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2023/005573 WO2023211104A1 (fr) 2022-04-25 2023-04-24 Système permettant de contrôler un accès au réseau basé sur un dispositif de commande, et procédé associé

Country Status (2)

Country Link
KR (1) KR102495369B1 (fr)
WO (1) WO2023211104A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102495369B1 (ko) * 2022-04-25 2023-02-06 프라이빗테크놀로지 주식회사 컨트롤러 기반 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102593271B1 (ko) * 2023-02-22 2023-10-25 프라이빗테크놀로지 주식회사 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120227088A1 (en) * 2009-09-08 2012-09-06 Huawei Technologies Co., Ltd. Method for authenticating communication traffic, communication system and protective apparatus
JP2017175462A (ja) * 2016-03-24 2017-09-28 学校法人東京電機大学 通信制御装置、通信制御方法、及びプログラム
KR102223827B1 (ko) * 2019-09-24 2021-03-08 프라이빗테크놀로지 주식회사 단말의 네트워크 접속을 인증 및 제어하기 위한 시스템 및 그에 관한 방법
KR102333553B1 (ko) * 2021-05-07 2021-12-01 프라이빗테크놀로지 주식회사 컨트롤러 기반의 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102377247B1 (ko) * 2021-06-09 2022-03-23 프라이빗테크놀로지 주식회사 컨트롤러 기반의 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102495369B1 (ko) * 2022-04-25 2023-02-06 프라이빗테크놀로지 주식회사 컨트롤러 기반 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120227088A1 (en) * 2009-09-08 2012-09-06 Huawei Technologies Co., Ltd. Method for authenticating communication traffic, communication system and protective apparatus
JP2017175462A (ja) * 2016-03-24 2017-09-28 学校法人東京電機大学 通信制御装置、通信制御方法、及びプログラム
KR102223827B1 (ko) * 2019-09-24 2021-03-08 프라이빗테크놀로지 주식회사 단말의 네트워크 접속을 인증 및 제어하기 위한 시스템 및 그에 관한 방법
KR102333553B1 (ko) * 2021-05-07 2021-12-01 프라이빗테크놀로지 주식회사 컨트롤러 기반의 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102377247B1 (ko) * 2021-06-09 2022-03-23 프라이빗테크놀로지 주식회사 컨트롤러 기반의 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102495369B1 (ko) * 2022-04-25 2023-02-06 프라이빗테크놀로지 주식회사 컨트롤러 기반 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법

Also Published As

Publication number Publication date
KR102495369B1 (ko) 2023-02-06

Similar Documents

Publication Publication Date Title
WO2021060854A1 (fr) Système de commande d'accès réseau et procédé associé
WO2023163509A1 (fr) Système de commande de connexion de réseau reposant sur un dispositif de commande et procédé associé
WO2022231306A1 (fr) Système de commande de connexion réseau basée sur un contrôleur et procédé correspondant
WO2023033586A1 (fr) Système de commande d'accès réseau d'une application d'après une commande de session tcp, et procédé associé
WO2023038387A1 (fr) Système de commande d'accès réseau d'application sur la base d'un flux de données, et procédé associé
WO2023146308A1 (fr) Système de commande d'accès au réseau sur la base d'un contrôleur, et procédé associé
WO2023211104A1 (fr) Système permettant de contrôler un accès au réseau basé sur un dispositif de commande, et procédé associé
WO2023085793A1 (fr) Système de commande d'accès au réseau sur la base d'un dispositif de commande, et procédé associé
WO2023211124A1 (fr) Système de commande de connexion de réseau basée sur un contrôleur et procédé associé
KR102396528B1 (ko) 컨트롤러 기반 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
WO2023085791A1 (fr) Système de contrôle de l'accès au réseau basé sur un contrôleur et procédé associé
WO2023211122A1 (fr) Système de commande de transmission et de réception de fichier d'une application sur la base d'un mandataire et procédé associé
WO2023163514A1 (fr) Système de commande d'accès au réseau basé sur un dispositif de commande et procédé associé
WO2023136658A1 (fr) Système et procédé reposant sur un dispositif de commande de commande d'accès réseau
WO2023177238A1 (fr) Système de commande de connexion au réseau basé sur un contrôleur, et son procédé
WO2023090755A1 (fr) Système de contrôle d'accès au réseau d'instance de virtualisation, et procédé associé
WO2023146304A1 (fr) Système de commande de transmission et de réception d'un fichier d'une application et procédé associé
WO2022231304A1 (fr) Système de contrôle d'accès à un réseau basé sur un contrôleur et procédé associé
WO2023033588A1 (fr) Système de commande de flux de données dans un terminal de virtualisation, et procédé associé
WO2021060859A1 (fr) Système d'authentification et de contrôle d'accès au réseau d'un terminal, et procédé associé
WO2023211121A1 (fr) Système de commande d'émission et de réception de fichier d'application sur la base d'un proxy, et procédé associé
WO2023163506A1 (fr) Système de commande de transmission et de réception de fichier d'application, et procédé associé
WO2023211120A1 (fr) Système de commande d'émission et de réception de fichiers d'une application sur la base d'un mandataire, et procédé associé
WO2023068553A1 (fr) Système pour contrôler une connexion réseau sur la base d'un contrôleur, et procédé associé
WO2023163504A1 (fr) Système de commande de transmission et de réception de fichier d'application, et procédé associé

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23796749

Country of ref document: EP

Kind code of ref document: A1