KR102377247B1 - System for controlling network access based on controller and method of the same - Google Patents

Abstract

The present invention relates to a system for controlling network access based on a controller to block transmission of data packets from an unauthorized target and a method thereof. According to one embodiment of the present invention, a node comprises: a communication circuit, a processor operatively connected to the communication circuit, and a memory operatively connected to the processor and storing a target application and a connection control application. The memory stores instructions allowing the node, during execution by the processor, to request network access to a service server of the target application from an external server through the access control application; receive a data flow corresponding to an IP and port of the service server from the external server through the access control application, wherein the data flow includes authentication information for generate a secure session between the node and the service server; transmit an authentication data packet including the authentication information through the access control application; receive an authentication result for the authentication data packet from a gateway existing at a network boundary of the node and the service server through the access control application; and generate the secure session with the service server through the access control application.

Description

SYSTEM FOR CONTROLLING NETWORK ACCESS BASED ON CONTROLLER AND METHOD OF THE SAME

Embodiments disclosed herein relate to a system for controlling a controller-based network connection and a method therefor.

Multiple devices may communicate data over a network. For example, the terminal may transmit or receive data with the server through the Internet. The network may include a public network such as the Internet as well as a private network such as an intranet.

The terminal communicates with the server by using IP (Internet Protocol)-based TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), Firewall technology may be used. In the case of IP communication, since data packets are transmitted in plain text, there is a problem that a third party can easily read important information of data packets using sniffing technology such as tapping equipment or rouge WiFi. In order to solve this problem, a VPN (Virtual Private Network) technology and tunneling technology for encrypting data packets between the terminal and the server are used.

Tunneling technology is created between a TSP (Tunnel Start Point) terminal and a TEP (Tunnel End Point) gateway. Control can be limited in scope. In addition, since the tunneling technology needs to set up a wide network band, it may be difficult to control each application running in the terminal and communication in the service server unit to which the application wants to access.

In order to compensate for the shortcomings of the tunneling technology, a secure session technology that can guarantee secure communication more easily and conveniently than tunneling may be considered. For example, for protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), Datagram Transport Layer Security (DTLS), Mutual Transport layer Security (MTLS), or Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS). A secure session technique may be applied.

In the secure session technology, the terminal and the service server must perform session creation and negotiation in advance. Due to the nature of IP communication based on the Open Systems Interconnection (OSI) 7 layer, the communication requesting target (eg, the terminal or Since there is no way to check whether the application) is a pre-authorized safe target, it is difficult to block unauthorized targets at the network level (ie, OSI layer 7). Although the service server may block the connection of a target that does not satisfy the authentication conditions, this method is not allowed because it is possible after a TCP session or a secure session has already been created or a service protocol access procedure (eg HTTP) has been performed. It is not possible to fundamentally block or cancel network access of an unauthorized target, and an attacker can perform a Denial of Service (DoS) attack through a well-known protocol such as HTTPS and an open port. Furthermore, when the security function included in the application of the terminal is not executed or a risk factor exists in the application, even if the terminal or the network detects it, there is no method to block the detected threat in the network connection state.

In addition, when an application to access the service server creates a secure session with the service server, individual modifications may be required for each application for data packet authentication or information processing for secure session creation.

Various embodiments disclosed in this document are intended to provide a system for solving the above-described problems in a network environment and a method therefor.

A node according to an embodiment disclosed herein comprises a communication circuitry, a processor operatively coupled to the communication circuitry, and a memory operatively coupled to the processor for storing a target application and a connection control application, the The memory, when executed by the processor, causes the node to request, through the access control application, a network connection to a service server of the target application from an external server, and to provide the service from the external server through the access control application. Receive a data flow corresponding to an IP and port of a server, wherein the data flow includes authentication information for creating a secure session between the node and the service server, and through the access control application, authentication including the authentication information transmit a data packet, receive an authentication result for the authentication data packet from a gateway existing at a network boundary between the node and the service server through the access control application, and through the access control application, the service server and commands for creating the secure session.

A server according to an embodiment disclosed in this document includes a communication circuit, a memory for storing a database, and a processor operatively connected to the communication circuit and the memory, wherein the processor is configured to: Receives a network access request to the service server of the target application, checks whether the target application is accessible based on the identification information of the target application and the IP and port of the service server, and if the target application is accessible , generate a data flow including authentication information for creating a secure session between the node and the service server, and transmit the data flow to a gateway and the access control application existing at a boundary between the node and the service server can be configured.

A gateway according to an embodiment disclosed in this document receives, from an external server, a data flow including authentication information for creating a secure session between a node and a service server, and receives an authentication data packet from an access control application of the node and performs authentication on the authentication data packet based on authentication information of the data flow, and when the authentication succeeds, transmits an authentication result to the access control application, and the access control application for creating the secure session and forwarding the data packet between the service server.

A method of operating a connection control application stored in a node according to an embodiment disclosed in this document includes an operation of requesting an external server for a network connection to a service server of a target application, and corresponding to the IP and port of the service server from the external server receiving a data flow that includes authentication information for creating a secure session between the node and the service server, and transmitting an authentication data packet including the authentication information, the node and the service server receiving an authentication result for the authentication data packet from a gateway existing at a network boundary of , and creating the secure session with the service server.

The method of operating a server according to an embodiment disclosed in this document includes the operation of receiving a network access request for a service server of a target application from an access control application of a node, identification information of the target application, and IP and port of the service server Checking whether the target application is accessible based on and transmitting the data flow to a gateway existing at a boundary between the node and the service server and the access control application.

The method of operating a gateway according to an embodiment disclosed in this document includes, from an external server, an IP and port of a service server, and an operation of receiving a data flow including authentication information for creating a secure session between a node and the service server , receiving an authentication data packet from the access control application of the node, performing authentication on the authentication data packet based on the authentication information of the data flow, and if the authentication is successful, send an authentication result to the access control application and forwarding a data packet between the access control application and the service server for creating the secure session.

According to the embodiments disclosed in this document, a system for controlling network access provides a method for allowing only an authorized target to access a network based on a secure session, and may block data packet transmission of an unauthorized target.

According to the embodiments disclosed in this document, a system for controlling network access provides a method for detecting and disconnecting threats to an invalid target, and clarifying an ambiguous network connection disconnection point between an application and a service server. It can facilitate life cycle management.

According to the embodiments disclosed in this document, a system for controlling network access blocks a data packet transmitted by an unauthorized target through a gateway to prevent DoS attacks and brute force attacks through service resource access. can

According to the embodiments disclosed in this document, a system for controlling network access overcomes the problems inherent in existing IP communication by implementing a secure network connection lifecycle ranging from application's network access control, threat blocking, and isolation. and can provide a secure network connection.

According to the embodiments disclosed in this document, a node can control data transmission in the transport layer more easily and in detail compared to a tunneling technology that protects data packets in a wide network range without application modification.

According to the embodiments disclosed in this document, the gateway may block a potentially dangerous element by forwarding a data packet between an application and a service server based on a secure session and blocking other data packets.

In addition, various effects directly or indirectly identified through this document may be provided.

1A-1B illustrate architectures within a network environment according to various embodiments.
2 is a functional block diagram illustrating a database stored in a controller according to various embodiments of the present disclosure;
3 illustrates information included in a control flow and a data flow according to various embodiments of the present disclosure.
4 is a functional block diagram of a node according to various embodiments.
5 illustrates an operation of controlling transmission of a data packet according to various embodiments.
6 illustrates a signal flow diagram for controller connection according to various embodiments.
7 illustrates a user interface screen for accessing a controller according to various embodiments of the present disclosure;
8 illustrates a signal flow diagram for user authentication according to various embodiments.
9 illustrates a signal flow diagram for a network connection according to various embodiments.
10A to 10B show user interface screens related to network connection.
11 illustrates a signal flow diagram for data flow update according to various embodiments.
12 illustrates a signal flow diagram for control flow update according to various embodiments.
13 illustrates a signal flow diagram for control flow cancellation in accordance with various embodiments.
14 illustrates a signal flow diagram for data flow cancellation in accordance with various embodiments.
15 illustrates a user interface screen related to termination of a connection according to various embodiments of the present disclosure;
16 is a flowchart illustrating an operation of a node for creating a secure session according to various embodiments of the present disclosure;
17 is a flowchart illustrating an operation of a server for creating a secure session according to various embodiments of the present disclosure.
18 is a flowchart illustrating an operation of a gateway for creating a secure session according to various embodiments of the present disclosure.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

In this document, the singular form of a noun corresponding to an item may include one or a plurality of items, unless the context clearly indicates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A; Each of the phrases such as "at least one of B, or C" may include any one of, or all possible combinations of, items listed together in the corresponding one of the phrases. Terms such as "first", "second", or "first" or "second" may be used simply to distinguish the element from other elements in question, and may refer to elements in other aspects (e.g., importance or order) is not limited. It is said that one (eg, first) component is "coupled" or "connected" to another (eg, second) component, with or without the terms "functionally" or "communicatively". When referenced, it means that one component can be connected to the other component directly (eg by wire), wirelessly, or through a third component.

Each component (eg, a module or a program) of components described in this document may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. . According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repetitively, or heuristically, or one or more of the operations are executed in a different order, omitted, or , or one or more other operations may be added.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit or a part of the part that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or an application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one of the one or more instructions stored from the storage medium and execute it. This makes it possible for the device to be operated to perform at least one function according to the called at least one command. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not include a signal (eg, electromagnetic wave), and this term is used in cases where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

Methods according to various embodiments disclosed in this document may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or via an application store or between two user devices (eg smartphones). It can be distributed directly or online (eg, downloaded or uploaded). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

1A-1B illustrate architectures within a network environment according to various embodiments.

1A to 1B , the node 201 may be various types of devices capable of performing data communication. For example, the node 201 may be a portable device such as a smartphone or tablet, a computer device such as a desktop or laptop, a multimedia device, a medical device, a camera, a wearable device, a virtual reality (VR) device, Alternatively, it may include a home appliance and is not limited to the above-described devices. For example, node 201 may include a server or gateway capable of sending data packets through an application. The node 201 may also be referred to as an 'electronic device' or a 'terminal'.

The node 201 may store a plurality of target applications 211-1 and 211-2. Each of the target applications 211-1 and 211-2 may transmit data packets to the service servers 205-1 and 205-2, or vice versa. Some of the target applications 211-1 and 211-2 may be trusted and/or secured applications, such as web browsers or business applications, while others may be untrusted or unsecured malicious programs.

The node 201 may store the access control application 212 for reliable data transmission between the target applications 211-1 and 211-2 and the service servers 205-1 and 205-2. The access control application 212 may operate as a kernel or a network driver to control network access of the target applications 211-1 and 211-2 stored in the node 201 . The access control application 212 is a service server 205- of an unauthorized program (application) through the secure sessions 220-1 to 220-4 between the node 201 and the service servers 205-1 and 205-2. 1, 205-2) can be blocked and the program can be quarantined. For example, the access control application 212 creates secure sessions 220-1 and 220-2 between the access control application 212 and the service servers 205-1 and 205-2 as shown in FIG. 1A. Alternatively, as shown in FIG. 1B , secure sessions 220-3 and 220-4 may be created between the target applications 211-1 and 211-2 and the service servers 205-1 and 205-2. . In this case, the access control application 212 checks whether the target applications 211-1 and 211-2 are accessible from the controller 202 before creating the secure sessions 220-1 to 220-4, If access is possible, authentication with the gateway 203 may be performed through the data packet authenticated by the controller 202 . When authentication is completed, the access control application 212 may create secure sessions 220-1 to 220-4 with the service servers 205-1 and 205-2.

The controller 202 may be, for example, a server (or cloud server). The controller 202 can ensure reliable data transmission within the network environment by managing data transmission between the node 201 , the gateway 203 , and the service servers 205 - 1 and 205 - 2 . For example, the controller 202 may allow network access of the authorized node 201 (or target applications 211-1 and 211-2) through policy information or blacklist information. In addition, the controller 202 mediates the creation of secure sessions 220-1 to 220-4 between the node 201 and the service servers 205-1 and 205-2, or from the node 201 or the gateway 203. The security sessions 220 - 1 to 220 - 4 may be removed according to the collected security event. The target applications 211-1 and 211-2 can communicate with the service servers 205-1 and 205-2 only through the secure sessions 220-1 to 220-4 authorized by the controller 202, If the authorized secure sessions 220 - 1 to 220 - 4 do not exist, network access of the node 201 and the target applications 211-1 and 211 - 2 may be blocked. According to an embodiment, the controller 202 performs various operations (eg, registration, approval, authentication, renewal, termination) related to network access of the node 201 or the target applications 211-1 and 211-2. For this purpose, each access control application 212 may transmit and receive a control data packet. A flow (eg, 230 ) through which a control data packet is transmitted may be referred to as a 'control flow'.

The gateway 203 may be located at a boundary of a network to which the node 201 belongs or a boundary of a network to which the service servers 205 - 1 and 205 - 2 belong. According to an embodiment, the gateway 203 may be connected to the controller 202 based on a cloud. The gateway 203 may forward only the authorized data packets among the data packets received from the node 201 to the service servers 205 - 1 and 205 - 2 . A flow in which data packets are transmitted between the target applications 211-1 and 211-2 (or the access control application 212), the gateway 203, and the service servers 205-1 and 205-2 (eg, 240) -1 to 240-4) may be referred to as 'data flow'. Data flows can be created not only on a node or IP basis, but also on a more granular basis (eg, an application). Gateway 203 performs authentication of the access control application 212 before the creation of secure sessions 220-1 to 220-4 between the node 201 and the service servers 205-1 and 205-2, and the target application By forwarding only the data packets transmitted through the secure sessions 220-1 to 220-4 among the data packets of 211-1 and 211-2 to the service servers 205-1 and 205-2, reckless network access is prevented in advance. can be blocked on

2 is a functional block diagram illustrating a database stored in the controller 202 according to various embodiments of the present disclosure, and FIG. 3 illustrates control flow information 340 and data flow information 350 among information included in the database.

Referring to FIG. 2 , the controller 202 may store databases 311 to 317 for controlling network access and data transmission in the memory 330 . 2 shows only the memory 330, the controller 202 communicates with an external electronic device (eg, the node 201, the gateway 203, or the service servers 205-1 and 205-2 of FIG. 1). It may further include a communication circuit for performing (eg, the communication circuit 430 of FIG. 4 ) and a processor (eg, the processor 410 of FIG. 4 ) for controlling the overall operation of the controller 202 . Since the administrator can access the controller 202 and set a connection-oriented policy for controlling the connection between the target applications 211-1 and 211-2 and the service servers 205-1 and 205-2, the service end You can control network access more precisely and safely than managing sessions.

The access policy database 311 may include information on networks and/or services to which the identified network, node, or application can connect. For example, when the access control application 212 requests network access, the controller 202 enables service access of the identified target applications 211-1 and 211-2 based on the policy of the access policy database 311 . can check whether The controller 202 may create a whitelist of target applications accessible by a specific service (eg, IP and port) based on the access policy database 311 .

The secure session policy database 312 includes information on the gateway 203 existing at the network boundary of the service servers 205-1 and 205-2 on the connection path, and the target applications 211-1 and 211-2. Authentication type and method for the gateway 203 to authenticate data packets in order to access the service servers 205-1 and 205-2; ) is not generated, expiration time information for releasing the network connection, expiration time information for periodic updating of data flow, or monitoring the secure sessions 220-1 to 220-4 in the gateway 203 may include at least one of secure session type information for

The blacklist policy database 313 is a target (eg, node ID ( identifier), an IP address, a media access control (MAC) address, or at least one of a user ID) may represent a blacklist registration policy for blocking access.

The blacklist database 314 may include a list of objects blocked by the blacklist policy database 313 . For example, when the identification information of the node 201 requesting network access is included in the blacklist database 314 , the controller 202 may isolate the node 201 by rejecting the network access request.

The control flow table 315 is an example of a session table for managing the flow (ie, control flow) of control data packets generated between the access control application 212 and the controller 202 . For example, referring to FIG. 3 , when the access control application 212 successfully accesses the controller 202 , the control flow information 340 and the control flow ID 342 (also referred to as 'control flow identification information') may be generated by the controller 202 . The control flow information 340 may include identification information 344 indicating at least one of an IP, a node, an application, or a target additionally identified through association with a service server, which is identified during controller access and authentication. For example, when a network access request of the access control application 212 is received, the controller 202 sets the control flow ID and identification information included in the access request to the control flow ID 342 included in the control flow information 340 and By mapping with the identification information 344 , it is possible to determine whether the access control application 212 is accessible and whether the data flow for generating the secure sessions 220 - 1 to 220 - 4 can be created. The state information 346 may indicate various states such as creation, authentication, update, termination, and the like, of a control flow.

According to an embodiment, since the control flow has an expiration time, the node 201 needs to update the expiration time of the control flow based on the time information 348, and if the expiration time is not updated for a certain period of time, the control flow ( Alternatively, the control flow information 340 may be removed. In addition, according to the security event collected from the node 201, the access control application 212, another security application (not shown), or the gateway 203, it is determined that immediate access blocking is necessary, or a connection termination request is made from them. Once received, the controller 202 may remove the control flow. When the control flow is removed, the associated data flow is also removed, and the gateway 203 may block the access control application 212 from accessing the service servers 205 - 1 and 205 - 2 .

Referring back to FIG. 2 , the secure session table 316 includes secure sessions 220-1 and 220-2, or targets, created between the access control application 212 and the service servers 205-1 and 205-2. This is a table for managing the secure sessions 220-3 and 220-4 created between the applications 211-1 and 211-2 and the service servers 205-1 and 205-2. According to an embodiment, the secure session table 316 may be included in the data flow table 317 , and information included in the secure session table 316 may be applied to the description of the data flow table 317 of FIG. 3 .

The data flow table 317 is a table for managing a flow (eg, data flow) through which detailed data packets are transmitted between the node 201 and the gateway 203 and the service servers 205-1 and 205-2. am. Data flows can be created in TCP sessions, applications, or more granular units. The data flow table 317 may include an application ID for identifying whether a data packet transmitted from a source is an authorized data packet, a destination IP address, and/or a service port. Referring to FIG. 3 , the data flow information 350 may include a data flow ID 351 and a control flow ID 352 when the data flow is dependent on the control flow. In addition, the data flow information 350 performs data packet authentication of the gateway 203 to create secure sessions 220-1 to 220-4 between the node 201 and the service servers 205-1 and 205-2. authentication information 353 for, authorized destination information 354 for determining forwarding of a data packet based on the source IP and destination IP and port of the data packet, and/or secure session ID and certificate information, or secure session It may include secure session information 355 for managing whether the data packet is transmitted or not and the last transmission time. Similar to the control flow, since the data flow may have an expiration time, the data flow information 350 may include the time information 356 for periodic authentication (or renewal) of the data flow.

4 is a functional block diagram of a node 201 according to various embodiments. At least some of the configurations shown in FIG. 4 may be applied to the controller 202 , the gateway 203 , or the service servers 205 - 1 and 205 - 2 .

Referring to FIG. 4 , a node 201 may include a processor 410 , a memory 420 , and a communication circuit 430 . According to an embodiment, the node 201 may further include a display 440 to interface with a user.

The processor 410 may control the overall operation of the node. In various embodiments, the processor 410 may include one processor core or a plurality of processor cores. For example, the processor 410 may include a multi-core such as a dual-core, a quad-core, or a hexa-core. According to embodiments, the processor 410 may further include a cache memory located inside or outside. According to embodiments, the processor 410 may be configured with one or more processors. For example, the processor 410 may include at least one of an application processor, a communication processor, and a graphical processing unit (GPU).

All or part of processor 410 may be electrically or operatively (eg, memory 420 , communication circuitry 430 , or display 440 ) with other components within node 201 (eg, memory 420 , communication circuitry 430 , or display 440 ). operatively) coupled with or connected to. The processor 410 may receive commands from other components, interpret the received commands, and perform calculations or process data according to the interpreted commands. The processor 410 may interpret and process a message, data, command, or signal received from the memory 420 , the communication circuit 430 , or the display 440 . The processor 410 may generate a new message, data, instruction, or signal based on the received message, data, instruction, or signal. The processor 410 may provide the processed or generated message, data, instruction, or signal to the memory 420 , the communication circuitry 430 , or the display 440 .

The processor 410 may process data or signals generated or generated in a program. For example, the processor 410 may request instructions, data, or signals from the memory 420 to execute or control a program. The processor 410 may write (or store) or update instructions, data, or signals to the memory 420 to execute or control a program.

The memory 420 may store a command for controlling a node, a control command code, control data, or user data. For example, the memory 420 may include at least one of an application program, an operating system (OS), middleware, or a device driver. The memory 420 may include one or more of volatile memory and non-volatile memory. Volatile memory includes dynamic random access memory (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), and ferroelectric RAM (FeRAM). may include The nonvolatile memory may include a read only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, and the like. The memory 420 includes a nonvolatile medium such as a hard disk drive (HDD), a solid state disk (SSD), an embedded multi media card (eMMC), and a universal flash storage (UFS). may include more.

According to an embodiment, the memory 420 may store the target applications 211-1 and 211-2 and the access control application 212 of FIG. 1A . The access control application 212 creates a network connection and secure sessions 220-1 to 220-4 to the service servers 205-1 and 205-2 of the target applications 211-1 and 211-2, and the controller It is possible to perform a control flow creation and update function with the 202 . To this end, the access control application 212 may include one or more security modules. In an embodiment, the memory 420 may store the control flow information 340 and the data flow information 350 of FIG. 3 .

The communication circuit 430 may support establishment of a wired or wireless communication connection between the node 201 and an external electronic device (eg, the controller 202 or the gateway 203 ) and performing communication through the established connection. According to an embodiment, the communication circuit 430 is a wireless communication circuit (eg, a cellular communication circuit, a short-range wireless communication circuit, or a global navigation satellite system (GNSS) communication circuit) or a wired communication circuit (eg, a local area network (LAN) ) communication circuit, or power line communication circuit), and using the corresponding communication circuit among them, a short-distance communication network such as Bluetooth, WiFi direct or IrDA (infrared data association) or a cellular network, Internet, or long-distance communication such as a computer network It can communicate with an external electronic device through a network. The above-described various types of communication circuits 430 may be implemented as a single chip or as separate chips.

The display 440 may output content, data, or a signal. In various embodiments, the display 440 may display image data processed by the processor 410 . According to embodiments, the display 440 may be configured as an integrated touch screen by being coupled with a plurality of touch sensors (not shown) capable of receiving a touch input or the like. When the display 440 is configured as a touch screen, a plurality of touch sensors may be disposed above the display 440 or below the display 440 .

5 illustrates an operation of controlling transmission of a data packet according to various embodiments.

Referring to FIG. 5 , the access control application 212 may control the network access of the target application 211 as a kernel or network driver of the node 201 . For example, the access control application 212 is not connected to the controller 202 , the data packet of the target application 211 is not authenticated by the gateway 203 , or the node 201 and the service If a secure session between the servers 205 is not created, the access control application 212 may drop the data packet of the target application 211 without sending it. Even if the target application 211 transmits the data packet by bypassing the access control application 212 , the transmitted data packet may be blocked by the gateway 203 .

6 illustrates a signal flow diagram for controller connection according to various embodiments, and FIG. 7 illustrates a user interface screen for controller connection according to various embodiments.

Since the node 201 needs to be authorized by the controller 202 to access or receive the network, the access control application 212 requests the controller 202 to create a control flow to connect to the controller of the node 201 . can try

Referring to FIG. 6 , in operation 605 , the node 201 may detect a controller access event. For example, the node 201 may detect that the access control application 212 is installed and executed in the node 201 , and a connection to the controller 202 is requested through the access control application 212 .

For example, referring to FIG. 7 , when the access control application 212 is executed, the node 201 may display a user interface screen 710 for receiving information necessary for accessing the controller. The user interface screen 710 includes an input window 711 for inputting an IP or domain of the controller 202, an input window 712 for inputting a user ID, and/or an input window 713 for inputting a password. may include After information on the input windows 711 to 713 is input, the node 201 may detect a controller access event by receiving a button 714 for an authenticated user's controller access. For another example, if user authentication of the node 201 is not yet completed, the node 201 detects a controller access event by receiving a button 715 for controller access of an unauthorized user (ie, a guest). can do.

In operation 610 , the node 201 may request the controller 202 to access the controller. For example, the access control application 212 is the identification information of the node 201 (eg, terminal ID, IP address, MAC address), type, location, environment, identification information of the network to which the node 201 belongs, network system Any identification information generated by itself and/or identification information of the access control application 212 may be transmitted to the controller 202 .

In operation 615 , the controller 202 may identify whether a target (eg, the access control application 212 or the node 201 ) requesting access to the controller is accessible. According to an embodiment, the controller 202 determines whether the information received from the node 201 is included in the access policy database 311 or whether the node 201, the network to which the node 201 belongs, and/or access Based on at least one of whether the identification information of the control application 212 is included in the blacklist database 314, it is possible to check whether a target that has requested access to the controller is accessible. If accessible, the controller 202 may create a control flow between the node 201 (or access control application 212 ) and the controller 202 . In this case, the controller 202 generates control flow identification information in the form of a random number, and stores identification information of at least one of the node 201, the network to which the node 201 belongs, or the access control application 212 in the control flow table ( 315) can be stored. Information stored in the control flow table 315 (eg, control flow information 340 ) may include user authentication of the node 201 , information update of the node 201 , policy confirmation for network access of the node 201 , and / Or it can be used for validation.

In operation 620, the controller 202 may generate a target application whitelist to which a target identified through the access policy database 311 (eg, node 201, source network, or access control application 212) can access. there is. If the following operations 630 to 665 are not performed, the controller 202 may omit operation 620 .

In operation 625 , the controller 202 may transmit control flow information 340 including control flow identification information to the node 201 in response to the controller access request. When the target application whitelist is generated, the controller 202 may transmit the target application whitelist together with the control flow information 340 . According to an embodiment, when a target requesting access to the controller is unavailable or included in the blacklist, the controller 202 may transmit the access unavailable information in operation 625 without generating a control flow. In this case, the node 201 may output a user interface screen 720 indicating that access to the controller is impossible as shown in FIG. 7 . The user interface screen 720 may include a user interface 725 that indicates that access to the node 201 is blocked, and guides release of isolation through an administrator (eg, the controller 202 ).

In operation 630 , the node 201 checks whether an application included in the target application whitelist (eg, the target application 211 ) is installed, and if the application is installed, the node 201 performs an application check through the access control application 212 . can do. For example, the access control application 212 may perform an integrity and safety check (eg, application forgery, tampering, code signing check, fingerprint check) of the target application 211 according to the validation policy. .

In operation 635 , the node 201 may transmit the application check result to the controller 202 .

In operation 640 , the controller 202 may check authentication information for creating a secure session through the secure session policy database 312 . The authentication information may include, for example, at least one of an authentication method between the access control application 212 and the gateway 203 , an authentication expiration time, a secure session type, and a secure session expiration time. The controller 202 determines whether the data flow information 350 corresponding to the identification information of the target application 211 and the IP of the service server 205 and the service port exists and the authentication information checked in the data flow information 350 is You can check if it exists. If the data flow information 350 or the authentication information does not exist, the controller 202 may generate the corresponding information.

In operation 645 , the controller 202 may transmit a response to the application check result. For example, the controller 202 may transmit a data flow including authentication information to the access control application 212 . Also, in operation 650 , the controller 202 may transmit the data flow to the gateway 203 .

In operation 655 , the access control application 212 may transmit an authentication data packet including authentication information to a destination IP and a service port indicated by the data flow in order to authenticate the data flow. The authentication data packet may include identification information for authentication. The authentication data packet may arrive at the gateway 203 .

In operation 660, the gateway 203 may perform authentication through the authentication data packet. For example, the gateway 203 may check whether a data flow corresponding to the source IP and destination IP and service port indicated by the received authentication data packet exists. Additionally, the gateway 203 may check whether the authentication information or identification information of the authentication data packet is the same as the authentication information or identification information included in the data flow. If the data flow does not exist or the authentication information or identification information is not the same, the gateway 203 may drop the authentication data packet.

If the data flow exists and the authentication information or identification information is the same, the gateway changes the state of the data flow to the authenticated state, and the authentication is completed in operation 665 so that the node 201 can transmit a data packet for creating a secure session It is possible to transmit an authentication result indicating that the access control application 212 is. If an authentication result is not received within a specified time after transmitting the authentication data packet, the access control application 212 may change the state of the data flow to an authentication rejection state.

According to an embodiment, the node 201 may omit application inspection and data flow authentication procedures (eg, operations 630 to 665 ). For example, the node 201 may perform the application inspection or data flow authentication procedure in the user authentication procedure of FIG. 8 or the network access procedure of FIG. 9 . Alternatively, when the access control application 212 creates a secure session between the target application 211 and the service server 205 , the access control application 212 may omit the application inspection and data flow authentication procedure.

8 illustrates a signal flow diagram for user authentication according to various embodiments.

In order for the node 201 to be granted detailed access authority to the service server 205 , the access control application 212 may receive authentication for the user of the node 201 from the controller 202 .

Referring to FIG. 8 , in operation 805 , the access control application 212 may receive an input for user authentication. The input for user authentication may be, for example, a user input inputting a user ID and password. As another example, the input for user authentication may be a user input (eg, biometric information) for more enhanced authentication.

In operation 810 , the access control application 212 may request user authentication from the controller 202 . For example, the access control application 212 may transmit input information for user authentication to the controller 202 . If the control flow between the node 201 and the controller 202 has already been created, the access control application 212 may transmit input information for user authentication together with the control flow identification information.

In operation 815 , the controller 202 may authenticate the user based on information received from the access control application 212 . For example, the controller 202 may configure the user based on whether the user ID, password, and/or enhanced authentication information included in the received information is included in the access policy database 311 or the blacklist database 314 . can determine whether the is accessible or blocked. When the user is authenticated, the controller 202 may add the user's identification information (eg, user ID) in the control flow table corresponding to the received identification information of the control flow. The added user identification information may be used for an authenticated user's controller access or network access.

In operation 820, the controller 202 may generate a target application whitelist to which a target identified through the access policy database 311 (eg, node 201, a user, or a network to which the node 201 belongs) can access. there is. If the following operations 830 to 865 are not performed, the controller 202 may omit operation 820 .

In operation 825 , the controller 202 may transmit control flow information 340 to which user identification information is added to the node 201 in response to the user authentication request. When the target application whitelist is generated, the controller 202 may transmit the target application whitelist together with the control flow information 340 . According to an embodiment, when the target for which user authentication is requested is unavailable for access or is included in the blacklist, the controller 202 may transmit access unavailable information.

The following operations 830 to 865 are the same as or similar to operations 630 to 665 of FIG. 6 , and thus a redundant description will be omitted.

9 illustrates a signal flow diagram for a network connection according to various embodiments of the present disclosure, and FIGS. 10A to 10B illustrate a user interface screen related to a network connection. The operations shown in FIG. 9 may be implemented, for example, after the signal flow diagram of FIG. 8 .

Referring to FIG. 9 , in operation 905 , the node 201 may detect a network access event. For example, the access control application 212 may detect that a target application 212 , such as a web browser, attempts to access the service server 205 .

In operation 910 , the access control application 212 may request a network connection of the target application 211 to the service server 205 from the controller 202 . In this case, the access control application 212 may transmit target application identification information and identification information (eg, IP and service port) of the service server 205 to the controller 202 together with identification information of the control flow.

In an embodiment, the access control application 212 may check whether a data flow corresponding to the destination IP and port information exists before requesting a network connection. Also, the access control application 212 may check whether the data flow is valid even if the data flow exists. As an example, the access control application 212 performs an integrity and safety check (eg, application forgery, tampering, code signing check, fingerprint check) of the target application 211 according to the validation policy, and the controller ( According to the access policy received from 202 , it is possible to check whether access to the destination IP and port of the target application 211 is possible. If there is a valid data flow, the access control application 212 may omit the following operations and transmit the data packet of the target application 211 to the service server 205 through the secure session in operation 955 . If the data flow exists but is not valid, the access control application 212 may output a user interface screen (eg, 1010 of FIG. 10A ) indicating that the network connection fails without transmitting the data packet. If the data flow does not exist, the authentication time of the data flow expires and requires renewal, or if the data flow needs to be updated for other reasons, the access control application 212 may request the controller 202 to access the network. there is.

In operation 915 , the controller 202 responds to the received request, based on whether identification information indicating the target application 211 and the service server 205 is included in the access policy of the access policy database 311 . 211) can be checked. If the target application 211 is not accessible, the controller 202 may transmit information indicating that the connection is not possible in operation 920 . In this case, the access control application 212 may output a user interface screen (eg, 1020 of FIG. 10A ) indicating that access to the network is impossible through the display. If the target application 211 is accessible, the controller 202 may check authentication information for creating a secure session through the secure session policy database 312 . The controller 202 determines whether the data flow information 350 corresponding to the identification information of the target application 211 and the IP of the service server 205 and the service port exists and the authentication information checked in the data flow information 350 is You can check if it exists. If the data flow information 350 or the authentication information does not exist, the controller 202 may generate the corresponding information.

In operation 920 , the controller 202 may transmit a response to the network access request. For example, the controller 202 may transmit a data flow including authentication information to the access control application 212 . Also, in operation 925 , the controller 202 may send the data flow to the gateway 203 .

In operation 930 , the access control application 212 may transmit an authentication data packet including authentication information to a destination IP and a service port indicated by the data flow in order to authenticate the data flow. The authentication data packet may include identification information for authentication. The authentication data packet may arrive at the gateway 203 .

In operation 935 , the gateway 203 may perform authentication through the authentication data packet. For example, the gateway 203 may perform authentication according to the same principle as operation 660 of FIG. 6 . If the authentication is successful, the gateway changes the state of the data flow to the authentication complete state, and sends an authentication result indicating that authentication is completed in operation 940 to the access control application so that the node 201 can transmit a data packet for creating a secure session ( 212) can be transmitted.

In operation 945 , the access control application 212 may establish a secure session with the service server 205 . The secure session may be created based on at least one of TLS, DTLS, SSL, or its own algorithm. The gateway 203 may perform forwarding based on whether a data packet transmitted during the secure session creation process is an authenticated data packet, and may check whether a secure session is created through data packet monitoring. In one embodiment, the gateway 203 blocks the unauthorized data packet, and if the transmission of the unauthorized data packet is repeated, the access control application 212 or the node 201 is recognized as a risk to the controller 202 You can request to release data flow and control flow.

When the secure session is created, in operation 950 , the gateway 203 may transmit data flow update information indicating that the secure session is created to the controller 202 . The controller 202 may update the state of the data flow based on the received data flow update information.

When the secure session is created, in operation 955 , the access control application 212 transmits the data packet of the target application 211 to the service server 205 through the created secure session or vice versa, receives the data packet from the service server 205 . can receive For example, the node 201 may output the execution screen 1130 of the target application 211 on the display as shown in FIG. 10B . If the data packet of the target application 211 is not secure session-based, the access control application 212 or the gateway 203 may drop the data packet without forwarding it.

In one embodiment, the access control application 212 should perform authentication by sending an authentication data packet within a specified time, and if authentication is performed, it should create a secure session within the specified time. If authentication is not performed or secure session creation is not completed within the specified time, the data flow is removed, so that a potential risk of attacking the service server 205 through a malicious application can be blocked.

Through the above operation, the access control application 212 can transmit the data packet to the service server 205 only through the secure session allowed through the authorization of the controller 202 and the authentication procedure of the gateway 203 . In addition, the above operation may be implemented in conjunction with the user authentication function, and when the user authentication is released, the node 201 or the gateway 203 blocks the connection to more precisely control the network connection.

11 illustrates a signal flow diagram for data flow update according to various embodiments.

Referring to FIG. 11 , in operation 1105 , the gateway 203 may transmit data flow update information to the controller 202 . For example, the gateway 203 may transmit data flow update information when the creation of a secure session is completed as shown in FIG. 9 . As another example, the gateway 203 may transmit data flow update information when a specified time elapses or a risk is detected. The data flow update information may include at least one of an authentication expiration time, a secure session expiration time, a last data packet transmission time in the secure session, information about an erroneous authentication attempt, or information about an erroneous secure session creation attempt.

In operation 1110 , the controller 202 may examine data flow update information. For example, the controller 202 determines whether the expiration time has elapsed without the data flow being updated, whether a risk has been detected on the data flow, whether authentication performed on the data flow or creation of a secure session has not been completed for a specified amount of time, etc. can confirm.

In operation 1115 , the controller 202 may transmit test result information to the gateway 203 . For example, if the test result is successful, the controller 202 may transmit a data flow update result. For another example, if the test result fails, the controller 202 may request the gateway 203 to remove the data flow or the control flow in which the data flow persists. When a control flow is removed, a data flow dependent thereon may also be removed. The gateway 203 may update or remove the data flow based on the received information.

12 illustrates a signal flow diagram for control flow update according to various embodiments.

Referring to FIG. 12 , in operation 1205 , the access control application 212 may request a control flow update from the controller 202 to maintain a control flow and a data flow. In an embodiment, the access control application 212 may request control flow update including identification information of the control flow every specified period.

In operation 1210 , the controller 202 may examine the control flow. For example, the controller 202 may check whether a control flow indicated by the received identification information exists in the control flow table 315 or, if the control flow exists, whether a data flow dependent thereon exists. A control flow may not exist if the connection is released by another security system, the update time elapses, or if the connection is released due to risk detection.

In operation 1215 , the controller 202 may transmit the test result information to the access control application 212 . For example, if the check fails, the controller 202 may transmit connection unavailable information, and the node 201 may terminate the access control application 212 or block the network connection of the target application 211 . For another example, if the check succeeds, the controller 202 may update the expiration time of the control flow and the data flow dependent thereon, and transmit the updated information. In this case, the node 201 may update the control flow and data flow information.

13 illustrates a signal flow diagram for control flow cancellation in accordance with various embodiments.

Referring to FIG. 13 , in operation 1305 , the node 201 may request the controller 202 to terminate the control flow. For example, the node 201 may request termination of the control flow when the connection control application 212 terminates, the network connection is not used for a specified time, or a connection termination request is received from another system. For another example, when an event such as risk detection is detected by the security module included in the access control application 212 , the access control application 212 may request removal of the control flow.

In operation 1310 , the controller 202 may remove a control flow corresponding to the identification information received from the node 201 . The controller 202 may also remove data flows that are dependent on the removed control flow.

In operation 1315 , the controller 202 requests the gateway 203 to remove the data flow, and in operation 1320 , the gateway 203 may block the network access of the access control application 212 by removing the data flow.

14 illustrates a signal flow diagram for data flow cancellation in accordance with various embodiments.

Referring to FIG. 14 , in operation 1405 , the access control application 212 may request the controller 202 to end the data flow. For example, the access control application 212 may request termination of the data flow when it no longer needs to connect to the service server 205 , receives user input, or receives a connection termination request from another system.

In operation 1410 , the controller 202 may remove a data flow corresponding to the identification information received from the node 201 . In operation 1415 , the controller 202 requests the gateway 203 to remove the data flow, and in operation 1420 , the gateway 203 may block the network connection of the access control application 212 by removing the data flow.

15 illustrates a user interface screen related to termination of a connection according to various embodiments of the present disclosure;

Referring to FIG. 15 , the node 201 may receive a user input for selecting the connection termination button 5615 on the user interface screen 1510 output through the display. The node 201 may reconfirm the termination of the connection to the user by outputting the user interface screen 1520 including the pop-up window 1525 . When a user input terminating the connection is received, the node 201 may perform operation 1305 of FIG. 13 or operation 1405 of FIG. 14 .

16 is a flowchart illustrating an operation of a node for creating a secure session according to various embodiments of the present disclosure; The following operation flowchart may be implemented by the node 201 or the access control application 212 installed in the node 201 .

Referring to FIG. 16 , in operation 1610 , the access control application 212 may request a network connection to the service server 205 of the target application 211 from an external server (eg, the controller 202 ).

In operation 1620 , the access control application 212 may receive a data flow including authentication information for secure session creation from an external server. The data flow may correspond to identification information of the target application 211 and IP and port information of the service server 205 .

In operation 1630 , the access control application 212 may transmit an authentication data packet including authentication information.

In operation 1640 , the access control application 212 may receive an authentication result for the authentication data packet from the gateway 203 .

In operation 1650 , the access control application 212 may create a secure session with the service server 205 . In an embodiment, the access control application 212 may create a secure session directly with the service server 205 , or may create a secure session between the target application 211 and the service server 205 .

17 is a flowchart illustrating an operation of a server (eg, the controller 202) for creating a secure session according to various embodiments of the present disclosure.

Referring to FIG. 17 , in operation 1710 , the server may receive a network access request for the service server 205 of the target application 211 from the access control application 212 of the node 201 .

In operation 1720 , the server may check whether the target application 211 is accessible based on the identification information of the target application 211 and the IP and port of the service server 205 .

In operation 1730 , the server may generate a data flow including authentication information for creating a secure session between the node 201 and the service server 205 . The data flow may include identification information of the target application 211 and IP and port information of the service server 205 .

In operation 1740 , the server may send the data flow to the gateway 203 and the access control application 212 .

18 is a flowchart illustrating an operation of the gateway 203 for secure session creation according to various embodiments.

Referring to FIG. 18 , in operation 1810 , the gateway 203 receives a data flow including authentication information for creating a secure session between the node 201 and the service server 205 from an external server (eg, the controller 202 ). can receive

In operation 1820 , the gateway 203 may receive an authentication data packet from the access control application 212 of the node 201 .

In operation 1830 , the gateway 203 may authenticate the authentication data packet based on authentication information of the data flow.

If the authentication is successful, in operation 1840 , the gateway 203 may transmit the authentication result to the access control application 212 .

In operation 1850 , the gateway 203 may forward a data packet for creating a secure session between the access control application 212 and the service server 205 .

The above description is merely illustrative of the technical idea disclosed in this document, and those of ordinary skill in the art to which the embodiments disclosed in this document belong are not departing from the essential characteristics of the embodiments disclosed in this document. Various modifications and variations will be possible.

Therefore, the embodiments disclosed in this document are for explanation rather than limiting the technical ideas disclosed in this document, and the scope of the technical ideas disclosed in this document is not limited by these embodiments. The protection scope of the technical ideas disclosed in this document should be interpreted by the claims below, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present document.

Claims (17)

In the node,
communication circuit;
a processor operatively coupled to the communication circuitry; and
a memory operatively coupled to the processor and storing a target application and a connection control application, wherein the memory, when executed by the processor, causes the node to:
Through the access control application, request an external server to access the network connection to the service server of the target application,
Through the access control application, receive a data flow corresponding to an IP (internet protocol) and port of the service server from the external server, wherein the data flow is a secure session between the access control application or the target application and the service server including authentication information for creation;
transmit an authentication data packet including the authentication information through the access control application;
receiving an authentication result for the authentication data packet from a gateway existing at a network boundary between the node and the service server through the access control application; and
and storing instructions for creating, through the access control application, the secure session between the access control application or the target application and the service server based on a secure session creation data packet authenticated from the gateway. delete The method according to claim 1, wherein the instructions are executed by the node,
requesting controller access to the external server through the access control application;
receive a first response to the controller connection request from the external server through the access control application, wherein the first response includes identification information of a control flow generated between the access control application and the external server and an accessible application contains a list;
through the access control application, check the target application based on the application list,
Transmitting the target application inspection result to the external server through the access control application,
to receive the authentication information from the external server through the access control application. The method according to claim 3, wherein the instructions are executed by the node,
Detecting a network connection event of the target application to the service server through the access control application,
Through the access control application, check whether the data flow exists,
if the data flow does not exist, request the network connection to the external server including identification information of the control flow through the access control application. 5. The method of claim 4, wherein the instructions are executed by the node,
requesting the external server to update the control flow,
Receiving the inspection result of the control flow from the external server,
When the check result indicates that the connection is unavailable, at least one of the access control application or the target application is terminated, and
and when the test result is normal, update the data flow. The method according to claim 3, wherein the instructions are executed by the node,
and when the connection control application is terminated or the network connection is not used for a specified time, request the external server to terminate the control flow or the data flow. The method according to claim 1, wherein the instructions are executed by the node,
requesting user authentication from the external server through the access control application;
receive a second response to the user authentication request from the external server through the access control application, wherein the second response includes identification information of a control flow generated between the access control application and the external server and an accessible application contains a list;
through the access control application, check the target application based on the application list,
Transmitting the target application inspection result to the external server through the access control application,
to receive the authentication information from the external server through the access control application. in the server,
communication circuit;
a memory for storing the database; and
a processor operatively coupled with the communication circuitry and the memory, the processor comprising:
receiving a network connection request to a service server of the target application from the access control application of the node;
Based on the identification information of the target application and the IP and port of the service server, check whether the target application is accessible,
When the target application is accessible, a data flow including authentication information for creating a secure session between the node and the service server is generated;
sending the data flow to a gateway and the access control application existing at a boundary between the node and the service server, and
and receive data flow update information indicating that the secure session is created from the gateway when the secure session is created. The method according to claim 8, wherein the processor,
receiving a controller access request from the access control application;
Check whether the access control application is accessible,
If access is possible, create a control flow between the access control application and the server,
Create a list of accessible applications,
Transmitting the identification information of the control flow and the application list to the access control application,
a server configured to receive a test result of the target application from the access control application. The method according to claim 9, wherein the processor,
receive data flow update information indicating that the secure session is created from the gateway;
examine the data flow update information; and
and request the gateway to remove the control flow or the data flow based on the check result. The method according to claim 9, wherein the processor,
receiving a request for updating the control flow from the node;
examining the control flow; and
server, configured to transmit connection unavailable information to the node based on the check result. The method according to claim 9, wherein the processor,
receiving, from the node, a request to terminate the control flow or the data flow;
remove the control flow or the data flow based on the received request; and
and request the gateway to remove the control flow or the data flow. The method according to claim 8, wherein the processor,
receiving a user authentication request from the access control application;
Check whether the user can access,
If access is possible, create a list of accessible applications,
sending the application list to the access control application;
a server configured to receive a test result of the target application from the access control application. In the gateway,
Receive, from an external server, a data flow including an IP and port of a service server, and authentication information for creating a secure session between a node and the service server,
receiving an authentication data packet from a connection control application of the node;
performing authentication on the authentication data packet based on authentication information of the data flow;
If the authentication is successful, sending an authentication result to the access control application,
forwarding a data packet between the access control application and the service server for creating the secure session, and
and send data flow update information indicating that the secure session is created to the external server when the secure session is created. A method of operating a connection control application stored in a node, the method comprising:
requesting an external server to access a network connection to the service server of the target application;
receiving a data flow corresponding to the IP and port of the service server from the external server, the data flow including authentication information for creating a secure session between the access control application or the target application and the service server;
transmitting an authentication data packet including the authentication information;
receiving an authentication result for the authentication data packet from a gateway existing at a network boundary between the node and the service server; and
generating the secure session between the access control application or the target application and the service server based on a secure session creation data packet authenticated from the gateway. In the method of operating a server,
receiving a network connection request to a service server of a target application from a connection control application of the node;
checking whether the target application is accessible based on the identification information of the target application and the IP and port of the service server;
generating a data flow including authentication information for creating a secure session between the node and the service server when the target application can be accessed;
transmitting the data flow to a gateway and the access control application existing at a boundary between the node and the service server; and
receiving data flow update information indicating that the secure session is created from the gateway when the secure session is created; A method comprising A gateway operation method comprising:
receiving, from an external server, a data flow including an IP and port of a service server, and authentication information for creating a secure session between a node and the service server;
receiving an authentication data packet from a connection control application of the node;
performing authentication on the authentication data packet based on authentication information of the data flow;
if the authentication is successful, transmitting an authentication result to the access control application;
forwarding a data packet between the access control application and the service server for creating the secure session; and
transmitting data flow update information indicating that the secure session is created to the external server when the secure session is created; A method comprising

Images