KR20030080412A - method of preventing intrusion from an exterior network and interior network - Google Patents

Abstract

According to the present invention, it can be seen that additional authentication procedure is required for the system requiring higher security among the internal systems. In addition to the address and port number), it provides an intrusion prevention method from the internal network and the external network that can prevent intrusion into the internal network.

The method is a method for preventing intrusion from an internal network and an external network in a network to which an internal network 1 and an external network 4 including a plurality of user systems 17 and a plurality of servers 12 are connected. Information of the authorized internal user from the packets transmitted from the plurality of user systems 17 of the internal network 1 to the IP address and the port number, and to the upper line of the at least one server 12 to be protected. The installed network intrusion prevention system 20 checks the IP address, service contents, user authority, etc. from the packet and connects it to an authorized packet, and adds a user verification step of denying access if the packet is not authorized. It is characterized by preventing the hacking of the internal network that requires the security of.

Description

Method of preventing intrusion from an exterior network and interior network}

The present invention relates to a method for preventing intrusion from an external network and an internal network, and more specifically, it can be seen that an additional authentication procedure is required for a system requiring higher security among internal systems. The present invention relates to an intrusion prevention method from an external network that can prevent an intrusion into an internal network by adding the information of the internal user to the above two determination grounds (IP address and port number).

Conventionally, a firewall apparatus and method for controlling network data packet traffic between an internal and an external network, as shown in FIG. 1, for securing a vulnerability of an internal network, are disclosed in Korean Patent Application Laid-Open No. 2001-0072661 (published date). : July 31, 2001, Application No. 10-2000-7015107. In Figure 1 an internal network 1, such as an intranet, comprises several network nodes 2, such as PCs, workstations, file servers, etc., which are connected to a firewall 3. Companies or organizations connected to the external network 4 (Internet) wish to publish company-related information such as products and services on the web, access information published by other companies or organizations on the Internet, and communicate via e-mail. . However, the company may have internal information that is information that is available to users on the Internet, such as through intranet information servers, file servers, etc., in order to allow Internet users to access public information. For example, it is allowed to connect to a limited set of servers such as web, email, etc., and access to information on other hosts such as intranet servers is denied. The public server is available in the 'buffer zone' (DMZ) 5, which is connected to the firewall 3. Moreover, since the firewall 3 is connected to the Internet via the router 6, the connection to the nodes in the DMZ 5 can be made from the intranet 1 as well as the external network or the Internet 4, but the Internet 4 From intranet to intranet 1 is restricted. The firewall devices and methods control network traffic between internal and external networks, provide rule matching processes and efficient address checking to achieve efficient and fast IP packet filtering, and limit the number of possible connections through the firewall. In this case, the set of rules that need to be searched linearly is reduced by segmenting the rule set, and the two stages of checking the source and destination address of the packet at a set of address prefixes first. -Dimensional address checking means, each prefix being associated with a subset of the rules in the set of total rules. Linear search is performed on a subset of the resulting rules to find rules applicable to the current data packet. In addition, a method in which an internal source address is converted into an external source address of a packet transmitted from the firewall or an external source address is converted into an internal source address of a packet transmitted to the firewall is used.

The basis for controlling access in any system using AccessControl technology, including conventional intrusion prevention, intrusion detection and intrusion prevention systems, was a kind of service based on IP address and port number. However, these two judgments are insufficient in establishing an access control policy for sensitive resources of the internal network. Because an illegal user who successfully hacks a vulnerable system in an internal network holds an allowed IP (the compromised system knows how to communicate with the internal network or has access), it can access most internal critical resources. Access will be made available, with the ability to continue to carry out the more threatening secondary and tertiary attacks following the first phase.

Therefore, in order to solve the above-mentioned problems, it is understood that an additional authentication procedure is required for a system requiring higher security among the internal systems. The purpose of the method is to provide an intrusion prevention method from an external network that can prevent intrusion into an internal network by adding the branch judgment basis (IP address and port number). Another authorization check, filtered from Login and Password, the part of user authentication that is passed through to use any system such as MS-Windows or Unix-like OS, accesses a system that must be extremely protected. It allows you to build an advanced authentication scheme for validating packets.

The addition of user verification in this manner need not be limited to simply user IDs and passwords. For example, the introduction of PKI authentication with physical devices such as smart cards or USB secure keys completely eliminates the potential risks associated with theft of user IDs and passwords. You can do it.

In addition, users in a domain are uniquely identified by their IDs. Therefore, when determining whether to access a certain system, the authority setting per group can increase the management efficiency. By reducing the number of nodes, the performance of the system can be improved.

1 is a block diagram showing a configuration of a packet processing system on a network for detecting and preventing intrusion into a conventional internal network.

2 is a block diagram showing the configuration of a system for implementing an intrusion prevention method from an external network according to an embodiment of the present invention;

3 is a flowchart of data for explaining an intrusion prevention method from an external network according to an embodiment of the present invention;

4 is a block diagram illustrating an example of a configuration of the NIPS of FIG. 3.

<Description of the symbols for the main parts of the drawings>

1: internal network 2: network node

3: firewall 4: external networks

5: DMZ (buffer zone) 6: router

11: hub 12: server

16: Hub 17: User System

20: Network Intrusion Prevention System (NIPS) 21, 26: NIC

22: memory means 23: CPU

24: Database 25: Policy Decision Algorithm

In order to achieve the above object, an intrusion prevention method from an internal network according to an embodiment of the present invention includes an internal network 1 and an external network including a plurality of user systems 17 and a plurality of servers 12. In the intrusion prevention method from the external network in the network connected 4), the information of the authorized internal user from the packet transmitted from the plurality of user systems 17 of the internal network 1 is added to the IP address and the port number. The network intrusion prevention system 20 installed on the upper line of the at least one server 12 to be protected, checks the IP address, service content, user authority, etc. from the packet, and connects it when it is accepted. If not, add a user verification step that denies access to prevent hacking due to IP theft of internal users by external users. It is characterized by underground.

The user verification step includes a physical device such as a smart card or a secure port of a USB port, PKI authentication, etc. instead of a user ID and password, and authority may be set in groups. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is a block diagram illustrating an example of a system for implementing an intrusion prevention method from an external network according to an embodiment of the present invention, and FIG. 3 illustrates an intrusion prevention from an external network according to an embodiment of the present invention. A flow chart of data to illustrate the method is shown.

Intrusion prevention method from an external network according to an embodiment of the present invention, an internal network 1 and an external network 4 including a plurality of user systems 17 and a plurality of servers 12 as shown in FIG. Network intrusion prevention system 20 is installed on the upper line of at least one server 12 to be protected as shown in FIG. 2 in order to verify the access rights of the internal user to the important server 12 on the connected network. do.

One example of the configuration of the network intrusion prevention system 20 includes a receiving side NIC 21 and a transmitting side NIC 26 each having a plurality of bridges, as shown in FIG. Memory means 22, such as RAM and / or ROM, comprising a buffer for storing and an algorithm unit on which the policy decision algorithm is mounted, and a CPU 23 for performing the policy decision algorithm. It also includes a database 24 for referencing or storing data during the execution of the policy decision algorithm.

In FIG. 4, the policy decision algorithm 25 is an algorithm for determining whether a packet is harmful to an incoming packet. The policy decision algorithm 25 may determine the harmfulness as an internal module, or may make a decision using an intrusion pattern database. A packet's harmfulness refers to a packet with an unauthorized destination or origin, or a packet randomly generated by an attacker who wants to use the network for malicious purposes.

In FIG. 4, the database 24 includes a session database that stores whether a session is created at the present time, an intrusion pattern database containing definitions of hackers' general behaviors, and malicious packets, and related intrusions up to now. An example consists of an intrusion-related log database containing information.

In order to verify the access right of the internal user by the network intrusion prevention system 20 described above, the IP address and the port information of the internal user authorized in the packet to be transmitted from the multiple user systems 17 of the internal network 1 are transmitted. Add it to the number. Thereafter, as in the automaton of FIG. 3, the network intrusion prevention system 20 checks the IP address, service content, user authority, etc. from the packet, and connects it when it is accepted. Internal user verification steps are rejected. In this way, hacking due to IP theft of the internal user by external users can be prevented.

An example of a scenario for protecting important resources of the actual internal network is as follows.

In FIG. 2, users A and B exist in the internal network 1, and there is Server-1 (IP address: 192.168.0.3) among the servers 12 which are systems to control access, and users A and B are used. Suppose you have two workstations, WS-1 (IP address: 192.168.0.6) and WS-2 (192.168.0.7).

Then set the access rights as shown below.

ACCEPT: USER = user A, HOST = WS-1, DEST = SERVER-1, SERVICE = 1938,

DEF_POLICY = DENY

Note that the default policy (DEF_POLICY) is DENY above. Any packet on any network cannot access SERVER-1 unless it has login information by user A using the WS-1 system. It is difficult to guess the transformation to UserA because WS-1 cannot access the encrypted security policy even after WS-1 is hacked by an external intruder. And since most of the systems for services use a specific port with root privileges, if you have a policy that denies all users, you can defend against attacks from any system.

As such, another authorization check, filtered from login and password, which is part of the user authentication that goes through the use of any system, takes a step further to verify the authorization of access packets to the system to be extremely protected. It allows you to build a system.

In addition, the user verification step may include a physical device such as a smart card or a secure key of a USB port method, PKI authentication, or the like instead of the user ID and password. In this case, introducing a physical device such as a smart card or USB secure key and PKI authentication completely eliminates the possibility of end-user risks caused by theft of user ID and password. It becomes possible. In addition, since users in a domain are uniquely identified by their IDs, when setting access to a system, the authority setting per group can increase the management efficiency and reduce the number of rules. Can improve the performance.

Such a packet control technique by user authentication is possible only when the operating system transmits the login information of the user to a machine to control access. If the PAM (Pluggable Authentication Module) is supported in the UNIX operating system, the user function can be naturally implemented. The MS-Windows operating system requires a device that can transmit the user login information to the access controller. Can be implemented very simply. Alternatively, in a network using a public domain controller (PDC) and a backup domain controller (BDC), a user authentication function can be implemented using a list of user information without using a special transmission device.

While the present invention has been described with reference to specific embodiments, the above disclosure of the invention is not limited to the specific embodiments as merely preferred embodiments of the present invention. In addition, it will be readily understood by those skilled in the art that various modifications and changes can be made without departing from the spirit or scope of the invention as set forth in the claims below.

According to the configuration and operation of the intrusion prevention method from the internal network according to the embodiment of the present invention described above, it can be seen that additional authentication procedure is required for the system that requires higher security among the internal systems. In addition, it is possible to prevent intrusion from the internal network to the internal network by additionally introducing user-related authentication to the IP address and port number that were checked in general access control and security products.

Claims (2)

In the method for preventing intrusion from an external network and an internal network in a network to which an internal network 1 and an external network 4 including a plurality of user systems 17 and a plurality of servers 12 are connected, The information of the internal user authorized from the packets transmitted from the plurality of user systems 17 of the internal network 1 is added to the IP address and the port number, and installed on the upper line of the at least one server 12 to be protected. The network intrusion prevention system 20 checks the IP address, service content, user authority, etc. from the packet, and adds a user verification step for connecting when the packet is authorized and denying access when the packet is not authorized. Intrusion prevention method characterized in that to prevent hacking of the internal network that requires security The method of claim 1, wherein the user verification step includes a physical device such as a smart card or a secure port of a USB port, PKI authentication, etc. instead of a user ID and a password. Intrusion prevention method from an external network, characterized in that the set.