KR101099083B1 - Network resource management system and method - Google Patents

Abstract

The present invention discloses a network resource management system and a management method thereof capable of efficiently managing network resources.

The network resource management system of the present invention includes a management server that stores a whitelist for network resources; And at least one provided by the agent group, receiving the allow list from the management server, comparing the information with the network information collected from the agent group to which the management server belongs, and detecting the blocking target hosts and controlling the communication of the detected blocking target hosts. A PM agent is provided to prevent unauthorized use of network resources without unauthorized access by any host without changing the current network settings.

Description

Network resource management system and its management method {Network resource management system and method}

1 is a block diagram showing the configuration of a network resource management system according to the present invention.

2 is a flowchart illustrating a network resource management method of the network resource management system of FIG. 1.

3 illustrates an example of a message format used between a PM agent and a management server.

4 is a flowchart for explaining an operation between a PM agent and an SM agent.

5 is a diagram illustrating a communication message format used between a PM agent and an SM agent.

The present invention relates to an IP address management system and a management method thereof, and more particularly, communication only between hosts having a network resource (IP address and / or MAC address) designated by an administrator without changing the current network configuration. The present invention relates to an IP management system and a method of managing the same, which can be controlled to prevent any host from unauthorized use of network resources without permission.

Companies, schools, or institutions with large networks want to use limited human resources to efficiently and integratedly manage and control large networks, but this is not easy under complex and diverse network environments.

In particular, duplicated use of IP addresses frequently occurs in a network using static IP. At this time, if the duplicated IP address is a main server, or an IP address of a router or a gateway, service failure may occur. However, there is no way to find and prevent the use of IP by stealing IP without permission.

To this end, manual management of network resources such as IP addresses, media access control (MAC) addresses, host IDs, etc., not only results in waste of human resources but also causes a decline in work capacity.

Therefore, in a network based on a LAN environment, it is necessary to appropriately restrict communication with other devices for each device connected to the network as necessary, and for this purpose, a means for controlling communication power between resources in the network. This is necessary.

An object of the present invention for solving the above problems is to automatically monitor and efficiently manage network resources being used on a network without user intervention.

Network resource management system of the present invention for achieving the above object is a management server for storing the allow list for network resources; And at least one provided by the agent group, receiving the allow list from the management server, comparing the information with the network information collected from the agent group to which the management server belongs, and detecting the blocking target hosts and controlling the communication of the detected blocking target hosts. Equipped with a PM agent.

The network resource management method of the present invention includes a first step of collecting network information of an agent group to which it belongs; A second step of detecting the blocking target host by comparing the collected network information with a predetermined allow list; Determining a state of the detected blocking target host; And a fourth step of selectively controlling communication of the blocking target host according to the state information.

Hereinafter, with reference to the accompanying drawings will be described in detail preferred embodiments of the present invention.

1 is a block diagram showing the configuration of a network resource management system according to the present invention.

The network resource management system of the present invention includes a management server 10, at least one prime master (hereinafter, referred to as 'PM') agent 21, 31, ..., and at least one secondary master. (Hereinafter referred to as SM) agents 22, 32, ... are provided.

The management server 10 collects mapping information on network resources (eg, IP address, MAC address, host ID, etc.) used in the entire managed network and provides the manager with the mapping information. At this time, the management server 10 receives the network information from the PM agent (21, 31, ...) by periodically communicating with the PM agent (21, 31, ...) to update the pre-stored mapping information based on this to the administrator Provides recent network information. In addition, the management server 10 is used in the corresponding agent group for each network area (the area in the dotted line in FIG. 1) (hereinafter, referred to as an “agent group”) accommodated in the same level network, that is, in the same router as in FIG. 1. It has a list of allowed network resources (e.g., at least one of an IP address, a MAC address, and an IP-MAC mapping list) (hereinafter referred to as an allow list). The allow list is selectively designated by the administrator, and the management server 10 provides the allow list of each agent group to the corresponding PM agents 21, 31,. At this time, the allow list is provided to each PM agent 21, 31,... When the request for provision is received from the PM agent 21, 31, ..., or when the allow list is newly updated. Of course, it is obvious that the provision time can be adjusted in many other cases. For example, the management server 10 may provide the PMs 21, 31,... With the PMs at regular intervals regardless of whether the allow list is changed. Only one management server 10 exists in the entire network to be managed.

One PM agent 21, 31, ... exists for each agent group, and when one host operates as the PM agent 21, 31, ..., the PM agent 21, 31, ... is itself a PM agent. Broadcasts a message to the agent group to which it belongs. In addition, the PM agents 21, 31, ... select an arbitrary host in the agent group to which they belong, designate the SM agent, and transmit a message informing that the host is designated as the SM agent. The PM agents 21, 31, ... collect network information (IP address and / or MAC address) of the hosts of the agent group to which they belong, and provide them to the management server 10 and from the management server 10. You are provided with a whitelist. At this time, the PM agents 21, 31, ... are provided as a PM agent by requesting the allow list from the management server 10 during initial operation, and later provided by the management server 10 when the allow list is changed. . The PM agent 21, 31,..., Manages the network connection and communication of the hosts to enable communication only between the network resources included in the allow list according to the allow list provided from the management server 10 and the network information collected by the PM agent. Selective control Communication between hosts connected to a specific network is performed using ARP. PM agents 21, 31,… capture the ARP (Address Resource Protocol) packets that are broadcast within the agent group to which they belong, Collect IP addresses and MAC addresses. In addition, the PM agent 21, 31, ... is a host that wants to use or uses a resource not included in the allow list provided from the management server 10 based on the collected network information (hereinafter, 'blocking target'). Host '). When the host to be blocked is detected, the PM agent 21, 31, ... determines the state of the host to be blocked, and according to the state, any ARP that blocks or spoofs the connection of the host to the network itself. Use packets to control the blocked host from communicating with other hosts. The description thereof will be described later in detail.

SM agent 22, 32,… periodically checks whether PM agent 21, 31,… exists in the agent group to which it belongs, and acts as PM agent when PM agent 21, 31,… does not exist. do. That is, the SM agents 22, 32, ... have the same functions as the PM agents 21, 31, ..., but operate in the standby mode if there is a host that is already acting as the PM agent, and if the PM agent does not exist, It operates by switching to this PM agent. To this end, the SM agents 22, 32, ... periodically communicate with the PM agents 21, 31, ... to check whether the PM agents 21, 31, ... are operating normally, and the PM agents 21, 31, ... …) Stores all of the information (allowed list and collected network information) of the PM agent 21, 31,…. These SM agents 22, 32, ... are arbitrarily designated by the PM agents 21, 31, ..., and the PM agents 21, 31, ... are randomly selected from among the IP lists collected by them at initial startup. Specify a host and send a message to the host to act as an SM agent. That is, all hosts connected to the network in FIG. 1 are provided with an agent capable of operating as the above-described PM agent or SM agent, and any host may operate as a PM agent or SM agent if necessary.

FIG. 2 is a flowchart for explaining a network resource management method of the network resource management system of FIG. 1. The function of the PM agent 21 will be described.

When the host is designated as the PM agent 21 or the host designated as the SM agent for the first time in the system operation is switched to the PM agent 21, the PM agent 21 informs that it is currently operating as the PM agent. Broadcasts to the agent group to which it belongs. The PM agent 21 selects any one host in the agent group to which it belongs, designates it as an SM agent, and transmits a message indicating that the host is designated as an SM agent (step 210).

Next, the PM agent 21 accesses the management server 10 and receives the allow list for the agent group to which it belongs from the management server 10 (step 220).

The PM agent 21 provided with the allow list transmits it to the SM agent 22, and collects network information by capturing ARP packets broadcast to the agent group to which it belongs (step 230).

Next, the PM agent 21 compares the collected information with the allow list provided from the management server 10 to determine whether there is a host to be blocked or wants to use network resources that are not allowed in the allow list. Monitor (step 240).

That is, the PM agent 21 checks whether the sender information (IP address, MAC address) and receiver information (IP address, MAC address) of the collected ARP packet are included in the allow list, and does not include the IP. The host to use the address or the host being used is determined as the blocking target host.

The PM agent 21 periodically transmits the collected network information to the management server 10. FIG. 3 is a diagram illustrating an example of a message format used between the PM agent 21 and the management server 10. The PM agent 21 and the management server 10 are allowed in the allow list using the message format shown in FIG. And network information transmission.

If the blocking target host is detected in step 240, the PM agent 21 first checks whether the corresponding ARP packet is a Gratuitous ARP packet (step 250).

In the present invention, the control method is changed according to the current state of the blocking target host. In other words, the PM agent 21 distinguishes whether the host to be blocked is connected to the network when the host to be blocked is not connected to the network, or is already connected to the network. Do it differently. To this end, the PM agent 21 first checks whether the ARP packet including the information of the blocking target host is a "Gratuitous ARP" packet.

Gratuitous ARP is a protocol used to verify that a host with the same IP address exists on the same network (agent group) when the host is online (booted) or when the IP software is initialized (if the IP address is changed). to be.

Therefore, when the packet is a Gratuitous ARP packet in step 250, the blocking target host may be said to be initially setting up a network for network access. In this case, the PM agent 21 generates a random ARP response message (an ARP response message indicating that the IP is already used) that prevents the blocked host from initializing the network, and the sender address included in the Gratuitous ARP packet is generated. Unicast to step 260. As a result, the PM agent 21 has an effect of blocking the network connection itself of the blocking target host.

On the other hand, if the corresponding ARP packet in step 250 is an ARP request message requesting the MAC address of the other host (recipient) rather than the Gratuitous ARP packet, the PM agent 21 checks whether the blocked host is the sender host or the receiver host. By unicasting the spoofed ARP response message to the host, spoofed fake information is recorded in the host's ARP cache table (step 270).

That is, the PM agent 21 detects fake information (fake recipients) for the recipient host when an IP address (or MAC address) that is not in the allow list is found in the sender information, that is, when the blocked target host wants to communicate with another host. ARP response message with MAC address) is unicast to the calling host (blocking destination host). Therefore, the fake MAC address is mapped to the recipient IP address in the ARP cache table of the blocked target host so that the blocked target host cannot communicate with the actual recipient host.

However, after the PM agent 21 unicasts the spoofed ARP response message to the blocking target host, the normal ARP response message by the original receiver host may be unicast to the blocking target host. In this case, since the ARP cache table of the blocking target host is updated again according to the actual receiver host information, the blocking action of the previously performed PM agent 21 is of no use. Accordingly, in order to prevent such a problem, the PM agent 21 unicasts the spoofed ARP response message to the blocking target host a plurality of times (for example, three times).

On the other hand, if an IP address (or MAC address) that is not in the allow list is found in the receiver information, that is, if a normal host wants to communicate with the blocked target host, the PM agent 21 will be sent to the recipient host (blocked host). Spoofed ARP response message with fake information (fake recipient MAC address) is unicast to sender host. Therefore, a fake MAC address is mapped and recorded on the IP address of the blocking target host in the ARP cache table of the sender host, thereby preventing communication with the blocking target host. Even in this case, for the same reason as described above, the PM agent 21 unicasts the spoofed ARP response message to the originator host a plurality of times (for example, three times).

The operation of the PM agent 21 is repeatedly performed until an abnormality occurs in the PM agent 21 and the operation as the PM agent 21 ends (step 280).

FIG. 4 is a flowchart for explaining the operation between the PM agent 21 and the SM agent 22, and will be described focusing on the function of the SM agent.

If one of the hosts belonging to the same agent group by the PM agent 21 is designated as the SM agent 22 (step 410), the SM agent 22 causes the PM agent 21 from the management server 10. The provided allow list is received from the PM agent 21 and stored (step 420). That is, the SM agent 22 is prepared to perform the function as a PM agent at any time while sharing information in the same manner as the PM agent 21. In this case, the allow list transmission to the SM agent is not necessarily performed at the initial stage when the corresponding host operates as the SM agent 22, but may be periodically or non-periodically when necessary.

The SM agent 22 periodically communicates with the PM agent 21 to check whether the PM agent 21 is operating normally (step 430).

5 is a diagram illustrating a communication message format used between the PM agent 21 and the SM agent 22. The SM agent 22 communicates with the PM agent 21 using the message format shown in FIG. The information is provided and it is checked whether the PM agent 21 operates normally.

When periodic communication with the PM agent 21 is normally performed (step 430), the SM agent 22 maintains the standby mode and repeats the operations of steps 420 and 430 (step 440).

However, if the periodic communication with the PM agent 21 is not normally performed in step 430, that is, if there is no response from the PM agent 21 for a predetermined time, the SM agent 22 indicates that an abnormality has occurred in the PM agent 21. After the determination, the user switches to the PM agent and operates as a PM agent (step 450).

At this time, the SM agent (hereinafter referred to as a "new PM agent") 22 converted to the PM agent first broadcasts a message indicating that it is a new PM agent to the agent group and notifies the management server 10. The new PM agent 22 again designates any one of the other hosts as a new SM agent, and then transmits information (acceptable list) that it has to the designated SM agent.

The operations of the new PM agent 22 are then the same as the operations of the PM agent 21 in FIG. 2 described above.

Other hosts not designated as SM agents in step 410 operate as normal hosts until receiving a message indicating that they are designated as SM agents (step 460).

In the above-described embodiment, specific IP addresses are designated as allow lists so that only those IP addresses can be used. However, when IP-MAC mapping information is specified as allow lists, only hosts with specific MAC addresses can use specific IP addresses. It can also be controlled. In such a case, the IP address assigned to the critical server can be provided with a stable service by restricting it to only a specific computer having a designated MAC address.

As described above, the network resource management system of the present invention can prevent unauthorized use of network resources without unauthorized access by any host without changing the current network settings.

Claims (21)

A management server storing a whitelist for network resources; And It is provided for each agent group, at least one that receives the allow list from the management server and compares it with the network information collected in the agent group to which the management server belongs to detect the blocking target host and control the communication of the detected blocking target host Primary Master (PM) agent; And And a Secondary Master (SM) agent which is assigned by the PM agent at the beginning of the system belonging to the same agent group as the at least one PM agent and receives and stores the allow list from the PM agent. Hosts in the agent group can selectively operate as a PM agent or SM agent. The method of claim 1, The SM agent is provided for each agent group, and when an abnormality occurs in the corresponding PM agent, the network resource management system, characterized in that to operate by switching to the PM agent. The method according to claim 1 or 2, wherein the management server is And storing the allow list for each agent group and transmitting the allow list of the agent group to the PM agent when a request from the PM agent or the allow list is changed. The method of claim 1, wherein the PM agent is Collecting the network information by collecting the ARP packet broadcast to the agent group to which it belongs. The method of claim 4, wherein the PM agent is And when the information on the blocking target host is included in the Gratuitous ARP packet, unicast an ARP response indicating that the corresponding IP is used as a sender address of the Gratuitous ARP packet. The method of claim 4 or 5, wherein the PM agent is And when the information on the blocking target host is included in the ARP request message, unicast the ARP response message spoofed to the sender address of the ARP request message. The method of claim 6, wherein the PM agent is And unicast the ARP response message spoofing the MAC address of the recipient of the ARP request message. 8. The system of claim 7, wherein the PM agent is And unicast the ARP response message to the originator address multiple times. The method of claim 4, wherein the PM agent is And periodically transmit the collected network information to the management server. The method of claim 1, wherein the PM agent is Designating any host belonging to the agent group as the SM agent, and transmits the allow list provided from the management server to the SM agent. The method of claim 10, wherein the SM agent And periodically communicating with the PM agent and switching to the PM agent when there is no response from the PM agent for a predetermined time. The method of claim 11, wherein the SM agent is The network resource management system, characterized in that for broadcasting the message to the agent group to which the agent belongs that after the switch to the PM agent. The method of claim 12, wherein the SM agent is After switching to the PM agent, the network resource management system, characterized in that any host in the agent group to which the agent belongs to set as a new SM agent and transmits a message informing the fact to the set SM agent. If a host designated as a PM (Primary Master) agent or a SM (Secondary Master) agent is switched to the PM agent, broadcasting a message to the agent group to which it belongs that it is operating as a PM agent; Selecting, by the PM agent, a host in the agent group to which the agent belongs to the SM agent, and transmitting a message indicating that the PM agent has been designated as the SM agent; Collecting network information of the agent group to which the agent belongs; Detecting the blocking target host by comparing the collected network information with a predetermined allow list; Determining a state of the detected blocking target host; And And selectively controlling communication of the blocking target host according to the state information. 15. The system of claim 14, wherein the whitelist is At least one of an IP address, a MAC address, and IP-MAC mapping information designated by an administrator. The method of claim 15, wherein collecting the network information And collecting IP addresses and MAC addresses of respective hosts by collecting ARP packets broadcasted to the agent group. The method of claim 16, wherein determining the detected state of the blocked target host comprises And determining whether the ARP packet including information of the blocking target host is a gratuitous ARP packet or an ARP request message. 18. The method of claim 17, wherein selectively controlling the communication of the blocked host And when the information on the blocking target host is included in the Gratuitous ARP packet, unicast an ARP response indicating that the corresponding IP is used as a sender address of the Gratuitous RAP packet. 19. The method of claim 17 or 18, wherein selectively controlling the communication of the blocked host And when the information on the blocking target host is included in the ARP request message, unicast the ARP response message spoofed to the sender address of the ARP request message. 20. The system of claim 19, wherein the spoofed ARP response message is And the MAC address of the recipient of the ARP request message is spoofed to an arbitrary address. 20. The method of claim 19, wherein the ARP response message is And unicast to the calling party address a plurality of times.

Images