KR101400709B1 - System and method for the terminal service access control in a cloud computing environment - Google Patents

Abstract

The present invention relates to a method for controlling terminal server access in server based computing and desktop computing environments. A system for controlling access to a terminal service, the system comprising: a session connection operation unit for controlling a flow occurring after a user accesses a terminal service; An information extraction unit for extracting information of a user accessing the terminal service; A terminal service access control system including a session management unit for managing and managing the user's state information and information extracted by the information extraction unit, and a policy checking unit for determining a login permission of the user based on the information obtained from the information extraction unit and the session management unit Can be provided.

Description

TECHNICAL FIELD [0001] The present invention relates to a terminal service access control system and a terminal service access control system in a cloud computing environment,

The present invention relates to a method for controlling terminal server access in server based computing and desktop computing environments.

A cloud computing (server-based computing or desktop computing) environment using a terminal server allows all applications and information to be run on 100% remote equipment (remote server or remote desktop) on a remote server or remote desktop, It is a computing environment that shows only results that are executed remotely, that is, all information is put on a remote server or a remote desktop so that users can use the necessary information anytime anywhere, any device or network. Also, as shown in FIG. 1, the client refers to a service environment in which only the information on the keyboard and mouse operations is given and information on the changed screen is received. In the feature, the authorized user has access to the remote information through the authentication process, It can prevent security accidents and information leakage by employees.

As a method of controlling an existing remote terminal server access, a connection can be granted or denied based on an accessing IP address as shown in FIG. The method shown in FIG. 2 is a method for processing in the network network area, and also a method for controlling access within the remote terminal server and the remote desktop operating system. The method includes a S / W firewall and an Intrusion Prevention System, Intrusion Prevention System) to handle access control to terminal service based on IP address.

The access control method of remote server terminal service does not exceed the limit of IP address and port. When setting access control of existing remote server terminal service, IP address, IP band, access port (Source Port, Destination Port) must be registered. There may be inconvenience because it is treated only as access denial or access permission.

Further, after accessing the terminal server of the remote server, access control must be performed before logging in to the system. Most of the access control methods are based on the IP address, so it is impossible to know whether the user who is logged in is accessing the terminal. Controlling access after logging in to the system can be a security vulnerability because you are already logged in to the system.

It has a structure that can cause a security problem when the terminal server access control of the remote server is performed based on the existing limited standard, that is, only the IP address and the port.

For example, if it is assumed that the users who can access and log in to the terminal server of the remote server are Tank and M16 and the connection terminal IP is operated with the connection denial policy, the terminal (client, PC ), When connecting to remote terminal service by Tank and M16, both Tank and M16 will be denied access. In the terminal (client, PC) used by the user A, only the tank ID is allowed to be denied. If the M16 is connectable, it is not possible in the existing method, and fluidity and scalability are not considered.

The above problem does not accurately extract information about the remote server users (Tank, M16) connecting to the remote server, nor does it obtain the host (computer) name of the terminal (client, PC) to which the user connects. Assuming that the above-mentioned user information can be extracted and information of the terminal can be extracted, it is possible to further expand the standard that was controlled by only the IP address and the port.

As another example, there is a security vulnerability in that access control is performed after a user A logs in to the system. Since access control is performed after logging in, a security problem may occur due to the occurrence of a time interval (Interval). For this reason, there is a need for a mechanism to determine whether or not the access is permitted by the access control policy before obtaining the accessed IP address and login information and logging in.

The present invention further specifies the criteria for terminal service access control of the remote server based on the information acquisition on the four criteria, namely, the IP address, the port information, the user information, and the Host information, And a system and a method for enhancing access control to the user.

A system for controlling access to a terminal service, the system comprising: a session connection operation unit for controlling a flow occurring after a user accesses a terminal service; An information extraction unit for extracting information of a user accessing the terminal service; And a session management unit for managing and managing the state information of the user and information extracted by the information extraction unit; And a policy checking unit for determining a login permission of the user based on the information obtained from the information extracting unit and the session managing unit.

On one side, the network communication protocol of Terminal Services can transmit and receive encrypted data using RDP (Remote Desktop Protocol).

In another aspect, the control in the session connection operation unit may correspond to connection control, disconnection control, reconnection control, log on control, and log off control.

In another aspect, the information extraction unit can extract user information by requesting specific information to the kernel device driver.

In another aspect, the information extracted by the information extraction unit may correspond to user information, IP information, Domain information, and Host information, which are policy elements used in each session.

In another aspect, the session management unit stores information extracted by the information extraction unit, and can provide information when the policy checking unit examines the policy.

In another aspect, the terminal service access control system includes an external policy decision unit. The policy check unit transmits information obtained from the information extraction unit and the session management unit to the policy decision unit, returns the determined policy, Can be determined.

In another aspect, the policy determined by the policy decision unit may be a method of verifying IP based on a user account.

In another aspect, a terminal service access control system uses a hooking technique, and can extract at least one of an IP address of a terminal accessing the system, information of a user who logs in, host information, and domain information.

CLAIMS What is claimed is: 1. A method of controlling access to a terminal service, comprising: controlling a flow that occurs after a terminal service connection; Extracting information of a user accessing the terminal service; A step of connecting and managing the user's state information and extracted information, and a step of connecting information extracted from the step of extracting the information of the user accessing the terminal service and the state information of the user and the extracted information, And determining a login permission of the user.

In addition to the IP address used in the terminal service access control of the existing remote server, if the user information and the terminal information are acquired after accessing (speeding) the remote server and logging in, the inconvenience of access control can be reduced and the expansion can be facilitated can do. Also, access control method can be applied up to user level.

In contrast to the limited access control based on the IP address, the access control policy is applied to the user and the terminal information of the remote server as a reference of the access control.

The application to the present invention can be applied to various systems in the field of access control. For example, the present invention can be applied to any application server capable of obtaining IP address and user information such as a database server access control and a web server access control.

Figure 1 shows a conventional terminal service control system.
FIG. 2 shows a system based on an access IP address as an existing terminal service access control method.
3 is a flowchart illustrating an existing remote terminal service access control method.
FIG. 4 schematically illustrates a remote terminal service access control method proposed by the present invention, in an embodiment of the present invention.
5 illustrates the structure and operation of a terminal service access control system in an embodiment of the present invention.
FIG. 6 illustrates a structure of a remote server terminal service system to which the present invention is applied, in an embodiment of the present invention.
7 is a flow chart illustrating each step of a terminal service access control method in an embodiment of the present invention.

Hereinafter, a terminal service access control system and a method thereof will be described in detail with reference to the accompanying drawings.

Terminal service access control of the existing remote server is performed as shown in FIG. When connecting to the remote server, the H / W firewall 310 performs access control primarily, and the policy reference is handled as an IP address. If the connection is allowed, the S / W firewall or the H / W firewall 320 operating in the OS can control the access based on the IP address after accessing the remote server. If the connection is permitted, And a service 330 are connected.

Here, the method of controlling access to the terminal service of the existing remote server is based on the IP address only. There is a function of blocking the session connection internally in the terminal service, but a method of blocking all the sessions Are provided.

Therefore, existing access control products also control the access from outside the terminal service for the connection which is allowed to access from the H / W firewall or the S / W firewall, or after accessing the remote server through the terminal service However, since this method controls access based only on the IP address information, there may be a difficulty in acquiring the host information connected with the user information.

Accordingly, the present invention can solve the security problem of the conventional access control method by proposing a terminal service access control system and method.

In the embodiment of the present invention, FIG. 4 shows a terminal service access control method of a remote server proposed by the present invention. As in the conventional invention, when connecting to a remote server, the H / W firewall 410 performs access control as a primary access. At this time, the policy reference is handled as an IP address. After connection to the remote server is permitted, The S / W or H / W firewall 420 operating in the OS can control the access based on the IP address and is connected to the terminal service 330 when the connection connection is permitted.

The method of FIG. 4 differs from the prior art in that there may be a system 430 for controlling the flow after connection in the terminal service.

IP information, host information, domain information, and the like can be obtained through the system 430. The user can access the remote server through the terminal service according to the access control policy based on the acquired information. May be permitted or denied.

In a system for controlling access to terminal services, FIG. 5 shows in detail the structure and operation thereof.

A system (500) for controlling access to a terminal service, comprising: a session connection operation unit (510) for controlling a flow that occurs after a user accesses a terminal service; An information extraction unit 520 for extracting information of a user accessing the terminal service; The session management unit 530 that manages and manages the state information of the user and the information extracted by the information extraction unit 520 and determines the user's login permission based on the information obtained from the information extraction unit 520 and the session management unit 530 And a policy checking unit 540 for checking the policy.

Terminal Services's network communication protocol uses RDP (Remote Desktop Protocol). Since the RDP protocol transmits and receives encrypted data, it is difficult to obtain necessary information even if packet capture is performed on the network. Accordingly, it is possible to design a system 500 capable of controlling within the terminal service by installing the system 500 so that necessary information can be obtained so that control of the server access can be performed more efficiently.

The session connection operation unit 510 is an area for controlling a stepwise flow generated when a remote user accesses a terminal service of the server. In detail, when the remote user makes an attempt to access and log in the terminal server of the remote server, the session connection operation unit 510 may operate. The session connection operation unit 510 proceeds to the information extraction unit 520 to extract information on the session according to the flow of the corresponding control. Here, the control in the session connection operation unit may be a connection control, a disconnection control, a reconnect control, a log on control, and a log off control.

In addition, the information extracting unit 520 may be a core of the present invention, and may request a terminal device kernel driver to extract specific information of a user. The information obtained by the information extraction unit 520 may correspond to user information, IP information, Domain information, and Host information, which are policy elements used in each session.

At this time, the detailed information on the information obtained by the information extracting unit 520 can be divided into two types. The first type is information on the local server user. The information about the local server users includes the user account (ie, Administrator account) registered in each OS, the IP address (192.168.100.128) of the terminal accessing the server, domain information (workgroup or domain name) , And terminal host information (HSLEE64-Machine) connecting to the server.

The second form is information about the Active Directory Server User. The information about this Active Directory server user is stored in the Active Directory, that is, the Domain User Account (ie, the Administrator account of the Domain) registered in the domain, the IP address (192.168.100.128) of the terminal accessing the server, Information (Active Directory Domain Name), and terminal host information (HSLEE64-Machine) connected to the server.

The terminal service of the server dynamically has the information required by the information extracting unit 520 in the OS kernel internal memory, and it can request the terminal service kernel device driver to obtain the requested information. According to the present invention, if it is desired to acquire this information, information can be acquired after logging into the terminal server. However, in the present invention, the information extraction unit 520 is required to acquire information before logging in the terminal server . The extracted information can be stored and managed in the session management unit 530. [

The session management unit 530 stores the information extracted by the information extraction unit 520 and may provide information extracted by the information extraction unit 520 when the policy verification unit 540 inspects the policy. Specifically, the session management unit 530 determines which user attempts to log in for each session that the terminal service generates. Which user attempts to reconnect to an already existing session? Do you disconnect? Is it logged in? Is it logged out? And the information acquired by the status and information extracting unit 520 of each remote server user can be managed by connecting the session with each session.

5, the policy verifying unit 540 determines whether the policy obtained by the information extracting unit 520 or the session managing unit 530 by the control flow of the session connection operating unit 510 The policy checking unit 540 can receive a reply to the determined policy by transmitting the policy to the policy determining unit 620 existing outside the terminal service access control system 610. In addition, And directly or indirectly determines whether the final user session is permitted or not. The terminal service access control system 610 may operate in interaction with an existing terminal service execution module 630 that is not performed solely.

In an example, if the session connection operation unit 510 inspects the policy for reconnection, the session connection operation unit 510 requests the information stored in the session management unit 530, receives the stored information, have. It is possible to make the forced connection release or the normal login success according to the policy check result of the policy verification unit 540 and to have the same flow in the other control.

In addition, the policy checking performed by the policy checking unit 540 will be described as follows.

The policy is basically configured on the basis of Deny (unauthorized, unauthorized), and the authorized IP can register the authorized IP and grant the request. These policy bases are the most commonly used form of security products. However, the difference from the existing policy is that the user group policy exists. For example, if a user group policy exists and HSLEE, which is a user registered in the HSLEE-Machine, is connected to a terminal service And you have registered a permit IP (192.168.100.100) that you want to allow HSLEE access, your HSLEE user will not be able to access any IP except 192.168.100.100. Also, if only HSLEE is registered as an authorized user, all users except HSLEE can access denied access even if they connect at 192.168.100.100.

Compared with existing policies, there is an advantage that user filtering can be finely added by adding one more step to access control because of existence of user group policy.

The following is an example of the access control method of terminal service using the characteristic of this policy.

If you set the criteria for each information prior to the description, it is assumed that the terminal server is S-HSLEE, the terminal server user is UL-HSLEE, the user group policy is Deny-based, and the authorized IP is assigned to the UL-HSLEE of the S-HSLEE In the case of terminal server, access control can be done by IP and user account in addition to access control only with existing IP. All users except UL-HSLEE accessing S-HSLEE do not deny access based on IP but deny access based on user. Check all users who are accessing and deny them if they violate the policy (U-Policy). When UL-HSLEE approaches, after checking the policy on the user account, UL-HSLEE can access the server if the registered authorized IP satisfies the permission condition.

Accordingly, although the existing terminal service access control method is based on IP, the access control condition of the present invention can be explained by a method of verifying IP based on the user account.

The terminal service access control system can use hooking technology during the software development technique, and the system can be installed inside the terminal service by using the hooking technology. When the system is accessed through the Hooking technology and the remote server is accessed through the terminal service, the IP address of the terminal connected to the system, the information of the logged-in user, the host information and the domain information are extracted .

Also, depending on the connected state, the system can check and determine the state of a new connection decision, reconnect, log out, log in, and disconnect. .

It is necessary to acquire the information of the user who finally makes a login attempt in case the information of the user who initially logs in and the information of the user who actually logs in can be changed in the window login screen. In this way, terminal server access control of the remote server can be performed efficiently based on the information of the user finally obtained from the system.

In the embodiment of the present invention, Fig. 7 is a flowchart showing each step of the terminal service access control method. The terminal service access control method may be the execution step of the above-described terminal service access control system 500, and the steps follow the description below.

Referring to FIG. 7, a method of controlling access to a terminal service, comprising: controlling (710) a flow that occurs after a user accesses a terminal service; Extracting information of a user accessing the terminal service (720); A step 730 of connecting and managing the status information of the user and the extracted information, and a step of connecting and extracting the extracted information and the user's status information and the extracted information in the step 720 of extracting information of the user accessing the terminal service (740) of determining a login permission of the user based on information managed by the terminal management server (730).

The terminal service access control method acquires information such as user information, IP information, host information, domain information, and the like. Based on the acquired information, You can either allow or deny login to.

The access control policy of the present invention differs from the existing most commonly used policies by adopting a user group policy based on the user's account based IP rather than based on the authorized IP, It is possible to have the advantage of being able to do.

Technically, the terminal service access control method can implement the method by introducing the hooking technology, and the terminal server access control of the remote server can be efficiently performed based on the information of the finally obtained user.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk and a magnetic tape, optical media such as CD-ROM and DVD, magnetic disks such as a floppy disk, - Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents thereof, the appropriate results may be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

500, 610: Terminal Services Access Control System
510: Session connection operation unit
520: Information Extraction Unit
530:
540:
620:

Claims (10)

A system for controlling access to a terminal service,
A session connection operation unit for controlling a flow occurring after a user accesses the terminal service;
An information extraction unit for extracting user information, IP information, Domain information, and Host information for accessing the terminal service, which is information on policy elements used in each session;
A session management unit for connecting and managing the session state information constructed in advance and the information extracted by the information extraction unit; And
A policy checking unit for determining a login permission of the user based on the information obtained from the information extracting unit and the session managing unit,
The terminal access control system comprising: The method according to claim 1,
The network communication protocol of the terminal service includes transmitting and receiving encrypted data using RDP (Remote Desktop Protocol)
The terminal access control system comprising: The method according to claim 1,
In the session connection operation unit,
Connection control, disconnection control, reconnection control, log on control, and log off control
The terminal access control system comprising: The method according to claim 1,
The information extracting unit extracts user information by requesting the kernel device driver
The terminal access control system comprising: delete The method according to claim 1,
The session management unit stores the information extracted by the information extraction unit and provides the information when the policy checking unit inspects the policy
The terminal access control system comprising: The method according to claim 1,
The terminal service access control system
And includes a policy decision part outside,
The policy checking unit,
Sending the information obtained from the information extracting unit and the session managing unit to the policy deciding unit, returning the determined policy, and determining the user's login permission based on the determined policy
The terminal access control system comprising: 8. The method of claim 7,
The policy determined by the policy decision unit is a method of verifying IP based on the user account
The terminal access control system comprising: The method according to claim 1,
The terminal service access control system comprises:
Hooking technology is used,
Extracting at least one of an IP address of a terminal accessing the system, information of a user who logs in, host information, and domain information
The terminal access control system comprising: A method for controlling access to a terminal service,
Controlling a flow that occurs after a user accesses the terminal service;
Extracting information of a user accessing the terminal service, IP information, Domain information, and Host information, which are information on policy elements used in each session;
Connecting and managing the pre-established session state information and the extracted information; And
Determining a user's login permission based on the information managed in the step of connecting and managing the extracted information and the user's state information and the extracted information in the step of extracting information of a user accessing the terminal service
/ RTI >

Images