KR20180032864A - Controlling apparatus for abnormally network traffic using user authentication and controlling method for the same - Google Patents

Abstract

The present invention relates to an apparatus and method for controlling abnormal network traffic through user authentication, and more particularly, to a traffic analysis module for collecting IP information by receiving a packet. And an authentication checking module for searching for an authentication user list based on the IP information collected by the traffic analysis module and for passing the packet when the user is an authenticated user, and an apparatus for controlling an abnormal network traffic through user authentication And allows only the communication of the user who has been authenticated through fast and efficient user authentication without using a separate session state table.

Description

[0001] The present invention relates to an apparatus and method for controlling abnormal network traffic through user authentication,

The present invention relates to an apparatus and method for controlling abnormal network traffic through user authentication. More particularly, the present invention relates to an apparatus and method for controlling abnormal network traffic through user authentication that permits only the communication of a user who has been authenticated through fast and efficient user authentication without using a separate session state table To a control apparatus and method.

Transmission Control Protocol (TCP) typically performs three-way handshaking before establishing a reliable connection.

In the 3-way handshaking process, when a client transmits a Syn packet requesting connection to the server, the server transmits a Syn / Ack packet to the client to accept the request, and the client transmits an Ack packet to the server in three steps Establish a connection between the client and the server.

However, in the 3-way handshaking process, if a malicious attacker requests a connection and receives an acknowledgment from the server, and then does not send an Ack packet to the server, the server expects a response from the attacker and a half-open half- And remain in the standby state.

If an Ack packet is not received from the client for a certain period of time, the connection continues to exist in the backlog queue, which is a memory space, until it is initialized.

Since the traffic in the mobile communication network changes according to the time and the day of the week, it is impossible to grasp whether the current traffic situation is normal or not by simply increasing or decreasing the traffic.

Therefore, it is necessary to understand whether the traffic change is normal or the traffic is rapidly increasing due to the abnormal situation.

For example, when a specific server fails, the client terminals continuously transmit a retransmission packet (TCP SYN) to the failed server to load the network.

In this case, it is necessary to quickly determine whether the current traffic situation is normal or abnormal.

In the related art, the abnormal state traffic is identified and blocked by using the session state table managing various state tables.

However, such a conventional technique has a problem that the session state table manages various state tables, which is complicated and the load is increased.

In addition, such a conventional technology has a problem that only data traffic coming from the outside to the inside can be controlled.

Korean Patent Publication No. 10-2016-0010255 Korean Patent Registration No. 10-1501698

SUMMARY OF THE INVENTION The present invention has been conceived to solve the above-mentioned problems, and it is an object of the present invention to provide a method and system for authenticating a user without operating a state table or the like in order to control excessive traffic caused by an abnormal user such as a traffic retransmission program, And to provide an apparatus and method for controlling abnormal network traffic through user authentication so as to reduce the complexity and load caused by various status table management by controlling abnormal traffic with only an authorized IP list.

According to an aspect of the present invention, there is provided a traffic analysis module that receives a packet and collects IP information. And an authentication checking module for searching an authentication user list based on the IP information collected by the traffic analysis module and for passing the packet when the user is an authenticated user.

In addition, the traffic analysis module of the present invention distinguishes the direction of a packet whether a packet is an incoming packet or an outgoing packet, and the authentication checking module checks the collected IP information The originating IP is searched in the authentication user list to determine whether the user is an authenticated user. In the case of a packet going from the inside to the outside, the destination IP is searched in the authentication user list from the collected IP information,

The traffic analysis module according to an embodiment of the present invention includes an authentication list database for obtaining a TCP status flag of a packet and managing an authentication user list; An authentication list management module for adding an authentication authorized user to the authentication user list of the authentication list database; A packet generation module for generating and transmitting an authentication request packet to a user by generating an authentication value in a sequence field; And requesting generation of an authentication request packet to the packet generation module when the TCP status flag acquired by the traffic analysis module is Syn. When the TCP status flag is Ack, the authentication response packet is transmitted to the authentication list management module And to add it to the authentication user list.

According to an aspect of the present invention, when the TCP status flag acquired by the traffic analysis module is in the Syn status or the Ack status, the status information of the TCP status flag is provided to the authentication approval module. Further comprising a status check module for interrupting the status check.

In addition, the packet generation module according to an embodiment of the present invention uses a combination of a source IP, a destination IP, a source port, and a destination port of a Syn packet and a timestamp as authentication values, And generates an authentication request packet by setting the Syn-Ack flag and transmits the authentication request packet.

When the TCP status flag is Ack, the authentication acknowledgment module determines that the packet is an authentication response packet, identifies an acknowledgment number of the Acknowledgment field, and determines whether the packet is an authentication response packet for the authentication request Verify validity.

In the case of the Ack packet, the authentication approval module of the present invention compares the value obtained by subtracting 1 from the acknowledgment number and the combination of the source IP, the destination IP, the source port, and the destination port, When the stamp is confirmed and the time set by the user has not passed, the IP information of the user is transferred to the authentication list management module and added to the authentication user list.

According to another aspect of the present invention, there is provided a traffic analysis module comprising: (A) a traffic analysis module receiving a packet and collecting IP information and a TCP status flag; And (B) the authentication inspection module searches the authentication user list based on the IP information collected by the traffic analysis module, and passes the packet when the user is the authenticated user.

In another aspect of the present invention, in the step (B), the authentication checking module searches the authentication user list for the IP address of the collected IP information in the case of a packet coming from the outside to the inside, ; And (B-2) the authentication checking module includes a step of searching for the destination IP from the collected IP information in the authentication user list and determining whether the user is the authenticated user.

According to another aspect of the present invention, (C) the status check module further comprises: providing status information of a TCP status flag to an authentication approval module when the TCP status flag acquired by the traffic analysis module is in a Syn status or an Ack status; (D) requesting generation of an authentication request packet to the packet generation module when the TCP state flag acquired by the traffic analysis module is Syn; (E) when the packet generation module is requested to generate an authentication request packet, generating an authentication value, generating an authentication request packet in a sequence field, and generating and transmitting an authentication request packet to the user; And (F) when the TCP status flag is Ack, transmitting the authentication response packet to the authentication list management module and adding the authentication response packet to the authentication list if the authentication response packet is valid.

In another aspect of the present invention, in the step (E), when the packet generation module is requested to generate an authentication request packet, a value obtained by combining a source IP, a destination IP, a source port, and a destination port of a Syn packet and a time stamp Stores the authentication value in the sequence number of the sequence field, sets the Syn-Ack flag, and generates and transmits an authentication request packet.

In the step (F) of the other aspect of the present invention, when the TCP status flag is Ack, the authentication approval module determines that the packet is an authentication response packet and confirms the acknowledgment number of the Acknowledgment field, Lt; RTI ID = 0.0 > validation < / RTI >

In another aspect of the present invention, in the case of the Ack packet, the authentication approval module compares the value obtained by subtracting 1 from the acknowledgment number and the combination of the source IP, the destination IP, the source port, and the destination port, When the stamp is confirmed and the time set by the user has not passed, the IP information of the user is transmitted to the authentication list management module and added to the authentication user list.

According to the present invention, it is possible to control excessive traffic caused by an abnormal user such as a traffic retransmission program or a script, which is not an actual user.

In particular, according to the present invention, unauthorized traffic is controlled only by an authenticated IP list by performing authentication on a user without operating a state table or the like in order to reduce complexity and load due to various state table management, And not only the traffic coming from the outside to the inside but also the abnormal traffic from the inside to the outside can be controlled.

1 is a block diagram of an apparatus for controlling an abnormal network traffic through user authentication according to a preferred embodiment of the present invention.
2 is a diagram illustrating a packet structure received by the traffic analysis module.
3 is a diagram illustrating an authentication process.
4 is a flowchart illustrating a method of controlling an abnormal network traffic through user authentication according to an exemplary embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.

First, the terminology used in the present application is used only to describe a specific embodiment, and is not intended to limit the present invention, and the singular expressions may include plural expressions unless the context clearly indicates otherwise. Also, in this application, the terms "comprise", "having", and the like are intended to specify that there are stated features, integers, steps, operations, elements, parts or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a block diagram of an apparatus for controlling an abnormal network traffic through user authentication according to a preferred embodiment of the present invention.

Referring to FIG. 1, an apparatus for controlling an abnormal network traffic through user authentication according to an exemplary embodiment of the present invention includes a traffic analysis module 100, an authentication inspection module 200, a status check module 300, 400, a packet generation module 500, an authentication list management module 600, and an authentication list database 700.

The traffic analysis module 100 analyzes the headers of the internal / external packets according to the directions of the packets and analyzes the headers according to the respective protocols, collects the IP information for attempting connection, and obtains the status flag of the TCP.

The structure of the packet received by the traffic analysis module is shown in FIG. 2. The source IP address (SouRCe IP address) 10, the destination IP address (DST IP) (DeSTnation IP address) 20, A TCP flag (TCP Flags) 30, and data (DATA) 40.

Next, the authentication checking module 200 compares the protocol with the authentication user list in the authentication list database 700 based on the protocol received from the traffic analysis module 100 and the IP information (source IP address and destination IP address) The user is allowed to pass the corresponding packet in the case of a user who has been authenticated in advance and to the status check module 300 in the case of a user who has not been authenticated in advance.

The authentication checking module 200 compares the source IP of the packet coming from the outside to the inside and compares the destination IP of the packet going from the inside to the outside.

As a result of comparison, when the packet exists in the authentication user list, the authentication checking module 200 updates the final access time of the authentication list database 700 and forwards the packet to the opposite side and passes the packet.

The state check module 300 checks the TCP state based on the information analyzed by the traffic analysis module 100.

The state check module 300 checks the state of the TCP and moves the packet to the authentication approval module 400 when the TCP flag is Syn or Ack, and determines that other packets are not authorized users and blocks the packets ).

Here, Syn is used to establish the initial session connection with the TCP flag status value. And, Ack means that an acknowledgment number value is set as the TCP flag status value.

At this time, the Acknowledgment number is a value obtained by adding +1 to the sequence number previously received as the next sequence number expected by the receiver.

The sequence number is a sequence number of the TCP data. When the Syn flag is set, the sequence number is initialized, and the value is an accumulated value of the transmitted data.

If the flag value of the TCP is Syn, the authentication approval module 400 determines that the user is the first access user based on the status information of the packet received from the status check module 300, When the TCP flag is Ack, it is determined that the packet is an authentication response packet and the acknowledgment number in the Acknowledgment field is checked to verify whether the packet is an authentication response packet for the authentication request.

The authentication approval module 400 delivers the packet to the list management module 600 in the case of a packet whose authentication is valid according to the verification result. If the packet is invalid, the authentication approval module 400 determines that the packet is an unauthenticated user and blocks the packet.

The packet generation module 500 generates an authentication value based on the information received from the status check module, generates an authentication request packet to the user in a sequence field, or transmits the authentication request packet to the user when the authentication is completed, And transmits an RST packet for guiding the packet.

3, the authentication acknowledgment module 400 of the abnormal network traffic control apparatus through the user authentication verifies that the flag value of the TCP is 'Syn' based on the status information of the packet received from the status check module 300 The packet generation module 500 determines that the user is the first access user and requests the packet generation module 500 to generate an authentication request packet. Accordingly, the packet generation module 500 generates an authentication request packet and transmits the authentication request packet to the user terminal.

At this time, when the packet generation module 500 is requested to generate an authentication request packet, a value obtained by combining the source IP, the destination IP, the source port, and the destination port of the corresponding Syn packet received from the status check module 300 and a time stamp It stores the authentication value in the sequence number of the sequence field and sets the Syn-Ack flag to generate and transmit the authentication request packet.

Then, the user terminal generates and transmits an authentication response packet accordingly, and authentication is completed accordingly.

The authentication list management module 600 adds the IP information of the authenticated users in the administrator's add command or the authentication approval module 400 to the authentication user list of the authentication list database 700, And manages the overall authentication user list such as deleting the IP information from the authentication user list for expired users.

That is, the authentication list management module 600 periodically checks the authentication user list of the authentication list database 700 and notifies the authentication list module 600 of an IP Is deleted from the list, and management functions such as addition, deletion, and reset of the authentication list by the user are performed.

4 is a flowchart illustrating a method of controlling an abnormal network traffic through user authentication according to an exemplary embodiment of the present invention.

Referring to FIG. 4, a method for controlling an abnormal network traffic through user authentication according to an exemplary embodiment of the present invention includes: determining whether a packet received from a network interface card (NIC) And analyzes the information to determine IP information (source IP address and destination IP address) and TCP flag information of the packet (S100).

Using the analyzed information of the traffic analysis module, the authentication checking module searches the authentication user list to determine whether the corresponding IP is a user who has been authenticated (S102). At this time, And compares destination IPs for packets going from the inside to the outside.

As a result of the determination, if the packet exists in the authentication user list, the authentication checking module updates the last access time of the authentication list database and forwards the packet to the opposite side for passing through (S104).

On the other hand, if the corresponding IP is not a user who has already been authenticated, the status check module checks the TCP status flag to check whether the status of the TCP status flag is the Syn flag or the Ack flag (S110).

If the Ack flag is set, the status check module sends an authentication response packet to the authentication request. When the Ack flag is set, the status check module sends an authentication response packet to the authentication request module And to the reporting user authentication module. In the case of the other packets, it is determined that the packet is unauthenticated and all packets are dropped (S112).

Thereafter, in the case of the Syn packet (S114), the authentication approval module determines that it is the first connection attempt and requests the packet generation module to generate the authentication request packet.

Accordingly, when the packet generation module is requested to generate an authentication packet, the packet generation module stores the combination value of the source IP, the destination IP, the source port, and the destination port of the corresponding Syn packet as the authentication value and the timestamp in the sequence number of the sequence field, A response request packet is generated by setting the -Ack flag and transmitted (S120).

On the other hand, if the flag value of TCP is Ack based on the status information of the packet received from the status check module, the authentication approval module determines that the packet is an authentication response packet and confirms the acknowledgment number of the Acknowledgment field, And verifies whether it is an authentication response packet for the request (S116).

That is, in the case of the Ack packet, the authentication acknowledgment module determines the Ack packet as a response to the authentication request, and compares the value obtained by subtracting 1 from the acknowledgment number of the acknowledgment field and the combination of the source IP, destination IP, If the value is the same and the time stamp is confirmed and the time set by the user is not passed, the IP information of the user is transferred to the authentication list management module, added to the authentication user list, and the packet generation module requests the re-connection guidance packet.

When the packet generation module is requested to generate a re-connection induction packet, the RST packet is generated and transmitted to terminate the connection (S122).

At this time, a source IP is added in case of a packet in which the direction of the packet comes from the outside to the inside, and a destination IP is added in case of a packet going from the inside to the outside. If the value is not equal or exceeds the time, the authentication approval module drops the packet (S112).

According to the present invention, it is possible to control excessive traffic caused by an abnormal user such as a traffic retransmission program or a script, which is not an actual user.

In particular, according to the present invention, unauthorized traffic is controlled only by an authenticated IP list by performing authentication on a user without operating a state table or the like in order to reduce complexity and load due to various state table management, And not only the traffic coming from the outside to the inside but also the abnormal traffic from the inside to the outside can be controlled.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments of the present invention are not intended to limit the scope of the present invention but to limit the scope of the present invention. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

100: traffic analysis module 200: authentication inspection module
300: status check module 400: authentication approval module
500: packet generation module 600: authentication list management module
700: Authentication List Database

Claims (13)

A traffic analysis module that receives packets and collects IP information; And
And an authentication checking module for searching for an authentication user list based on the IP information collected by the traffic analysis module and passing the packet when the user is an authenticated user. The method according to claim 1,
The traffic analysis module classifies the direction of a packet whether a packet is an incoming packet or an outgoing packet,
In the case of a packet coming from the outside to the inside, the authentication inspection module searches the authentication user list for the IP address of the collected IP information to determine whether the user is an authenticated user. To the authentication user list to determine whether the user is an authenticated user. The method according to claim 1,
The traffic analysis module obtains a TCP status flag of the packet,
An authentication list database for managing the authentication user list;
An authentication list management module for adding an authentication authorized user to the authentication user list of the authentication list database;
A packet generation module for generating and transmitting an authentication request packet to a user by generating an authentication value in a sequence field; And
Requesting generation of an authentication request packet to the packet generation module when the TCP status flag acquired by the traffic analysis module is Syn, and when the TCP status flag is Ack, transferring the authentication response packet to the authentication list management module when the authentication response packet is valid Further comprising an authentication approval module for allowing the user authentication module to add to the authentication user list. The method according to claim 3,
And a status check module for providing the status information of the TCP status flag to the authentication acknowledgment module when the TCP status flag acquired by the traffic analysis module is in the Syn status or the Ack status and blocking the packet if the TCP status flag is other status An apparatus for controlling an abnormal network traffic through user authentication. The method according to claim 3,
The packet generation module stores a value obtained by combining a source IP, a destination IP, a source port, and a destination port of a Syn packet and a time stamp as an authentication value in a sequence number of a sequence field when a request for generating an authentication request packet is received. An apparatus for controlling an abnormal network traffic through user authentication for generating and transmitting an authentication request packet by setting an Ack flag. The method according to claim 3,
When the TCP status flag is Ack, the authentication acknowledgment module determines that the packet is an authentication response packet and confirms the acknowledgment number of the Acknowledgment field, and confirms whether the packet is an authentication response packet for the authentication request. Apparatus for controlling abnormal network traffic. The method of claim 6,
In the case of the Ack packet, the authentication approval module compares the value obtained by subtracting 1 from the acknowledgment number and the combination of the source IP, the destination IP, the source port, and the destination port, checks the timestamp, And transmitting the IP information of the user to the authentication list management module and adding the IP information to the authentication user list when the time has passed. (A) the traffic analysis module receives a packet and collects IP information and a TCP status flag; And
(B) the authentication inspection module searches the authentication user list based on the IP information collected by the traffic analysis module, and passes the packet if the user is the authenticated user. The method of claim 8,
The step (B)
(B-1) In the case of a packet coming from the outside to the inside, the authentication inspection module searches the authentication user list of the IP address of the collected IP information to determine whether the user is an authenticated user. And
(B-2) In the case of a packet going from the inside to the outside, the authentication checking module determines whether the user is an authenticated user by searching for the destination IP from the collected IP information in the authenticated user list, Control method. The method of claim 8,
(C) providing the state information of the TCP status flag to the authentication approval module when the TCP status flag acquired by the traffic analysis module is in the Syn status or the Ack status;
(D) requesting generation of an authentication request packet to the packet generation module when the TCP state flag acquired by the traffic analysis module is Syn;
(E) when the packet generation module is requested to generate an authentication request packet, generating an authentication value, generating an authentication request packet in a sequence field, and generating and transmitting an authentication request packet to the user; And
(F) when the TCP status flag is Ack, when the authentication response packet is valid, the authentication approval module transmits the authentication response packet to the authentication list management module and adds the authentication response packet to the authentication user list, . 12. The method of claim 10,
In step (E), when the generation packet of the authentication request packet is requested, the packet generation module generates a sequence of sequence fields by using a combination of a source IP, a destination IP, a source port, And storing the number in the number field and setting a Syn-Ack flag to generate and send an authentication request packet. 12. The method of claim 10,
In step (F), if the TCP status flag is Ack, the authentication acknowledgment module determines that the packet is an authentication response packet and confirms an acknowledgment number of the Acknowledgment field. A method for controlling abnormal network traffic through user authentication. The method of claim 12,
In the case of the Ack packet, the authentication approval module compares the value obtained by subtracting 1 from the acknowledgment number and the combination of the source IP, the destination IP, the source port, and the destination port, checks the timestamp, And transmitting the IP information of the user to the authentication list management module and adding the IP information to the authentication user list when the time passes.

Images