Network protection device and method thereof

Abstract

To provide a network protection device and a method thereof.SOLUTION: According to the present disclosure, a network protection device can include a communication device, a storage device that stores a white list that defines connection authority between a plurality of first terminals belonging to a target network, and a control device configured to modulate an ARP (Address Resolution Protocol) table of each of the plurality of first terminals using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and to block or transmit the first communication flow to a destination based on the white list when the first communication flow is received.SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] The present disclosure relates to a network protection device and method, and more particularly to a network protection device and method for preventing the spread of malicious code. [Background technology]

[0002] In recent years, many malicious codes have been actively using infection routes such as internal networks to take over key data and expand the scale of damage. The damage caused by a malicious code infection is not limited to the infected system, but spreads to all systems in the same network, increasing the scale of damage. Even if we could prevent the damage from spreading from one infected system to other systems, we could dramatically reduce the damage caused by malicious code.

[0003] Malicious code is distributed in various ways, including disguising security emails such as card statements, stealing web cookies, sidejacking, session hijacking, etc. In recent years, the trend in distributing malicious code has changed to a method in which hacker groups that specialize in stealing only connection privileges slowly gain access over a long period of time, then plant malicious code and sell the information to other hacker groups for financial gain.

[0004] If the system infected with the malicious code contains important information, the victim has no choice but to pay the amount demanded by the hacker, and even after paying the amount, there is no guarantee that the information will not be recovered or spread. In order to prepare for an attack, the vigilance of all members is required, but it is also necessary to prevent the damage from spreading from one infected system to many other systems connected to the same network. Summary of the Invention [Problem to be solved by the invention]

[0005] The present disclosure provides a network protection device and method capable of preventing malicious code from entering a network and preventing damage caused by malicious code from spreading between terminals connected to the same network or between networks. [Means for solving the problem]

[0006] A network protection device according to one embodiment for solving the above problem may include a communication device, a storage device for storing a white list defining connection authority between a plurality of first terminals belonging to a target network, and a control device configured to modulate an ARP table of each of the plurality of first terminals using an Address Resolution Protocol (ARP) packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and to block or transmit the first communication flow to a destination based on the white list when the first communication flow is received.

[0007] The control device may be configured to generate an ARP response packet including an IP address of a first terminal whose MAC (Media Access Control) address is to be modulated in the ARP table and a MAC address of the network protection device as origin address information, and transmit the ARP response packet to each of the plurality of first terminals to modulate the ARP table.

[0008] The control device may be configured to collect address information of each of the first terminals using an ARP request packet. The address information may include an IP address and a MAC address.

[0009] The control device can be configured to detect an unauthorized terminal among the plurality of first terminals based on the address information, and to use an ARP packet to modulate a MAC address included in the ARP table of the unauthorized terminal to a MAC address with which communication is not possible, thereby blocking communication of the unauthorized terminal.

[0010] The control device can be configured to execute a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) process in a first terminal that is the starting point of the first communication flow, if the received first communication flow is a communication flow that is permitted to be connected by the whitelist, and to block or transmit the received first communication flow to a destination depending on the CAPTCHA authentication result in the first terminal that is the starting point.

[0011] The storage device further stores a blacklist that defines connection authority between the plurality of first terminals and an external network of the target network;

[0012] The control device can be configured to modulate the ARP table of each of the plurality of first terminals using an ARP packet so that a second communication flow transmitted from any of the plurality of first terminals toward the external network is received by the communication device, and when the second flow is received, to block or transmit the second communication flow to the external network based on the blacklist.

[0013] The control device may be configured to generate an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as origin address information, and to transmit the ARP response packet to each of the plurality of first terminals to modulate the MAC address of the gateway in the ARP table.

[0014] The control device may be configured to store DNS information of a Domain Name System (DNS) response packet in a DNS table each time the control device receives a DNS response packet from the external network, and, when the control device determines that the second communication flow is a communication flow generated without a DNS query by referring to the DNS table, block the second communication flow without transmitting it to a destination. The DNS information may include an IP address and a domain address included in the DNS response packet.

[0015] The control device may be configured to store in a flow table flow information of a communication flow generated each time a communication flow occurs whose origin or destination is the plurality of first terminals, and when a third communication flow destined for any of the plurality of first terminals is received in an external network of the target network, to refer to the flow table and determine whether the third communication flow is a communication flow generated at the request of any of the plurality of first terminals, and when it is determined that the third communication flow is a communication flow generated at the request of any of the plurality of first terminals, to transmit the third communication flow to the first terminal that is the destination. The flow information may include address information of the origin and destination of the corresponding communication flow, and protocol information.

[0016] The control device can be configured to instruct a second terminal having an agent installed thereon to detect an AP (Access Point) located on a communication path between the network protection device and the second terminal, and when the AP is detected on the communication path by the second terminal, to instruct the second terminal to collect terminal information of at least one third terminal connected to the AP, to receive from the second terminal address information of the at least one third terminal collected by the second terminal using an ARP packet, to detect an unauthorized terminal among the at least one third terminal based on the address information of the at least one third terminal, and when the unauthorized terminal is detected, to instruct the second terminal to block communication of the unauthorized terminal using an ARP packet.

[0017] In addition, a network protection method of a network protection device according to one embodiment may include a step of modulating an ARP table of each of a plurality of first terminals belonging to a target network using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the network protection device, and a step of blocking or transmitting the first communication flow to a destination based on a whitelist defining connection authority between the plurality of first terminals when the first communication flow is received.

[0018] The modulating step may include a step of generating an ARP response packet including an IP address of a first terminal whose MAC address is to be modulated in the ARP table and a MAC address of the network protection device as origin address information, and a step of transmitting the ARP response packet to each of the plurality of first terminals to modulate the ARP table.

[0019] The network protection method may further include collecting address information of each of the first terminals using an ARP request packet, the address information including an IP address and a MAC address of the corresponding first terminal.

[0020] The network protection method may further include a step of detecting an unauthorized terminal among the plurality of first terminals based on the address information, and a step of using an ARP packet to modulate a MAC address included in the ARP table of the unauthorized terminal to a MAC address that does not allow communication, thereby blocking communication of the unauthorized terminal.

[0021] The network protection method may further include executing a CAPTCHA process in a first terminal that is a source of the first communication flow, and receiving a CAPTCHA authentication result from the first terminal that is the source. The step of blocking or transmitting the first communication flow to a destination may include blocking or transmitting the first communication flow to a destination based on the CAPTCHA authentication result and the whitelist.

[0022] The network protection method may further include a step of modulating the ARP table using an ARP packet so that a second communication flow transmitted from any one of the plurality of first terminals toward an external network of the target network is received by the network protection device, and a step of blocking or transmitting the second communication flow to the external network by referring to a blacklist that defines connection authority between the plurality of first terminals and the external network when the second flow is received.

[0023] The step of modulating the ARP table so that the second communication flow is received by the network protection device may include the steps of generating an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as origin address information, and transmitting the ARP response packet to each of the plurality of first terminals and modulating the MAC address of the gateway in the ARP table.

[0024] The network protection method may further include a step of storing DNS information of the received DNS response packet in a DNS table every time a DNS response packet is received from the external network. The step of blocking or transmitting the second communication flow to the external network may include a step of determining whether the second communication flow is a communication flow generated without a DNS query by referring to the DNS table, and a step of blocking the second communication flow without transmitting it to a destination if the second communication flow is a communication flow generated without a DNS query. The DNS information may include an IP address and a domain address included in the DNS response packet.

[0025] The network protection method may further include the steps of: storing flow information of a communication flow generated each time a communication flow originating or destination is generated at the plurality of first terminals in a flow table; receiving a third communication flow destined for any one of the plurality of first terminals in an external network of the target network; and, when it is determined that the third communication flow is a communication flow generated at the request of any one of the plurality of first terminals by referring to the flow table, transmitting the third communication flow to the first terminal that is a destination. The flow information may include address information of origin and destination of the corresponding communication flow, and protocol information. Effect of the Invention

[0026] According to the present disclosure, it is possible to prevent malicious code from entering a network, and to prevent damage caused by malicious code from spreading between terminals connected to the same network or between networks. [Brief description of the drawings]

[0027] [Figure 1A] 1 illustrates an example of a network system to which a network protection device according to an embodiment is applied. [Figure 1B]1 illustrates an example of a network system in which a private network exists, to which a network protection device according to an embodiment is applied. [Diagram 2] 1 illustrates a schematic diagram of a network protection device according to an embodiment; [Diagram 3] 1 illustrates a schematic diagram of a communication flow control method for a network protection device according to an embodiment. [Figure 4] 1 illustrates a method for controlling a communication flow generated between internal terminals by a network protection device according to an embodiment. [Diagram 5] 1 illustrates a schematic diagram of a method for controlling communication flow from an internal terminal to an external network by a network protection device according to an embodiment. [Figure 6] 1 illustrates a schematic diagram of a method for controlling communication flow from an external network to an internal terminal by a network protection device according to an embodiment; [Figure 7] 1 illustrates a schematic diagram of a method for managing a private network by a network protection device according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] Hereinafter, the embodiments disclosed herein will be described in detail with reference to the accompanying drawings, and the same or similar components are given the same or similar reference numerals, and the duplicated description thereof will be omitted. The suffixes "module" and "part" for components used in the following description are given or mixed for the sake of ease of specification writing only, and do not have any meaning or role that is different from each other. In addition, when describing the embodiments disclosed herein, if a detailed description of related known technology is determined to make the gist of the embodiments disclosed herein unclear, the detailed description will be omitted. In addition, the accompanying drawings are intended to facilitate understanding of the embodiments disclosed herein, and the technical ideas disclosed in the present specification are not limited by the accompanying drawings, and should be understood to include all modifications, equivalents, or alternatives included in the ideas and technical scope of the present invention.

[0029] Terms including ordinal numbers, such as "first," "second," and the like, may be used to describe various components, but the components are not limited by these terms. These terms are used only to distinguish one component from another.

[0030] A singular expression includes a plural expression unless the context clearly indicates otherwise.

[0031] In this application, the terms "comprise" or "have" and the like are intended to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof set forth in the specification, but are to be understood as not precluding the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0032] FIG. 1A illustrates an example of a network system to which a network protection device according to an embodiment is applied.

[0033] Referring to FIG. 1A, packets transmitted between a network 1 to be protected (hereinafter referred to as a "target network") and an external network (e.g., the Internet) pass through a firewall 11 and a switch 12. The firewall 11 is responsible for the security of the target network 1 and can function to block harmful traffic entering or leaving the target network 1. In this specification, the internal network and the external network of the target network 1 are distinguished based on the use of a router, and can also be distinguished based on whether or not they use the same broadcast domain. In a network system, a router distinguishes networks and blocks broadcasts from being transmitted to other networks. In this case, the range that a broadcast reaches is called a broadcast domain.

[0034] The switch 12 can operate as a backbone switch located at the center of nodes that wish to connect to the Internet in the target network 1. In this case, all packets transmitted and received between the target network 1 and an external network pass through the switch 12. The switch 12 can also operate as a gateway for the target network 1. The gateway can transfer packets between an external network and the target network 1 based on a destination Internet Protocol (IP) address included in each packet.

[0035] The switch 12 can also support communication between terminals (hereinafter referred to as "internal terminals") (14: 14-1, ..., 14-n) belonging to the target network 1. The internal terminals 14 can include network terminals and servers belonging to the target network 1, as well as network peripherals such as a NAT (Network Address Translation) device (for example, AP 151 in FIG. 1B described later) and a printer.

[0036] The target network 1 may further include a network protection device 13 to prevent damage caused by malicious code from spreading rapidly when the malicious code is installed in the internal terminal 14. The network protection device 13 is connected to the switch 12 and can communicate with the internal terminal 14 or a gateway (or the switch 12 functioning as a gateway).

[0037] The network protection device 13 can detect terminal information of the internal terminal 14 belonging to the target network 1 using an Address Resolution Protocol (ARP) packet. The network protection device 13 can also isolate the internal terminal 14 so that a communication flow generated from the internal terminal 14 of the target network 1 is transmitted only through the network protection device 13. The network protection device 13 can block or allow a communication flow between the internal terminals 14 of the target network 1 using a white list and a flow cache table. The network protection device 13 can also block or allow a communication flow between the internal terminal 14 and an external network using a black list and a Domain Name System (DNS) cache table.

[0038] Each internal terminal 14 can collect process information of processes executed in the background of the internal terminal 14. The process information can include the execution path of the process executed in the background, communication information used in the process (e.g., destination IP address and port number, protocol information (TCP, UDP, etc.)), etc. The internal terminal 14 can transmit the collected process information to the network protection device 13. An agent for collecting process information can be installed in the form of an application in each internal terminal 14.

[0039] The network protection device 13, which receives process information from each internal terminal 14, can additionally perform a function of comparing the received process information with a whitelist to determine whether or not each internal terminal 14 is infected with malware. When it is determined that any of the internal terminals 14 is infected with malware, the network protection device 13 can block the communication flow generated by that internal terminal 14.

[0040] FIG. 1B illustrates another example of a network system to which a network protection device according to an embodiment is applied.

[0041] 1B, the target network 1 may include a private network 15 connected via an AP (Access Point) 151 (or a NAT device). The private network 15 may include the AP 151 and terminals (16:16-1, ..., 16-n) connected to the AP 151.

[0042] The network protection device 13 can additionally perform the function of detecting the AP 151 .

[0043] An agent for communicating with the network protection device 13 may be installed in the terminal 16 belonging to the private network 15. In this case, the network protection device 13 can detect the AP 151 by communicating with the agent installed in the terminal 16. When the AP 151 of the private network 15 is detected in the target network 1, the network protection device 13 can also communicate with the agent of the terminal 16 to collect address information of the terminal 16 connected to the AP 151. In addition, the network protection device 13 can detect an unauthorized terminal connected to the AP 151 of the private network 15 based on the collected address information of the terminal 16. The network protection device 13 can further communicate with the agent of the terminal 16 to block communication between an unauthorized terminal connected to the AP 151 and the terminal 16 in which an agent is not installed. The agent of the terminal 16 can block communication between an unauthorized terminal and a terminal in which an agent is not installed by continuously transmitting an ARP packet to the gateway 152 of the AP 151 and the terminal 16 to be blocked.

[0044] If the terminal 16 does not have an agent installed, the network protection device 13 can also perform a self-discovery process to discover the APs 151 of the private network 15 .

[0045] FIG. 2 illustrates a schematic diagram of a network protection device according to an embodiment.

[0046] Referring to FIG. 2, the network protection device 13 according to one embodiment may include a storage device 21, a communication device 22, and a control device .

[0047] The storage device 21 includes at least one memory and can store various information, data, etc. processed by the network protection device 13.

[0048] The storage device 21 can temporarily store packets transmitted through the network protection device 13 .

[0049] The storage device 21 can also store policy information used by the network protection device 13. The policy information can include a management bandwidth policy in the target network 1. The management bandwidth policy can include static information related to the management bandwidth of the target network 1, such as an IP address range assigned to the target network 1 and Virtual Local Area Network (VLAN) information.

[0050] The storage device 21 can also store terminal information of each internal terminal 14 acquired by the control device 23 described later. The terminal information can include address information (IP address and MAC address) of each internal terminal 14, status information (online or not), and the like.

[0051] The storage device 21 may store, in the form of a flow cache table, flow information of a communication flow transmitted through the network protection device 13. The flow information may include 5-tuple information including a source IP address and port number, a destination IP address and port number, and protocol information of the corresponding communication flow.

[0052] The storage device 21 may also store a whitelist. The whitelist may include information related to connection permission between internal terminals 14 in the target network 1. That is, the whitelist may include information regarding which internal terminal 14 is permitted to connect to which other internal terminal 14 in the target network 1, that is, connection permission information between terminals. The whitelist may include 5-tuple information including IP address information (or IP address band), port number, protocol information, etc. permitted to connect to each internal terminal 14 registered in the whitelist. The whitelist may further include information on software that is mandatory to be installed in the internal terminal 14 depending on the operating system.

[0053] The storage device 21 can also store a blacklist. The blacklist can include information related to connection restrictions of the internal terminals 14 to the external network of the target network 1. That is, the blacklist can include information on destinations (e.g., web servers, etc.) in the external network that are not permitted to be connected to for each internal terminal 14 registered in the blacklist. That is, the blacklist can include information on IP addresses, domains, etc. that are not permitted to be connected to for each internal terminal 14 of the target network 1.

[0054] The storage device 21 may also store an exception list. The exception list may include information (such as IP address, domain information, etc.) regarding external networks that are permitted for connection to the internal terminal 14 of the target network 1.

[0055] The storage device 21 may store, in the form of a DNS cache table, DNS information of a DNS response packet generated between the external network and the internal terminal 14. The DNS information is information extracted from the DNS response packet, and may include destination address information (IP address and domain address) of a destination (e.g., a web server) in the external network to which the internal terminal 14 wishes to connect.

[0056] The communication device 22 can transmit and receive information, packets, etc. between other devices belonging to the target network 1 and the network protection device 13. The communication device 22 is connected to each internal terminal 14 connected to the target network 1 via the switch 12, and can transmit and receive packets (ARP packets, UDP (User Datagram Protocol) packets, TCP (Transmission Control Protocol) packets, etc.) with each internal terminal 14. The communication device 22 is connected to an external network via a gateway (for example, the switch 12 that performs a gateway function), and can also transmit and receive packets with the external network.

[0057] The control device 23 can collect terminal information of the internal terminals 14 belonging to the target network 1. The control device 23 can control the communication flow of the internal terminals 14 so that all packets between the internal terminals 14 belonging to the target network 1 and between the internal terminals 14 and a gateway (i.e., between the internal terminals 14 and an external network) are transmitted via the network protection device 13. The control device 23 can also permit or block packet transmission between the internal terminals 14 belonging to the target network 1 and between the internal terminals 14 and an external network by referring to a whitelist, a blacklist, an exception list, a flow cache table, a DNS cache table, etc. stored in the storage device 21.

[0058] For this purpose, the control device 23 can include a terminal information collection unit 231 , a flow control unit 232 , a policy management unit 233 , a policy application unit 234 , a DNS processing unit 235 , and a packet processing unit 236 .

[0059] When the operation of the network protection device 13 is started, the terminal information collection unit 231 can collect terminal information (address information, state information, etc.) of the internal terminal 14 belonging to the target network 1.

[0060] The terminal information collecting unit 231 can collect address information (IP address and MAC address) of each internal terminal 14 by using an ARP request packet. At the time of initial operation of the network protection device 13, the IP address of each internal terminal 14 is unknown, so the terminal information collecting unit 231 can generate an ARP request packet for collecting address information based on the managed bandwidth policy of the target network 1. The terminal information collecting unit 231 can select an arbitrary IP address from the IP address range assigned to the target network 1, generate an ARP request packet including this as destination address information, and transmit it to the internal terminal 14 by broadcasting.

[0061] If there is an internal terminal 14 corresponding to the destination IP address of the ARP request packet transmitted in this manner, the internal terminal 14 can transmit an ARP response packet including its own IP address and MAC address as origin address information by unicast to the network protection device 13. When the terminal information collection unit 231 receives an ARP response packet, it can obtain address information (IP address and MAC address) of the corresponding internal terminal 14 from the origin address information (origin IP address and origin MAC address) included in the response packet.

[0062] The terminal information collecting unit 231 can generate an ARP request packet while changing an IP address used as destination address information within the IP address range allocated to the target network 1. The terminal information collecting unit 231 can sequentially broadcast the ARP request packet with the changed destination address information to the internal terminals 14. The terminal information collecting unit 231 waits for a response packet to be received every time an ARP request packet is broadcast, and when an ARP response packet is received, analyzes the packet to obtain address information of the corresponding internal terminal 14, thereby collecting address information of all internal terminals 14 connected to the target network 1. The terminal information collecting unit 231 can further set the state information of the internal terminal 14 that has transmitted the ARP response packet to indicate an online state.

[0063] The terminal information collecting unit 231 may also monitor the online state of each internal terminal 14 using an ARP packet. The terminal information collecting unit 231 may generate an ARP request packet including an IP address of an internal terminal 14 whose online state is to be confirmed as destination address information, and broadcast the ARP request packet within the target network 1. Thereafter, the terminal information collecting unit 231 may determine state information of the corresponding internal terminal 14 depending on whether an ARP response packet is received for the transmitted ARP request packet. The terminal information collecting unit 231 may transmit an ARP request packet at least once for a predetermined period of time to the internal terminal 14 whose state is to be confirmed, and then wait for reception of an ARP response packet from the corresponding internal terminal 14. If an ARP response packet is not received from the corresponding internal terminal 14 within a predetermined period of time after transmitting the ARP request packet, the terminal information collecting unit 231 may determine that the corresponding internal terminal 14 is in an offline state. If an ARP response packet is received from the corresponding internal terminal 14 within a predetermined period of time after transmitting the ARP request packet, the terminal information collecting unit 231 may determine that the corresponding internal terminal 14 is in an online state. The terminal information collection unit 231 can further set state information of each internal terminal 14 based on the determined state. Here, the online state of the internal terminal 14 can indicate a state in which the connection between the internal terminal 14 and the target network 1 is activated, and the offline state of the internal terminal 14 can indicate a state in which the connection between the internal terminal 14 and the target network 1 is deactivated.

[0064] When the terminal information collection unit 231 collects the terminal information (state information and address information) of each internal terminal 14 in the above-mentioned manner, it can store and manage the collected information in the storage device 21.

[0065] The flow control unit 232 can use the terminal information and ARP packets of the internal terminals 14 belonging to the target network 1 to control the communication flows of the internal terminals 14 so that the communication flows of all the internal terminals 14 are transmitted through the network protection device 13.

[0066] The flow control unit 232 can modulate the MAC addresses of other internal terminals 14 and the gateway in the ARP table stored in each internal terminal 14 in order to change the communication flow of the internal terminal 14. The ARP table of each internal terminal 14 can include address information (IP address and MAC address) of a network device (e.g., the internal terminal 14) that belongs to the same broadcast domain (target network 1) as the internal terminal 14, and address information (IP address and MAC address) of a gateway (or a switch 12 acting as a gate) to which the network device is connected.

[0067] The flow control unit 232 can use the modulated ARP response packet to modulate the MAC address of the internal terminal 14 in the ARP table. Each modulated ARP response packet can include the IP address and MAC address of the internal terminal 14 whose ARP table is to be modulated as destination address information, and the IP address of the target (internal terminal) whose MAC address is to be modulated in the corresponding ARP table and the modulated MAC address (the MAC address of the network protection device 13) as source address information. When the modulated ARP response packet is generated, the flow control unit 232 can transmit it in a unicast manner to the internal terminal 14 whose ARP table is to be modulated. The internal terminal 14 that receives it from the network protection device 13 can obtain the source IP address and modulated MAC address from the received ARP response packet and use it to change the MAC address of the corresponding internal terminal 14 in its own ARP table.

[0068] The flow control unit 232 may transmit an ARP response packet one or more times to each internal terminal 14 to modulate the MAC addresses of all internal terminals 14 to the MAC address of the network protection device 13 in the ARP table of each internal terminal 14 .

[0069] Since the MAC addresses of all other internal terminals 14 belonging to the target network 1 are modulated to the MAC address of the network protection device 13 in the ARP table of each internal terminal 14, when each internal terminal 14 attempts to transmit a packet to another internal terminal, the packet is transmitted by referring to the MAC address of the network protection device 13, not the MAC address of the internal terminal. Therefore, a packet transmitted by each internal terminal 14 to another internal terminal 14 can be first delivered to the network protection device 13 instead of the internal terminal.

[0070] The flow control unit 232 may use the modulated ARP response packet to modulate the MAC address of the gateway (or the switch 12 functioning as a gateway) to the MAC address of the network protection device 13 in the ARP table of each internal terminal 14. Here, the modulated ARP response packet may include the IP address and MAC address of the internal terminal 14 whose ARP table is to be modulated as destination address information, and may include the IP address of the actual gateway (the IP address of the switch 12) and the MAC address of the network protection device 13 as origin address information. When the modulated ARP response packet is generated, the flow control unit 232 may transmit the modulated ARP response packet to the internal terminal 14 whose ARP table is to be modulated, in a unicast manner. The internal terminal 14 that receives the ARP response packet with the gateway's MAC address modulated from the network protection device 13 may change the gateway's MAC address in its own ARP table using the modulated MAC address of the gateway acquired from the ARP response packet.

[0071] As described above, the flow control unit 232 transmits an ARP response packet with the gateway MAC address modulated to each internal terminal 14, and can modulate the gateway MAC address to the MAC address of the network protection device 13 in the ARP tables of all internal terminals 14 belonging to the target network 1.

[0072] Since the MAC address of the gateway is modulated to the MAC address of the network protection device 13 in the ARP table of each internal terminal 14, when each internal terminal 14 attempts to transmit a packet outside the target network 1, the packet is transmitted by referring to the MAC address of the network protection device 13, not the gateway. Therefore, a packet transmitted by each internal terminal 14 to the outside of the target network 1 can be first delivered to the network protection device 13 instead of the gateway.

[0073] The flow control unit 232 can isolate the internal terminal 14 by modulating the ARP table of each internal terminal 14 using the ARP packet as described above, so that packets sent and received by all internal terminals 14 pass through the network protection device 13 and are transmitted to other internal terminals 14 or the external network.

[0074] The flow control unit 232 can also block the communication flow of unauthorized internal terminals (not shown) connected to the target network 1 using modulated ARP packets.

[0075] The flow control unit 232 can modulate the MAC addresses of all other internal terminals 14 belonging to the target network 1 in the ARP table of the unauthorized internal terminal using the modulated ARP response packet to meaningless MAC addresses with which communication is not possible. The flow control unit 232 can generate an ARP response packet modulated to include the IP address and meaningless MAC address of each internal terminal 14 as origin address information and to include the IP address and MAC address of the unauthorized internal terminal as destination address information. The flow control unit 232 can transmit the ARP response packet modulated in this way to the unauthorized internal terminal in a unicast manner. The unauthorized internal terminal receiving this can change the MAC address of the corresponding internal terminal 14 in its ARP table to a meaningless MAC address with which communication is not possible. Therefore, the unauthorized internal terminal cannot confirm the correct MAC address of the other internal terminals 14 belonging to the target network 1, and communication with the other internal terminals 14 may be blocked.

[0076] The flow control unit 232 can also modulate the MAC address of the gateway to a meaningless address in the ARP table of the unauthorized internal terminal using the modulated ARP response packet. The flow control unit 232 can generate an ARP response packet modulated to include the IP address and meaningless MAC address of the gateway as origin address information and the IP address and MAC address of the unauthorized internal terminal as destination address information. The flow control unit 232 can transmit the ARP response packet modulated in this way to the unauthorized internal terminal in a unicast manner. The unauthorized internal terminal that receives this can change the MAC address of the gateway in its own ARP table to a meaningless MAC address with which communication is not possible. Therefore, the unauthorized internal terminal cannot confirm the correct MAC address of the gateway, and communication with the external network that should be connected via the gateway may be blocked.

[0077] The policy management unit 233 can set policy information for managing the internal terminal 14 belonging to the target network 1. The policy management unit 233 can receive input information for registering policy information from an administrator or an administrator terminal (not shown) and generate policy information based on the input information. The policy management unit 233 can store the set policy information in the storage device 21 and manage it.

[0078] The policy management unit 233 can also generate a whitelist, a blacklist, or an exception list to be used in the target network 1. The policy management unit 233 can receive input information for registering a whitelist, a blacklist, or an exception list from an administrator or an administrator terminal (not shown), and generate a whitelist, a blacklist, or an exception list based on the input information. The policy management unit 233 can store and manage the set whitelist, blacklist, or exception list in the storage device 21.

[0079] The policy applicator 234 can transmit the policy information registered by the policy manager 233 to a component that requires it (eg, the packet processor 236) so that the policy information can be applied.

[0080] The DNS processing unit 235 can analyze a DNS response packet generated between the external network and the internal terminal 14 to obtain DNS information (IP address and domain address) of a destination (e.g., a web server) in the external network to which the internal terminal 14 wishes to connect. The DNS processing unit 235 can store and manage the obtained DNS information in the storage device 21 in the form of a DNS cache table.

[0081] The packet processor 236 can receive packets transmitted between internal terminals 14 or between an external network of the target network 1 and the internal terminal 14, and can transmit or block the received packets to their destination.

[0082] For packet processing, the packet processing unit 236 may collect flow information on a communication flow generated for the internal terminal 14. The packet processing unit 236 may collect flow information by monitoring a communication flow generated between the internal terminal 14 and an external network. The packet processing unit 236 may also collect flow information by monitoring a communication flow generated between the internal terminals 14. The collected flow information may be 5-tuple information including an IP address and a port number of a source, an IP address and a port number of a destination, and protocol information. The packet processing unit 236 may store and manage the collected flow information in the storage device 21 in the form of a flow cache table. In order to simultaneously manage two-way communication flows between the external network and the internal terminal 14, the packet processing unit 236 may store the flow information based on a communication flow direction from inside the target network 1 to the external network when storing the flow information in the flow cache table. In addition, in the case of a communication flow from an external network to inside the target network 1, the packet processing unit 236 may interchange the order in which the destination information (IP address and port number) and the source information (IP address and port number) are stored when storing the flow information. In order to simultaneously manage two-way communication flows between internal terminals 14, the packet processing unit 236 can also manage the order in which flow information is stored based on a comparison of the IP addresses of the origin and destination, or on the initial starting point of each communication flow.

[0083] When a communication flow occurs for an internal terminal 14 of the target network 1 to connect to another internal terminal 14, the packet processing unit 236 can refer to the whitelist to determine whether or not the communication flow is permitted. When a communication flow occurring between the internal terminals 14 is a communication flow registered in the whitelist, the packet processing unit 236 can normally transmit packets of the communication flow to the destination internal terminal 14. The packet processing unit 236 can further add flow information of the communication flow to the flow cache table. When a communication flow occurring between the internal terminals 14 is a communication flow not registered in the whitelist, the packet processing unit 236 can block packets of the communication flow without transmitting them to the destination internal terminal 14. The packet processing unit 236 can further add flow information of the communication flow to the flow cache table.

[0084] If the internal terminal 14 is infected with malicious code, the background process of the internal terminal 14 may generate an arbitrary communication flow unintended by the user and connect to another internal terminal 14 registered in the whitelist. In this case, the packet processing unit 236 can additionally perform a security process such as a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) in cooperation with the policy application unit 234 to prevent the malicious code from spreading to other internal terminals 14.

[0085] When a communication flow occurs for an internal terminal 14 to connect to another internal terminal 14 registered in the whitelist, the policy application unit 234 can control the internal terminal 14 attempting the connection to execute a capture process. After that, the policy application unit 234 can receive an authentication result by the capture process from the internal terminal 14 and control the packet processing unit 236 according to the received authentication result. When the received authentication result indicates successful authentication, the policy application unit 234 can control the packet processing unit 236 to transmit packets of the corresponding communication flow to the destination internal terminal 14. When the received authentication result indicates failed authentication or the authentication result is not received for a predetermined time or more, the policy application unit 234 can control the packet processing unit 236 to block packets of the corresponding communication flow without transmitting them to the destination internal terminal 14.

[0086] When a communication flow destined for an external network occurs in the internal terminal 14 of the target network 1, the packet processing unit 236 can refer to the blacklist to determine whether or not to permit the communication flow. When a communication flow destined for an external network occurs in the internal terminal 14 of the target network 1, the packet processing unit 236 can generate flow information for the communication flow. The packet processing unit 236 compares the generated flow information with the blacklist, and if the corresponding flow is a communication flow registered in the blacklist, can block the packets of the flow without transmitting them to the external network. When the packet processing unit 236 determines that the corresponding flow is a flow not registered in the blacklist, it can pass the packets of the flow and transmit them to the external network.

[0087] In the case of infection with malicious code, a background process of the internal terminal 14 can generate a communication flow directly to the external network using an IP address without a DNS query. The packet processing unit 236 can use a DNS cache table to prevent the malicious code from spreading in such a case.

[0088] When a DNS request packet is generated from the internal terminal 14, the packet processing unit 236 may transmit the DNS request packet to the external network and then wait for a DNS response packet to be received from the external network. When the DNS response packet is received, the packet processing unit 236 may transmit the received DNS response packet to the DNS processing unit 235 to detect DNS information (IP address and domain address). The DNS processing unit 235 may obtain the DNS information (IP address and domain address) from the transmitted DNS response packet and add the obtained DNS information to a DNS cache table.

[0089] If the DNS information of a communication flow from the internal terminal 14 of the target network 1 to an external network is not registered in the DNS cache table, the packet processing unit 236 can block packet transmission of the communication flow regardless of the blacklist. If the DNS information of a communication flow from the internal terminal 14 of the target network 1 to an external network is DNS information registered in the DNS cache table, the packet processing unit 236 can permit or block packet transmission of the communication flow by referring to the blacklist as described above.

[0090] When a communication flow directed to the internal terminal 14 of the target network 1 occurs in the external network, the packet processing unit 236 can confirm whether or not the communication flow has occurred as a response to the communication flow generated in the internal terminal 14. In the case of a communication flow generated at the request of the internal terminal 14, the corresponding flow information may already be registered in the flow cache table. Therefore, the packet processing unit 236 can refer to the flow cache table to confirm whether or not the communication flow generated in the external network is a communication flow generated at the request of the internal terminal 14. In the case of a communication flow generated in the external network is a communication flow generated at the request of the internal terminal 14, the packet processing unit 236 can transmit the communication flow to the internal terminal 14, which is the destination. If the communication flow generated in the external network is not generated at the request of the internal terminal 14, the packet processing unit 236 can allow or block packet transmission of the communication flow by referring to the exception list. Even if the communication flow generated in the external network is not generated at the request of the internal terminal 14, if it is a communication flow registered in the exception list, the packet processing unit 236 can transmit the packets of the communication flow to the internal terminal 14, which is the destination.

[0091] The packet processing unit 236 can also receive process information from an agent installed in each internal terminal 14, and use the received process information and the whitelist to determine whether or not each internal terminal 14 is infected with malware. Based on the received process information, the packet processing unit 236 can determine that the corresponding internal terminal 14 is infected with malware if the corresponding process is executed on a route different from the route registered in the whitelist, if the process generates a communication flow using an IP address that has not been used before, or if the port number for receiving / waiting for connection in the communication flow has been changed.

[0092] When an internal terminal 14 is determined to be infected with malware, the packet processing unit 236 can block the communication flow generated by that internal terminal 14 .

[0093] When a private network 15 exists within the target network 1, the control device 23 can additionally perform a function of detecting an AP 151. For this purpose, the control device 23 can additionally include an AP detection unit 237.

[0094] An agent for communicating with the network protection device 13 may be installed in the terminal 16 belonging to the private network 15. In this case, the AP detection unit 237 may detect the AP 151 through communication with the agent installed in the terminal 16. The AP detection unit 237 may transmit a command to the agent installed in the terminal 16 to instruct detection of the AP 151. The agent of the terminal 16 that receives this command may detect the number of APs 151 located on the communication path using a traceroute command that tracks the communication path between the corresponding terminal 16 and the network protection device 13. The terminal 16 may use the traceroute command to check whether only one AP 151 exists on the communication path or whether multiple APs exist hierarchically.

[0095] The agent of the terminal 16 can transmit information on the number of APs 151 that have been identified to the network protection device 13. The AP detection unit 237 can check the number of APs 151 included in the target network 1 based on the information received from the agent of the terminal 16, and can display the information on a screen to notify the administrator of the target network 1. Therefore, the administrator can easily identify security vulnerabilities due to the private network 15 in the target network 1.

[0096] When the AP 151 of the private network 15 is detected in the target network 1 by the AP detection unit 237, the terminal information collection unit 231 can transmit a command to an agent installed in the terminal 16 to collect information of the terminal 16 connected to the AP 151. The agent of the terminal 16 that receives this command can collect address information (IP address and MAC address) of the terminal 16 connected to the corresponding AP 151 using an ARP packet. After that, the agent of the terminal 16 can transmit the address information of the terminal 16 connected to the corresponding AP 151 to the network protection device 13. The terminal information collection unit 231 that receives this can store the received terminal information in the storage device 21.

[0097] The flow control unit 232 can detect unauthorized terminals from among the terminals 16 in the private network 15 based on the terminal information received from the terminals 16 in the private network 15. When an unauthorized terminal is detected, the flow control unit 232 can transmit a command to the agent of the terminal 16 to instruct the blocking of communication not only with unauthorized terminals in the private network 15 but also with terminals 16 on which no agent is installed.

[0098] The agent of the terminal 16 that has received the communication blocking command can transmit an ARP packet for blocking communication to the gateway 152 in the AP 151 and the terminal 16 that is to be blocked. The agent of the terminal 16 can block the communication flow of the terminal 16 to be blocked by transmitting an ARP response packet with a modulated MAC address to the terminal 16 to be blocked, similar to the method in which the flow control unit 232 blocks the communication flow of an unauthorized terminal described above. The agent of the terminal 16 can continuously transmit the ARP packet for blocking communication until a blocking release command is received from the network protection device 13. When the administrator wishes to permit communication for the terminal 16 whose communication has been blocked, the administrator can control the network protection device 13 to transmit a communication permission command to the agent of the terminal 16.

[0099] If the terminal 16 does not have an agent installed, the AP detector 237 can also perform a self-discovery process to detect the APs 151 of the private network 15 .

[0100] The control device 23 may include at least one processor for performing the above-mentioned functions. Each processor may perform at least one function among the components constituting the control device 23, that is, the terminal information collector 231, the flow controller 232, the policy manager 233, the policy applicator 234, the DNS processor 235, the packet processor 236, and the AP detector 237. For example, the packet processor 236 and the DNS processor 235 may be executed by different processors. In this way, when the control device 23 includes a plurality of processors and the components that are linked to each other are executed by different processors, the components may communicate with each other by an IPC (Inter-Processor-Communication) method.

[0101] 2 illustrates an example in which the terminal information collection unit 231, the flow control unit 232, the policy management unit 233, the policy application unit 234, the DNS processing unit 235, the packet processing unit 236, and the AP detection unit 237 are integrated into one network protection device 13, but the embodiment of the present invention is not limited thereto. In other embodiments, at least some of these components may be realized in a separate device outside the network protection device 13 or in a cloud form. For example, the policy management unit 233 may be realized in a separate device outside the network protection device 13 or in a cloud form.

[0102] A network protection method of the network protection device 13 according to one embodiment will be described below with reference to Figures 3 to 7. The method described with reference to Figures 3 to 6 can be performed by the network protection device 13 described with reference to Figures 1A, 1B, and 2.

[0103] FIG. 3 illustrates a schematic diagram of a communication flow control method of the network protection device 13 according to one embodiment.

[0104] Referring to FIG. 3, when the operation of the network protection device 13 is started, the control device 23 of the network protection device 13 can collect terminal information of the internal terminal 14 belonging to the target network 1 (S301).

[0105] In step S301, the control device 23 can collect address information (IP address and MAC address) of each internal terminal 14 using an ARP request packet. The control device 23 can generate an ARP request packet while changing an IP address used as destination address information within the IP address range allocated to the target network 1. The control device 23 can broadcast the ARP request packet with the changed destination address information to the internal terminals 14 in sequence and wait for a response packet to be received. The control device 23 can collect address information of the internal terminals 14 connected to the target network 1 by acquiring address information of the corresponding internal terminal 14 from source address information included in the ARP response packet every time an ARP response packet is received.

[0106] In step S301, the control device 23 can also collect status information of each internal terminal 14 using an ARP packet. The control device 23 can generate an ARP request packet including the IP address of the internal terminal 14 to be checked for its online status as destination address information, and broadcast the ARP request packet within the target network 1. After that, the control device 23 can determine that the status information of the corresponding internal terminal 14 is an online status or an offline status depending on whether an ARP response packet is received in response to the transmitted ARP request packet.

[0107] The control device 23 can change the communication path of each internal terminal 14 so that the communication flow of each internal terminal 14 is transmitted through the network protection device 13 by modulating the ARP table of each internal terminal 14 using the terminal information and ARP packets of the internal terminal 14 collected through step S301 (S302).

[0108] In step S302, the control device 23 can modulate the MAC address of another internal terminal 14 in the ARP table stored in each internal terminal 14 in order to change the communication path between the internal terminals 14. In order to modulate the MAC address of the internal terminal 14 in the ARP table, the control device 23 can generate a modulated ARP response packet including the IP address of the internal terminal 14 to be MAC address modulated and the modulated MAC address (MAC address of the network protection device 13) as source address information. When the modulated ARP response packet is generated, the control device 23 can transmit it in a unicast manner to the internal terminal 14 whose ARP table it is intended to modulate, thereby modulating the ARP table of the corresponding internal terminal 14. The internal terminal 14 that receives the modulated ARP response packet can obtain the source IP address and the modulated MAC address from the received ARP response packet, and use this to change the MAC address of the corresponding internal terminal 14 in its own ARP table.

[0109] In step S302, the control device 23 can also modulate the MAC address of the gateway in the ARP table stored in each internal terminal 14 in order to change the communication path between the internal terminal 14 and the external network. The control device 23 can generate a modulated ARP response packet including the IP address of the gateway (the IP address of the switch 12) and the MAC address of the network protection device 13 as origin address information in order to modulate the MAC address of the gateway (or the switch 12 functioning as a gateway) to the MAC address of the network protection device 13 in the ARP table of each internal terminal 14. When the modulated ARP response packet is generated, the control device 23 can transmit the modulated ARP response packet in a unicast manner to the internal terminal 14 whose ARP table it is intended to modulate, thereby modulating the ARP table of the corresponding internal terminal 14. The internal terminal 14 that receives the ARP response packet in which the MAC address of the gateway is modulated from the network protection device 13 can change the MAC address of the gateway in its own ARP table using the modulated MAC address of the gateway acquired from the ARP response packet.

[0110] The control device 23 can also detect an unauthorized internal terminal based on terminal information collected from the internal terminal 14. When an unauthorized internal terminal is detected (S303), the control device 23 can block communication of the unauthorized internal terminal by modulating the ARP table of the unauthorized internal terminal (S304).

[0111] In step S304, the control device 23 can generate an ARP response packet modulated to include the IP address and meaningless MAC address of each internal terminal 14 as origin address information and the IP address and MAC address of the unauthorized internal terminal as destination address information. The control device 23 can transmit the ARP response packet modulated in this way to the unauthorized internal terminal in a unicast manner. The unauthorized internal terminal that receives this packet can change the MAC address of the corresponding internal terminal 14 in its ARP table to a meaningless MAC address with which communication is not possible. Therefore, the unauthorized internal terminal cannot confirm the correct MAC address of the other internal terminals 14 belonging to the target network 1, and communication with the other internal terminals 14 may be blocked.

[0112] In step S304, the control device 23 can generate an ARP response packet modulated to include the IP address and meaningless MAC address of the gateway as origin address information and the IP address and MAC address of the unauthorized internal terminal as destination address information. The control device 23 can transmit the ARP response packet modulated in this way to the unauthorized internal terminal in a unicast manner. The unauthorized internal terminal that receives this packet can change the MAC address of the gateway in its ARP table to a meaningless MAC address with which communication is not possible. Therefore, the unauthorized internal terminal cannot confirm the correct MAC address of the gateway, and communication with the external network that should be connected via the gateway may be blocked.

[0113] After the communication path of the internal terminal 14 is changed through step S302, the control device 23 can receive communication packets generated within the target network 1 or that flow into the target network 1 from an external network (S305).

[0114] If the received communication packet is a communication packet between internal terminals 14 (S306), the control device 23 can control the corresponding communication flow using the whitelist (S307).

[0115] FIG. 4 illustrates diagrammatically how a network protection device 13 according to one embodiment controls communication flows occurring between internal terminals 14.

[0116] Referring to FIG. 4, the control device 23 may analyze a communication flow received from the internal terminal 14 at the origin to obtain flow information (S401).

[0117] In step S401, the flow information may be 5-tuple information including the IP address and port number of the internal terminal 14 at the origin, the IP address and port number of the internal terminal 14 at the destination, and protocol information.

[0118] Based on the flow information acquired through step S401, the control device 23 can determine whether or not the communication flow occurring between the internal terminals 14 is a communication flow registered in the whitelist (S402).

[0119] If the received communication flow is registered in the whitelist, the control device 23 can normally transmit the communication flow to the destination internal terminal 14 (S406). The control device 23 can further additionally store the flow information of the communication flow in the flow cache table (S408).

[0120] When the received communication flow is not registered in the whitelist, the control device 23 can block the communication flow without transmitting the communication flow to the internal terminal 14, which is the destination (S407). The packet processing unit 236 can further additionally store the flow information of the communication flow in the flow cache table (S408).

[0121] The control device 23 may additionally perform a capture process of the security process before proceeding to step S406. The control device 23 may control the capture process to be executed in the internal terminal 14, which is the origin, even if the received communication flow is a communication flow registered in the whitelist (S403). After that, the control device 23 waits for reception of a capture result from the internal terminal 14, which is the origin (S404), and if the capture result is successfully received, it may analyze it to determine whether authentication is successful or not (S405).

[0122] If the capture result corresponds to authentication success, the control device 23 can normally transmit the communication flow to the destination internal terminal 14 (S406). If the capture result corresponds to authentication failure, the control device 23 can block the communication flow without transmitting it to the destination internal terminal 14 even if the communication flow is registered in the whitelist (S407).

[0123] Returning to FIG. 3 again, if the received communication packet is a communication packet transmitted from the internal terminal 14 to the external network (S308), the control device 23 can use the blacklist to control the corresponding communication flow (S309).

[0124] FIG. 5 illustrates diagrammatically how a network protection device 13 according to one embodiment controls communication flows from an internal terminal 14 towards an external network.

[0125] 5, the control device 23 may analyze a communication flow received from the origin internal terminal 14 to obtain flow information (S501). In step S501, the flow information may be 5-tuple information including the IP address and port number of the origin internal terminal 14, the IP address and port number of the destination external terminal, and protocol information.

[0126] If the received communication flow is a communication flow registered in the blacklist, the control device 23 can block the communication flow (S505). The control device 23 can further add and store the flow information of the communication flow in the flow cache table (S506).

[0127] If the received communication flow is a communication flow that is not registered in the blacklist, the control device 23 can use the DNS cache table to determine whether the communication flow is a communication flow that occurred through a DNS query (S503).

[0128] When a DNS request packet is generated from the internal terminal 14, the control device 23 can transmit the DNS request packet to the external network and then wait for a DNS response packet to be received from the external network. When the control device 23 receives the DNS response packet, it can detect DNS information (IP address and domain address) from the received DNS response packet and add the detected DNS information to the DNS cache table. Therefore, in step S503, the control device 23 can check whether the DNS information corresponding to the communication flow is registered in the DNS cache table and determine whether the communication flow is a communication flow that directly connects to an external network using an IP address without a DNS query.

[0129] When the control device 23 determines that the received communication flow is a communication flow that has proceeded without a DNS query, it blocks the communication flow even if it is a communication flow that is not registered in the blacklist (S505), and adds and stores the flow information of the communication flow in the flow cache table (S506).

[0130] When the control device 23 determines that the received communication flow is a communication flow generated by performing a DNS query, the control device 23 can transmit the communication flow to the external network that is the destination (S504). The control device 23 can further add and store the flow information of the communication flow in the flow cache table (S506).

[0131] Returning to FIG. 3 again, if the received communication packet is a communication packet transmitted from an external network to an internal terminal 14 (S310), the control device 23 can control the corresponding communication flow using the DNS cache table (S311).

[0132] FIG. 6 illustrates diagrammatically how a network protection device 13 according to one embodiment controls communication flow from an external network to an internal terminal 14 .

[0133] 6, the control device 23 can analyze a communication flow transmitted from an external network to an internal terminal 14 of a target network 1 to obtain flow information (S601). In step S601, the flow information can be 5-tuple information including the IP address and port number of the origin external terminal, the IP address and port number of the destination internal terminal 14, and protocol information.

[0134] Based on the flow information acquired through step S601, the control device 23 can determine whether or not the communication flow is a communication flow that has occurred at the request of the internal terminal 14 (S602).

[0135] In the case of a communication flow generated by a request from the internal terminal 14, the corresponding flow information may already be registered in the flow cache table. Therefore, in step S602, the control device 23 can refer to the flow cache table to check whether the communication flow generated in the external network is a communication flow generated by a request from the internal terminal 14.

[0136] If the communication flow transmitted from the external network to the internal terminal 14 of the target network 1 is a communication flow generated by a request from the internal terminal 14, the control device 23 can transmit it to the destination internal terminal 14 (S604). The control device 23 can further add and store the flow information acquired from the communication flow in the flow cache table (S606).

[0137] If the communication flow transmitted from the external network to the internal terminal 14 of the target network 1 is not generated by a request from the internal terminal 14, the control device 23 can check whether or not the communication flow is registered in the exception list (S603). If the communication flow transmitted from the external network to the internal terminal 14 of the target network 1 is registered in the exception list, the control device 23 can transmit the packets of the communication flow to the destination internal terminal 14 (S604). On the other hand, if the communication flow transmitted from the external network to the internal terminal 14 of the target network 1 is not registered in the exception list, the control device 23 can block the communication flow (S605) and store the corresponding flow information in the flow cache table (S606).

[0138] FIG. 7 illustrates a schematic diagram of how the network protection device 13 manages a private network according to one embodiment.

[0139] 7, the control device 23 of the network protection device 13 can transmit a command to detect the AP 151 to a terminal 16 in which an agent is installed among the terminals 16 belonging to the private network 15 (S701). The terminal information of the terminal 16 in which the agent is installed can be registered in the network protection device 13 when the agent is installed. Therefore, the control device 23 can transmit a command to the agent of the terminal 16 belonging to the private network 15 by referring to the terminal information registered in advance.

[0140] The agent of the terminal 16 that receives this command can use the traceroute command to detect the number of APs 151 located on the communication path between the corresponding terminal 16 and the network protection device 13 (S702). In addition, the agent of the terminal 16 can transmit the AP detection result including information on the number of detected APs 151 to the network protection device 13 (S703).

[0141] When the control device 23 of the network protection device 13 receives the AP detection result, it can display it on a screen (S704) and notify the administrator of the target network 1. In addition, the control device 23 of the network protection device 13 can transmit a command to an agent installed in the terminal 16 to collect information on the terminal 16 connected to the detected AP 151 (S705).

[0142] The agent of the terminal 16 that receives this command can use the ARP packet to collect terminal information (IP address and MAC address) of the terminal 16 connected to the AP 151 in the private network 15 (S706). After that, the agent of the terminal 16 can transmit the collected terminal information to the network protection device 13 (S707).

[0143] The control device 23 of the network protection device 13 that has received the terminal information can detect an unauthorized terminal from among the terminals 16 in the private network 15 based on the received terminal information (S708). When an unauthorized terminal is detected in the private network 15, the control device 23 of the network protection device 13 can transmit a command to the agent of the terminal 16 to instruct blocking communication with the unauthorized terminal (S709).

[0144] The agent of the terminal 16 that receives the communication cutoff command can use an ARP packet to cut off the communication of unauthorized terminals present in the private network 15 (S710).

[0145] When the administrator wishes to permit communication for an unauthorized terminal whose communication has been blocked, the administrator can request the network protection device 13 to lift the block on communication. When the administrator requests the control device 23 of the network protection device 13 to lift the block on communication for an unauthorized terminal (S711), the control device 23 can transmit a command to lift the block on communication to the agent of the terminal 16 (S712).

[0146] The agent of the terminal 16 can maintain the communication blocked state of the unauthorized terminal by continuously transmitting the blocking ARP packet until the command to unblock the communication is received. When the command to unblock the communication is received, the agent of the terminal 16 can cancel the communication block of the unauthorized terminal whose communication has been blocked by stopping the transmission of the blocking ARP packet (S713).

[0147] As described above, the network protection device 13 can manage connection authority between the internal terminals 14 using a whitelist. Therefore, in the case of an internal terminal 14 that is subject to enormous damage when infected with malicious code, such as a server storing key information, the whitelist can be used to strictly restrict connections of the internal terminal 14 other than essential connections, thereby minimizing damage caused by the infection with malicious code. The network protection device 13 can strengthen security functions against exceptional flows generated by background processes of the internal terminal 14 by using additional security processes such as capture. The network protection device 13 can also detect malware infection of the internal terminal 14 by collecting process information on processes executed in the background from the internal terminal 14 located in the target network 1 and comparing the collected process information with information registered in the whitelist. The network protection device 13 can prevent additional damage caused by malware infection by blocking communication flows generated in the internal terminal 14 determined to be infected with malware.

[0148] When a communication flow toward an external network occurs in the internal terminal 14 of the target network 1, the network protection device 13 can refer to a DNS cache table in which DNS information is stored to determine whether the communication flow is a communication flow that directly connects to the external network using an IP address without a DNS query. If the determination result indicates that the communication flow is a communication flow that proceeds without a DNS query, the network protection device 13 can block the communication flow. When a communication flow toward the internal terminal 14 occurs in the external network, the network protection device 13 can refer to the flow cache table to determine whether the communication flow was generated at the request of the internal terminal 14. If the communication flow generated from the external network toward the internal terminal 14 was not generated at the request of the internal terminal 14, the network protection device 13 can block the communication flow. In this way, the network protection device 13 can detect and block a communication flow that is determined not to have occurred according to a normal procedure between the internal terminal 14 and the external network, thereby preventing the spread of malicious code from the target network 1 to the external network and the inflow of malicious code from the external network to the target network 1.

[0149] The network protection device 13 registers and manages websites, etc. that are determined to be harmful by an administrator on a blacklist, and registers and manages websites, etc. that should be permitted to connect to the target network 1 on an exception list. By managing the communication flow between the target network 1 and external networks by referring to the blacklist or exception list, the network protection device 13 can additionally block malicious or harmful connections to the target network 1 and prevent unnecessary connection blocking.

[0150] The network protection device 13 can automatically detect APs 151 connected to the inside of the target network 1 and communicate the detection results to the administrator so that the administrator can understand security vulnerabilities. In addition, the network protection device 13 can work in conjunction with the terminal 16 belonging to the private network 15 to easily block unauthorized terminals that are not permitted to connect to the private network 15 by the administrator.

[0151] The above-mentioned embodiment can be realized as computer readable codes on a medium having a program recorded thereon. The computer readable medium includes any kind of recording device in which data readable by a computer system is stored. Examples of the computer readable medium include a hard disk drive (HDD), a solid state disk (SSD), a silicon disk drive (SDD), a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also includes those realized in the form of a carrier wave (e.g., transmission via the Internet). The computer may also include a control unit of a terminal. Therefore, the above detailed description should not be construed as limiting in all respects, but should be regarded as illustrative. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all changes within the scope of the present invention that are within the equivalent scope are included in the scope of the present invention.

Claims

1. Communication devices, A storage device for storing a white list that defines connection authority between a plurality of first terminals belonging to the target network; and A network protection device including a control device configured to modulate an ARP table of each of the plurality of first terminals using an ARP (Address Resolution Protocol) packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and to block or transmit the first communication flow to a destination based on the whitelist when the first communication flow is received.

2. The control device includes: An ARP response packet is generated including an IP address of a first terminal whose MAC address is to be modified in the ARP table and a MAC address of the network protection device as source address information; configured to transmit the ARP response packet to each of the plurality of first terminals to modulate the ARP table; 2. The network protection device of claim 1.

3. The control device is configured to collect address information of each of the first terminals using an ARP request packet; The address information includes an IP address and a MAC address.

3. The network protection device of claim 2.

4. The control device includes: Detecting an unauthorized terminal among the plurality of first terminals based on the address information; The method is configured to use an ARP packet to modulate a MAC address included in the ARP table of the unauthorized terminal to a MAC address with which communication is not possible, thereby blocking communication of the unauthorized terminal.

4. The network protection device of claim 3.

5. The control device includes: If the received first communication flow is a communication flow permitted for connection by the whitelist, a CAPTCHA (Completely Automated Public Turning test to tell Computers and Humans Apart) process is executed in a first terminal which is a source of the first communication flow; The first communication flow is configured to be blocked or forwarded to a destination according to a result of CAPTCHA authentication at the first terminal, which is the origin.

2. The network protection device of claim 1.

6. The storage device additionally stores a blacklist that defines connection authority between the first terminals and an external network of the target network; The control device includes: modulating an ARP table of each of the first terminals using an ARP packet so that a second communication flow transmitted from any of the first terminals toward the external network is received by the communication device; and configured, when the second communication flow is received, to block or transmit the second communication flow to the external network based on the blacklist.

2. The network protection device of claim 1.

7. The control device includes: Generate an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as origin address information; configured to transmit the ARP response packet to each of the plurality of first terminals and modulate the MAC address of the gateway in the ARP table; 7. The network protection device of claim 6.

8. The control device includes: When a DNS (Domain Name System) response packet is received from the external network, the DNS information of the received DNS response packet is stored in a DNS table; and when it is determined by referring to the DNS table that the second communication flow is a communication flow that occurred without a DNS query, blocking the second communication flow without transmitting it to a destination; 7. The network protection device of claim 6, wherein the DNS information includes an IP address and a domain address included in the DNS response packet.

9. The control device includes: Store flow information of communication flows whose origin or destination is the plurality of first terminals in a flow table; When a third communication flow directed to any one of the first terminals is received from an external network of the target network, the flow table is referred to to determine whether or not the third communication flow is a communication flow generated at the request of any one of the first terminals; when it is determined that the third communication flow is a communication flow generated at the request of any one of the plurality of first terminals, the third communication flow is transmitted to a first terminal that is a destination of the third communication flow; The network protection device of claim 1 , wherein the flow information includes origin and destination address information and protocol information of the corresponding communication flow.

10. The control device includes: instructing a second terminal having an agent installed therein to detect an access point (AP) located on a communication path between the network protection device and the second terminal; When the AP is detected on the communication path by the second terminal, instructing the second terminal to collect terminal information of at least one third terminal connected to the AP; receiving address information of the at least one third terminal collected by the second terminal using an ARP packet from the second terminal; Detecting an unauthorized terminal among the at least one third terminal based on address information of the at least one third terminal; configured to instruct the second terminal to block communication of the unauthorized terminal using an ARP packet when the unauthorized terminal is detected; 10. The network protection device of claim 9.

11. A network protection method for a network protection device, comprising: modulating the ARP table of each of a plurality of first terminals belonging to a target network using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the network protection device; and When the first communication flow is received, the method includes blocking or transmitting the first communication flow to a destination based on a whitelist that defines connection authority between the plurality of first terminals.

12. The modulating step includes: generating an ARP response packet including an IP address of a first terminal whose MAC address is to be modified in the ARP table and a MAC address of the network protection device as origin address information; The method of claim 11, further comprising the step of transmitting the ARP response packet to each of the first terminals to modulate the ARP table.

13. The method further includes collecting address information of each of the first terminals using an ARP request packet; The network protection method according to claim 12, wherein the address information includes an IP address and a MAC address of the corresponding first terminal.

14. detecting an unauthorized terminal among the plurality of first terminals based on the address information; and The network protection method according to claim 13, further comprising the step of using an ARP packet to modulate a MAC address included in the ARP table of the unauthorized terminal to a MAC address with which communication is not possible, thereby blocking communication of the unauthorized terminal.

15. running a CAPTCHA process at a first terminal from which the first communication flow originates; and The method further includes receiving a CAPTCHA authentication result from the first terminal, which is the origin; The method of claim 11 , wherein blocking or transmitting the first communication flow to a destination comprises blocking or transmitting the first communication flow to a destination based on the CAPTCHA authentication result and the whitelist.

16. modulating the ARP table using an ARP packet so that a second communication flow transmitted from any of the plurality of first terminals toward an external network of the target network is received by the network protection device; and 12. The network protection method of claim 11, further comprising the step of, when the second communication flow is received, blocking or transmitting the second communication flow to the external network by referring to a blacklist that defines connection authority between the plurality of first terminals and the external network.

17. The step of modulating the ARP table so that the second communication flow is received by the network protection device comprises: generating an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as origin address information; 17. The method of claim 16, further comprising the step of transmitting the ARP response packet to each of the first terminals to modulate the MAC address of the gateway in the ARP table.

18. The method further includes the step of storing DNS information of the received DNS response packet in a DNS table each time the DNS response packet is received from the external network; The step of blocking or transmitting the second communication flow to the external network includes: referring to the DNS table to determine whether the second communication flow is a communication flow that occurred without a DNS query; and If the second communication flow is a communication flow generated without a DNS query, blocking the second communication flow without transmitting it to a destination; 17. The method of claim 16, wherein the DNS information includes an IP address and a domain address included in the DNS response packet.

19. storing flow information of the generated communication flow in a flow table every time a communication flow occurs in which the plurality of first terminals are a departure point or a destination point; receiving a third communication flow from an external network of the target network, the third communication flow being directed to any of the first terminals; and and when it is determined that the third communication flow is a communication flow generated at the request of any one of the first terminals by referring to the flow table, transmitting the third communication flow to a first terminal that is a destination of the third communication flow; The method of claim 11 , wherein the flow information includes origin and destination address information and protocol information of the corresponding communication flow.

Images