Method for managing network using microsegmentation for zero trust security and access switch using the same

Abstract

To provide a network management method using microsegmentation for zero trust security.SOLUTION: A method includes (a) obtaining a source MAC address of a packet by a specific access switch when a first forwarding is performed on the packet, registering the source MAC address when the source MAC address is not registered in a MAC address table, and performing a second forwarding when the source MAC address satisfies a specific user security policy, (b) obtaining a source IP address of the packet by the specific access switch, registering the source IP address when the source IP address is not registered in a routing table, and performing a third forwarding, obtaining a destination IP address or service port of the packet, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or service port of the packet satisfies a specific service security policy.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a network management method for zero trust security, and more particularly to a method for managing a network by having an access switch of a network perform packet switching using micro-segmentation for zero trust security (METHOD FOR MANAGING NETWORK USING MICRO-SEGMENTATION FOR ZERO TRUST SECURITY AND ACCESS SWITCH USING THE SAME). [Background technology]

[0002] The perimeter security model is a powerful network security model for controlling access from external networks to internal networks, but the biggest problem with the perimeter security model is the boundary itself: security control is concentrated at the boundary, and once beyond the boundary, security control cannot be applied any further.

[0003] In the perimeter security model, allowing access means trusting the entity that is accessing, and since you trust the person approaching, you allow access to internal resources. For example, a computer located on an internal business network uses an internal IP address, so internal security equipment basically operates on the principle of trust.

[0004] Attackers exploit this trust relationship to launch attacks, occupying internal terminals that have already been trusted and using them for attacks. The perimeter security module applies security controls only at the boundary, which is the contact point between the external network and the internal network, so it cannot detect or block threats that cross the boundary and are located inside.

[0005] In other words, attackers can use malicious code to infect computers located in the internal network and then use the infected computers as bases to attack information assets, so the internal network of a company, which was previously the source of trust, can no longer be trusted. Therefore, it is necessary to assume that attackers have already infiltrated the internal network of a company, and procedures are now required to detect and respond to attacks even in such a worst-case scenario.

[0006] The Zero Trust Security model has been proposed as a solution to address the issues of the perimeter security model.

[0007] Zero trust security essentially keeps data and resources inaccessible, but allows users to access them in a limited way only under appropriate circumstances, known as least privilege access.

[0008] The zero trust security model assumes that any user, device, or application on the network is a potential threat and must go through an authentication stage before access is granted. In other words, access is granted not based on the user's location or network, but based on their identity, the device they are using, and the content of the request.

[0009] Therefore, the zero trust security model has the advantages of being highly secure as it enforces device authentication for all access requests, allowing users to access safely anywhere and improving work flexibility, and it allows for flexible application of security as it continuously monitors the behavior of users and devices.

[0010] However, implementing a zero trust security model in a system requires a significant amount of time and investment, and since device authentication is required for every access request, implementation becomes complicated and management costs become high.In addition, since authentication is forced on users, the user experience is degraded.

[0011] Therefore, the present applicant proposes a method for more efficiently implementing a network security model for zero trust security. Summary of the Invention [Problem to be solved by the invention]

[0012] An object of the present invention is to solve all of the problems of the prior art described above.

[0013] Another object of the present invention is to enable a network security model for zero trust security to be implemented at low cost and in a short period of time.

[0014] Another object of the present invention is to more easily implement a network security model for zero trust security.

[0015] Another object of the present invention is to enable low-cost management of a network security model for zero trust security.

[0016] Another object of the present invention is to prevent a degradation of user experience due to application of a network security model for zero trust security. [Means for solving the problem]

[0017] According to an embodiment of the present invention, a method for managing a network using micro-segmentation for zero trust security includes: (a) when a first forwarding is performed on a packet transmitted to a specific port of a specific access switch, the specific access switch being one of access switches that allows network devices to communicate with each other in a network, acquiring a source MAC address corresponding to a specific network device that transmitted the packet from an Ethernet head of the packet, and checking whether the source MAC address is registered in a MAC address table; if the source MAC address is not registered in the MAC address table, registering the source MAC address in the MAC table by referring to a specific user security policy set in a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segmentations in which each port of the access switch is grouped and divided according to a network security policy for zero trust security; and, in a state in which the source MAC address is registered in the MAC table, checking whether the source MAC address satisfies the specific user security policy; and, if the source MAC address satisfies the specific user security policy, performing a second forwarding on the packet;and (b) the specific access switch obtains a source IP address from an IP header of the packet, checks whether the source IP address is registered in a routing table, and if the source IP address is not registered in the routing table, causes the source IP address to be registered in the routing table, and performs a third forwarding on the packet with the source IP address registered in the routing table, obtains a destination IP address or a service port from the IP header of the packet, and filters the packet on which the third forwarding is performed by checking whether the destination IP address or the service port meets a specific service security policy set in the specific micro-segmentation.;

[0018] In one example, the micro-segmentation is configured by a network controller that manages the access switches, and the micro-segmentation is configured by the network controller by dividing it into pairs of access switches and ports according to the network security policy, and with each user security policy set for each of the micro-segmentations, an Address Resolution Protocol (ARP) packet obtained by filtering each packet for which the first forwarding is performed in each of the access switches is analyzed to detect each of the network devices coupled to each of the ports of each of the access switches, and the network devices are registered in each of the micro-segmentations corresponding to each of the ports to which each of the network devices is coupled according to each user security policy.

[0019] In one example, in the step (a), the specific user security policy includes a first blacklist mode that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered in a blacklist. In the first blacklist mode, the specific access switch, in a state in which the MAC address learning is enabled, (i) checks whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is registered in the MAC address table, checks whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, drops the first blacklist mode for the packet. (ii) checking whether the source MAC address is registered in the MAC address table and if it is determined that the source MAC address is not registered in the MAC address table, registering the source MAC address in the MAC address table through the MAC address learning, checking whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, blocking the second forwarding for the packet, and if the source MAC address is not registered in the blacklist, performing the second forwarding for the packet.

[0020] In one example, in step (a), the specific user security policy includes a first whitelist mode in which MAC address learning for all MAC addresses is disabled, and only MAC addresses registered in a whitelist are registered in the MAC address table and forwarded, and the remaining MAC addresses are dropped. In the first whitelist mode, when the MAC address learning is disabled, the specific access switch (i) checks whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is registered in the MAC address table, performs the second forwarding for the packet, and (ii) checks whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is not registered in the MAC address table, checks whether the source MAC address is registered in the whitelist, and if the source MAC address is registered in the whitelist, registers the source MAC address in the MAC address table and performs the second forwarding for the packet, and if the source MAC address is not registered in the whitelist, blocks the second forwarding for the packet.

[0021] In one example, in the step (b), the specific service security policy includes one of a second blacklist mode for forwarding the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, and a second whitelist mode for dropping the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, and (i) if the specific service security policy is the second blacklist mode, the specific access switch checks whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in a blacklist, and confirms that the destination IP address or the service port is registered in the blacklist. (ii) when the specific service security policy is the second whitelist mode, the specific access switch checks whether the destination IP address or the service port of the packet on which the third forwarding is performed is registered in a whitelist, and when it is confirmed that the destination IP address or the service port is registered in the whitelist, it allows the third forwarding of the packet, and when it is confirmed that the destination IP address or the service port is registered in the whitelist, it blocks the third forwarding of the packet.

[0022] In one example, when the specific access switch blocks the third forwarding for the packet, it may transmit information regarding the packet for which the third forwarding is blocked to a network controller, and enable the network controller to refer to the information regarding the packet for which the third forwarding is blocked and update at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation, or reconfigure the specific micro-segmentation corresponding to the specific port of the specific access switch.

[0023] In one example, in step (b), if the packet on which the second forwarding is performed is an ARP packet, the specific access switch may not perform the third forwarding on the packet and may flood the packet to the remaining ports of the specific access switch except for the specific port.

[0024] In one example, (c) the specific access switch transmits the packet on which the third forwarding is performed to a security module, and has the security module analyze the packet to determine whether the packet is an abnormal packet, and if the packet is determined to be an abnormal packet, blocks the third forwarding for the packet.

[0025] According to another embodiment of the present invention, an access switch for managing a network using microsegmentation for zero trust security includes: a memory storing instructions for managing a network using microsegmentation for zero trust security; and a processor performing an operation of managing the network using microsegmentation for zero trust security according to the instructions stored in the memory;(I) when a first forwarding is performed on a packet transmitted to a specific port among ports of an access switch, the processor acquires a source MAC address corresponding to a specific network device that transmitted the packet from an Ethernet head of the packet, and checks whether the source MAC address is registered in a MAC address table. If the source MAC address is not registered in the MAC address table, the processor registers the source MAC address in the MAC table by referring to a specific user security policy set in a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segmentations in which each port of the access switch is grouped and classified according to a network security policy for zero trust security, and when the source MAC address is registered in the MAC table, the processor registers the source MAC address in the MAC table by referring to a specific user security policy set in a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segmentations in which each port of the access switch is grouped and classified according to a network security policy for zero trust security, and and if the source MAC address satisfies the specific user security policy, performing a second forwarding on the packet; and (II) obtaining a source IP address from an IP header of the packet, checking whether the source IP address is registered in a routing table, and if the source IP address is not registered in the routing table, allowing the source IP address to be registered in the routing table, and performing a third forwarding on the packet with the source IP address registered in the routing table, obtaining a destination IP address or a service port from the IP header of the packet, and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation, thereby filtering the packet for which the third forwarding is performed.

[0026] In one example, the micro-segmentation is configured by a network controller that manages access switches that enable network devices to communicate with each other within the network, and the micro-segmentation is configured by the network controller by dividing it into pairs of access switches and ports according to the network security policy, and with each user security policy set for each of the micro-segmentations, the network controller analyzes ARP (Address Resolution Protocol) packets obtained by filtering each packet for which the first forwarding is performed in each of the access switches to detect each of the network devices coupled to each of the ports of each of the access switches, and registers the network devices in each of the micro-segmentations corresponding to each of the ports to which each of the network devices is coupled according to each user security policy.

[0027] In one example, the processor, in the process (I), the specific user security policy includes a first blacklist mode that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered in a blacklist, and in the first blacklist mode, while the MAC address learning is enabled, (i) checks whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is registered in the MAC address table, checks whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, performs the second blacklist mode for the packet. (ii) as a result of checking whether the source MAC address is registered in the MAC address table, if it is determined that the source MAC address is not registered in the MAC address table, the source MAC address is registered in the MAC address table through the MAC address learning, and it is checked whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, the second forwarding for the packet is blocked, and if the source MAC address is not registered in the blacklist, the second forwarding for the packet is performed.

[0028] In one example, in the process (I), the specific user security policy includes a first whitelist mode in which MAC address learning for all MAC addresses is disabled, and only MAC addresses registered in a whitelist are registered in the MAC address table and forwarded, and the remaining MAC addresses are dropped, and in the first whitelist mode, when the MAC address learning is disabled, (i) a check is made to see whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is registered in the MAC address table, the second forwarding is performed for the packet, and (ii) a check is made to see whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is not registered in the MAC address table, the processor checks whether the source MAC address is registered in the whitelist, and if the source MAC address is registered in the whitelist, registers the source MAC address in the MAC address table and performs the second forwarding for the packet, and if the source MAC address is not registered in the whitelist, blocks the second forwarding for the packet.

[0029] In one example, the processor, in the process (II), the specific service security policy includes one of a second blacklist mode for forwarding the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, and a second whitelist mode for dropping the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, and (i) if the specific service security policy is the second blacklist mode, checks whether the destination IP address or the service port of the packet on which the third forwarding is performed is registered in a blacklist, and if the destination IP address or the service port is registered in the blacklist, and (ii) if the specific service security policy is the second whitelist mode, check whether the destination IP address or the service port of the packet on which the third forwarding is performed is registered in a whitelist, and if it is determined that the destination IP address or the service port is registered in the whitelist, allow the third forwarding of the packet, and if it is determined that the destination IP address or the service port is not registered in the whitelist, block the third forwarding of the packet.

[0030] In one example, when the processor blocks the third forwarding for the packet, it transmits information regarding the packet for which the third forwarding is blocked to a network controller, and enables the network controller to refer to the information regarding the packet for which the third forwarding is blocked and update at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation, or to reconfigure the specific micro-segmentation corresponding to the specific port of the specific access switch.

[0031] In one example, in the (II) process, if the packet on which the first forwarding is performed is an ARP packet, the processor does not perform the third forwarding on the packet, and floods the packet to the remaining ports of the specific access switch except for the specific port.

[0032] In one example, the processor (III) further performs a process of transmitting the packet on which the third forwarding is performed to a security module, analyzing the packet using the security module to determine whether the packet is an abnormal packet, and blocking the third forwarding for the packet if the packet is determined to be an abnormal packet. Effect of the Invention

[0033] According to the present invention, a network security model for zero trust security can be implemented at low cost and in a short time.

[0034] According to the present invention, a network security model for zero trust security can be more easily implemented.

[0035] The present invention makes it possible to manage a network security model for zero trust security at low cost.

[0036] According to the present invention, it becomes possible to prevent a deterioration in user experience due to application of a network security model for zero trust security.

[0037] The following drawings, which are attached to be used for explaining the embodiments of the present invention, are merely a part of the embodiments of the present invention, and a person having ordinary knowledge in the technical field to which the present invention pertains (hereinafter, "ordinary engineers") can derive each of the other drawings based on these drawings without performing any inventive work. [Brief description of the drawings]

[0038] [Figure 1] 1 is a simplified diagram of an access switch that manages a network using microsegmentation for zero trust security according to an embodiment of the present invention; [Diagram 2] 1 is a simplified diagram illustrating a method for managing a network using microsegmentation for zero trust security according to one embodiment of the present invention. [Diagram 3] 1 is a simplified diagram of a network managed using microsegmentation for zero trust security in accordance with one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0039] The following detailed description of the present invention will be made with reference to the accompanying drawings, which show, by way of example, specific embodiments in which the present invention may be practiced. These embodiments will be described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different from one another, but are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be embodied in different embodiments without departing from the spirit and scope of the present invention. It should also be understood that the location or arrangement of individual components within each embodiment may be changed without departing from the spirit and scope of the present invention. Therefore, the following detailed description is not intended to be taken in a limiting sense, and the scope of the present invention should be accepted as encompassing the scope of the appended claims and all equivalents thereto. In the drawings, like reference numerals refer to the same or similar components throughout the various aspects.

[0040] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a number of preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily practice the present invention.

[0041] FIG. 1 illustrates a simplified access switch for managing a network using microsegmentation for zero trust security according to one embodiment of the present invention. The access switch 1000 may include a memory 1100 storing instructions for managing a network using microsegmentation for zero trust security, and a processor 1200 that performs operations for managing a network using microsegmentation for zero trust security according to the instructions stored in the memory 1100.

[0042] In particular, the access switch 1000 may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include computer processors, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0043] The processor of the computing device may include hardware components such as a micro processing unit (MPU) or central processing unit (CPU), a cache memory, a data bus, etc. The computing device may further include software components such as an operating system and an application for performing a specific purpose.

[0044] However, this does not exclude the case where the computing device includes an integrated processor in which a medium, a processor and a memory for implementing the present invention are integrated.

[0045] Meanwhile, when a first forwarding is performed on a packet transmitted to a specific port among ports of the access switch according to the instruction stored in the memory 1100, the processor 1200 of the access switch 1000 obtains a source MAC address corresponding to a specific network device that transmitted the packet from the Ethernet head of the packet, and checks whether the source MAC address is registered in the MAC address table. If the source MAC address is not registered in the MAC address table, the processor 1200 causes the source MAC address to be registered in the MAC table by referring to a specific user security policy set in a specific micro-segment corresponding to a specific port of a specific access switch among micro-segmentations in which each port of the access switch is grouped and classified according to a network security policy for zero trust security. When the source MAC address is registered in the MAC table, In this state, it is possible to perform a process of checking whether the source MAC address satisfies a specific user security policy, and if the source MAC address satisfies the specific user security policy, performing a second forwarding on the packet; obtaining a source IP address from an IP head of the packet, checking whether the source IP address is registered in a routing table, and if the source IP address is not registered in the routing table, making the source IP address be registered in the routing table, and performing a third forwarding on the packet with the source IP address registered in the routing table; obtaining a destination IP address or a service port from an IP head of the packet, and checking whether the destination IP address or the service port satisfies a specific service security policy set in a specific micro-segmentation, thereby filtering the packet for which the third forwarding is performed.

[0046] A method for managing a network using micro-segmentation for zero trust security by using an access switch according to an embodiment of the present invention configured as described above will now be described with reference to FIG. 2.

[0047] First, a network controller that manages an access switch that allows network devices to communicate with each other in a network can set micro-segmentation by grouping and classifying each port of the access switch according to a network security policy for zero trust security. That is, the network controller can set micro-segmentation by classifying pairs of access switches and ports according to a network security policy for zero trust security, and can set each user security policy for zero trust security for each set micro-segmentation, and the set micro-segmentation and user security policy can be shown in Table 1 below.

[0048] [Table 1]

[0049] According to Table 1, ports GE1 through GE10 of switch S1 can be set to microsegmentation A, ports GE1 and GE2 of switch S2 can be set to microsegmentation B, port GE3 of switch S2 and port GE1 of switch S3 can be set to microsegmentation C, and ports GE1 through GE10 of the router can be set to microsegmentation D. And unspecified switch and port pairs can be set to default.

[0050] The network controller can then set respective user security policies for each of the micro-segments.

[0051] For example, according to Table 1, the first blacklist mode may be set for microsegmentation A, the first whitelist mode may be set for microsegmentation B, the first whitelist mode may be set for microsegmentation C, and the first whitelist mode may be set for microsegmentation D. The first blacklist mode may be set as a default. In this case, the first blacklist mode may be a user security policy that enables MAC address learning for all MAC addresses, forwards the learned MAC addresses, and drops only the MAC addresses registered in the blacklist, and the first whitelist mode may be a user security policy that disables MAC address learning for all MAC addresses, registers only the MAC addresses registered in the whitelist in the MAC address table and forwards them, and drops the remaining MAC addresses.

[0052] In addition, the network controller can set each service security policy for each micro-segmentation. As an example, the state in which a service security policy is set for each micro-segmentation can be shown as in Table 2 below.

[0053] [Table 2]

[0054] According to Table 2, the second blacklist mode may be set as a service security policy for micro-segmentation A and micro-segmentation B, and a service security group II in which TELENT, FTP, and SV1-SV5 are registered in a service IP or port may be set, the second whitelist mode may be set as a service security policy for micro-segmentation C, and a service security group I in which SV1, SV2&SSH, SV3&:8080, SSH, and HTTPS are registered in a service IP or port may be set, and the second whitelist mode may be set as a service security policy for micro-segmentation D, and a service security group III in which SSH and SFTP are registered in a service IP or port may be set. In this case, the second blacklist mode may be a service security policy that forwards the remaining destination IP addresses or remaining service ports excluding the set destination IP address or the set service port, and the second whitelist mode may be a service security policy that drops the remaining destination IP addresses or remaining service ports excluding the set destination IP address or the set service port.

[0055] The network controller can transmit the user security policy and service security policy set for each microsegmentation to each access switch, thereby allowing each access switch to process packets according to the user security policy and service security policy set for each microsegmentation.

[0056] In this state, each of the access switches that allow network devices to communicate with each other in the network filters ARP (Address Resolution Protocol) packets sent to its own port through an ARP filter and transmits the ARP packets to its own security module, and each security module in each of the access switches analyzes the ARP packets to detect network devices connected to each port and transmits information on the detected network devices to a network controller that manages the access switches. Then, the network controller can refer to the micro-segmentation that is set by dividing the access switch and port pair according to the network security policy, and register the network devices in each of the micro-segmentations that correspond to each of the ports to which each of the network devices is connected according to the user security policy (S100).

[0057] The process by which the network controller configures microsegmentation will be described in more detail with reference to Figure 3 as follows.

[0058] Network devices physically connected to the ports of the wireless hub, router, switch S1, switch S2, and switch S3, which are access switches located in the network, can be detected as shown in Table 3 below.

[0059] [Table 3]

[0060] At this time, the information on the detected network devices may include a corresponding port of a corresponding access switch to which each of the network devices is connected, and a MAC address and an IP address for each of the network devices.

[0061] In this way, the network controller can group the access switch and port pairs according to the network security policy and register each network corresponding to the micro-segmentation set according to each user security policy, which can be shown, for example, as shown in Table 4 below.

[0062] [Table 4]

[0063] That is, the network controller can register the network devices that are associated with each blacklist or whitelist for each micro-segmentation.

[0064] For example, according to Table 4, network device M04 may be registered in microsegmentation B, network devices M06 and M07 may be registered in microsegmentation C, and network devices SV1 to SV5 may be registered in microsegmentation D. These network device lists may be blacklisted or whitelisted depending on the user security policy. That is, when the user security policy is in the first blacklist mode, the network device list may be blacklisted, and when the user security policy is in the first whitelist mode, the network device list may be whitelisted. For example, for ports GE1 to GE10 of the router, in microsegmentation D set to the first whitelist mode, server SV6 connected to port GE6 of the router is a network device with which communication is not permitted, and therefore it is removed from the network device list. Also, for ports GE1 and GE2 of the switch S2, in microsegmentation B set to the first whitelist mode, network device M05 connected to port GE2 of the switch S2 is a network device with which communication is not permitted, and therefore it is removed from the network device list.

[0065] 2, in this state, a specific access switch 1000, which is one of the access switches that allows network devices to communicate with each other in the network, can check the source MAC address of a packet sent to a specific port and perform MAC learning according to a specific user security policy set in a specific micro-segmentation corresponding to the specific port (S200). This can be to perform access control for connected equipment that is trying to access the network according to a network security model for zero trust security through an access switch directly connected to a host that is a network device.

[0066] That is, when the first forwarding is performed on a packet transmitted to a specific port among the ports of the specific access switch 1000, the specific access switch 1000 can obtain a source MAC address corresponding to a specific network device that transmitted the packet at the Ethernet head of the packet. The specific access switch 1000 checks whether the source MAC address is registered in the MAC address table, and if the source MAC address is not registered in the MAC address table, the specific access switch 1000 causes the source MAC address to be registered in the MAC address table by referring to a specific user security policy set in a specific micro-segment corresponding to a specific port of the specific access switch among micro-segments in which each port of the access switch is grouped and divided according to a network security policy for zero trust security, and checks whether the source MAC address satisfies the specific user security policy while the source MAC address is registered in the MAC address table, and if the source MAC address satisfies the specific user security policy, the specific access switch 1000 can perform the L2 process according to the specific user security policy set for the specific port.

[0067] For example, when a specific user security policy for a specific port of a specific access switch is the first blacklist mode, the specific access switch 1000 can check whether a source MAC address is registered in the MAC address table with MAC address learning enabled, and if it is confirmed that the source MAC address is registered in the MAC address table, it can check whether the source MAC address is registered in the blacklist. If the source MAC address is registered in the blacklist, the specific access switch 1000 can block the second forwarding of the packet, and if the source MAC address is not registered in the blacklist, it can perform the second forwarding of the packet.

[0068] In addition, the specific access switch 1000 checks whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is not registered in the MAC address table, it registers the source MAC address in the MAC address table through MAC address learning and can check whether the source MAC address is registered in the blacklist. If the source MAC address is registered in the blacklist, the specific access switch 1000 can block secondary forwarding of the packet, and if the source MAC address is not registered in the blacklist, it can perform secondary forwarding of the packet.

[0069] As another example, when a specific user security policy for a specific port of a specific access switch is the first whitelist mode, a specific access switch 1000 can check whether a source MAC address is registered in the MAC address table with MAC address learning disabled, and if it is confirmed that the source MAC address is registered in the MAC address table, perform a second forwarding of the packet.

[0070] Furthermore, the specific access switch 1000 can check whether the source MAC address is registered in the MAC address table, and if it is determined that the source MAC address is not registered in the MAC address table, it can check whether the source MAC address is registered in the whitelist. If the source MAC address is registered in the whitelist, the specific access switch 1000 can register the source MAC address in the MAC address table and perform the second forwarding of the packet, and if the source MAC address is not registered in the whitelist, it can block the second forwarding of the packet.

[0071] Next, the specific access switch 1000 checks the IP address of the packet, and if the source IP address is not registered in the routing table, it can register the source IP address in the routing table (S300).

[0072] That is, a specific access switch 1000 obtains a source IP address from the IP header of a packet on which the second forwarding has been performed, checks whether the source IP address is registered in the routing table, and if the source IP address is not registered in the routing table, causes the source IP address to be registered in the routing table, and performs a third forwarding on the packet with the source IP address registered in the routing table.

[0073] On the other hand, if a specific access switch 1000 analyzes the IP header of the packet on which the second forwarding has been performed and determines that the packet on which the second forwarding has been performed is an ARP packet, it does not perform the third forwarding on the packet and can flood the packet to the remaining ports except for a specific port of the specific access switch.

[0074] Next, the specific access switch 1000 can filter packets according to a specific service security policy set for a specific micro-segment (S400). This can perform service access control for a host that is allowed to control access to connected equipment according to a network security model for zero trust security through an access switch directly connected to a host that is a network device.

[0075] That is, a particular access switch 1000 can obtain a destination IP address or service port in the IP header of a packet for which third forwarding is performed, and filter the packet for which third forwarding is performed by checking whether the destination IP address or service port satisfies a particular service security policy set in a particular microsegmentation.

[0076] For example, when a specific service security policy is the second blacklist mode, the specific access switch 1000 may check whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in the blacklist. If the specific access switch 1000 determines that the destination IP address or the service port is registered in the blacklist, it may block the third forwarding of the packet, and if the specific access switch 1000 determines that the destination IP address or the service port is not registered in the blacklist, it may allow the third forwarding of the packet.

[0077] As another example, when a specific service security policy is the second whitelist mode, the specific access switch 1000 may check whether the destination IP address or service port of the packet for which the third forwarding is performed is registered in the whitelist. If the specific access switch 1000 determines that the destination IP address or service port is registered in the whitelist, it may allow the third forwarding of the packet, and if the destination IP address or service port is determined to be not registered in the whitelist, it may block the third forwarding of the packet.

[0078] In addition, when a specific access switch 1000 blocks third forwarding for a packet, it transmits information related to the packet for which third forwarding has been blocked to a network controller, and enables the network controller to update at least one of a specific user security policy and a specific service security policy corresponding to a specific micro-segmentation by referring to the information related to the packet for which third forwarding has been blocked, or to reconfigure a specific micro-segmentation corresponding to a specific port of a specific access switch.

[0079] In addition, a specific access switch 1000 can transmit a packet for which third forwarding is to be performed to a security module, and have the security module analyze the packet to determine whether the packet is an abnormal packet, and if the packet is determined to be an abnormal packet, can block the third forwarding for the packet.

[0080] As described above, according to the present invention, all network devices connected to a network are automatically detected, and the detected information is established in a security policy and can be used for access control for zero trust security. In addition, since all network devices connected to an access switch are controlled and managed for communication at the location where communication begins, i.e., at the access layer, and the minimum access authority for resource access can be provided at the access layer, a zero trust security model can be established quickly and at low cost. According to the present invention, the movement, traffic state, and abnormal behavior of all network devices connected to a network can be monitored in real time, a resource access control function can be provided in real time, and the security state of all assets can be confirmed. According to the present invention, whether communication is permitted or not can be determined through administrator authentication for all connected network devices, i.e., a blacklist or whitelist can be determined, and network devices permitted to communicate can be classified by micro-segmentation to provide the minimum access authority. In addition, according to the present invention, the connection state, traffic, movement, and communication state of all connected network devices can be digitized to continuously update the network security policy.

[0081] The above-described embodiments of the present invention may be embodied in the form of program instructions that can be executed by various computer components and stored in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions stored in the computer-readable recording medium may be specially designed and constructed for the present invention, or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROMs, RAMs, flash memories, and the like. Examples of program instructions include not only machine language codes, such as those produced by a compiler, but also high-level language codes executed by a computer using an interpreter, and the like. The hardware devices may be configured to operate as one or more software modules to perform the processes of the present invention, and vice versa.

[0082] Although the present invention has been described above using specific details such as specific components and limited examples and drawings, this is provided merely to aid in a more general understanding of the present invention, and the present invention is not limited to the above examples. Various modifications and variations will be apparent from such descriptions if one has ordinary knowledge in the technical field to which the present invention pertains.

[0083] Therefore, the concept of the present invention should not be limited to the above-described embodiments, and all modifications equivalent to or equivalent to the scope of the claims, as well as the scope of the claims described below, are within the concept of the present invention. [Explanation of symbols]

[0084] 1000: Access switch 1100:Memory 1200: Processor

Claims

1. How to manage your network using microsegmentation for zero trust security (a) when a specific access switch, which is one of access switches that allows network devices to communicate with each other in a network, performs a first forwarding on a packet transmitted to a specific port of the specific access switch, acquiring a source MAC address corresponding to a specific network device that transmitted the packet from an Ethernet head of the packet, and checking whether the source MAC address is registered in a MAC address table. If the source MAC address is not registered in the MAC address table, the source MAC address is registered in the MAC table by referring to a specific user security policy set in a specific micro-segment corresponding to the specific port of the specific access switch among micro-segments in which each port of the access switch is grouped and divided according to a network security policy for zero trust security, and checking whether the source MAC address satisfies the specific user security policy while the source MAC address is registered in the MAC table, and performing a second forwarding on the packet if the source MAC address satisfies the specific user security policy; and (b) the specific access switch obtaining a source IP address from an IP head of the packet, checking whether the source IP address is registered in a routing table, and if the source IP address is not registered in the routing table, causing the source IP address to be registered in the routing table, performing a third forwarding on the packet with the source IP address registered in the routing table, obtaining a destination IP address or a service port from the IP head of the packet, and filtering the packet on which the third forwarding is performed by checking whether the destination IP address or the service port satisfies a specific service security policy set in the specific micro-segmentation; The method includes:

2. The micro-segmentation is configured by a network controller that manages the access switch; 2. The method of claim 1, wherein the network controller configures the micro-segmentation by dividing the micro-segmentation into pairs of access switches and ports according to the network security policy, and configures a respective user security policy for each of the micro-segmentation, and analyzes an Address Resolution Protocol (ARP) packet obtained by filtering each packet for which the first forwarding is performed in each of the access switches to detect each of the network devices coupled to each of the ports of each of the access switches, and registers the network devices in each of the micro-segmentation corresponding to each of the ports to which each of the network devices is coupled according to the respective user security policy.

3. In the step (a), The specific user security policy includes a first blacklist mode that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only blacklisted MAC addresses; In the first blacklist mode, the specific access switch, in a state in which the MAC address learning is enabled, (i) checks whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is registered in the MAC address table, checks whether the source MAC address is registered in a blacklist, and if the source MAC address is registered in the blacklist, blocks the second forwarding of the packet, and if the source MAC address is not registered in the blacklist, performs the second forwarding of the packet; and (ii) 2. The method of claim 1, further comprising: checking whether the source MAC address is registered in the MAC address table; if it is determined that the source MAC address is not registered in the MAC address table, registering the source MAC address in the MAC address table through the MAC address learning; checking whether the source MAC address is registered in a blacklist; if the source MAC address is registered in the blacklist, blocking the second forwarding for the packet; and if the source MAC address is not registered in the blacklist, performing the second forwarding for the packet.

4. In the step (a), The specific user security policy includes a first whitelist mode in which MAC address learning for all MAC addresses is disabled, only MAC addresses registered in a whitelist are registered in the MAC address table and forwarded, and the remaining MAC addresses are dropped; 2. The method of claim 1, wherein in the first whitelist mode, when the MAC address learning is disabled, the specific access switch (i) checks whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is registered in the MAC address table, performs the second forwarding on the packet, and (ii) checks whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is not registered in the MAC address table, checks whether the source MAC address is registered in a whitelist, and if the source MAC address is registered in the whitelist, registers the source MAC address in the MAC address table and performs the second forwarding on the packet, and if the source MAC address is not registered in the whitelist, blocks the second forwarding on the packet.

5. In the step (b), The specific service security policy includes one of a second blacklist mode for forwarding the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, and a second whitelist mode for dropping the remaining destination IP addresses or the remaining service ports except for the set destination IP address or the set service port, (i) when the specific service security policy is the second blacklist mode, the specific access switch checks whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in a blacklist, and if it is confirmed that the destination IP address or the service port is registered in the blacklist, blocks the third forwarding for the packet, and if it is confirmed that the destination IP address or the service port is not registered in the blacklist, allows the third forwarding for the packet; (ii) When the specific service security policy is the second whitelist mode, the specific access switch checks whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in a whitelist, and if it is confirmed that the destination IP address or the service port is registered in the whitelist, allows the third forwarding for the packet, and if it is confirmed that the destination IP address or the service port is not registered in the whitelist, blocks the third forwarding for the packet.

6. 6. The method of claim 5, wherein, when the specific access switch blocks the third forwarding for the packet, the specific access switch transmits information regarding the packet for which the third forwarding is blocked to a network controller, and enables the network controller to refer to the information regarding the packet for which the third forwarding is blocked and update at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation, or to reconfigure the specific micro-segmentation corresponding to the specific port of the specific access switch.

7. In the step (b), 2. The method of claim 1, wherein if the packet on which the second forwarding is performed is an ARP packet, the specific access switch does not perform the third forwarding on the packet, and floods the packet to remaining ports of the specific access switch except for the specific port.

8. (c) transmitting the packet on which the third forwarding is performed to a security module by the specific access switch, and having the security module analyze the packet to determine whether the packet is an abnormal packet, and blocking the third forwarding of the packet if the packet is determined to be an abnormal packet; The method of claim 1 further comprising:

9. In access switches that manage networks using microsegmentation for zero trust security, a memory having instructions stored therein for managing a network using microsegmentation for zero trust security; and a processor that performs operations for managing a network using microsegmentation for zero trust security according to the instructions stored in the memory; Including, The processor (I) obtains a source MAC address corresponding to a specific network device that transmitted the packet from an Ethernet head of the packet when a first forwarding is performed on a packet transmitted to a specific port among ports of an access switch, and checks whether the source MAC address is registered in a MAC address table. If the source MAC address is not registered in the MAC address table, the processor registers the source MAC address in the MAC table by referring to a specific user security policy set in a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segmentations obtained by grouping and classifying each port of the access switch according to a network security policy for zero trust security, and, in a state where the source MAC address is registered in the MAC table, registers the source MAC address in the MAC table by referring to a specific user security policy set in a specific micro-segmentation corresponding to the specific port of the specific access switch among micro-segmentations obtained by grouping and classifying each port of the access switch according to a network security policy for zero trust security. and if the source MAC address satisfies the specific user security policy, performing a second forwarding on the packet; and (II) obtaining a source IP address from an IP head of the packet, checking whether the source IP address is registered in a routing table, and if the source IP address is not registered in the routing table, causing the source IP address to be registered in the routing table, and performing a third forwarding on the packet in a state in which the source IP address is registered in the routing table, obtaining a destination IP address or a service port from the IP head of the packet, and checking whether the destination IP address or the service port satisfies a specific service security policy set for the specific micro-segmentation, thereby filtering the packet for which the third forwarding is performed.

10. The microsegmentation is configured by a network controller that manages access switches that enable network devices to communicate with each other within the network; 10. The access switch of claim 9, wherein the network controller divides the micro-segmentation into pairs of access switches and ports according to the network security policy, and sets a respective user security policy for each of the micro-segmentation, and analyzes an Address Resolution Protocol (ARP) packet obtained by filtering each packet for which the first forwarding is performed in each of the access switches, detects each of the network devices coupled to each of the ports of each of the access switches, and registers the network devices in each of the micro-segmentation corresponding to each of the ports to which each of the network devices is coupled according to the respective user security policy.

11. The processor, in the process (I), detects that the specific user security policy includes a first blacklist mode that enables MAC address learning for all MAC addresses, forwards learned MAC addresses, and drops only MAC addresses registered in a blacklist; 10. The access switch of claim 9, wherein in the first blacklist mode, when the MAC address learning is enabled, (i) as a result of checking whether the source MAC address is registered in the MAC address table, if it is confirmed that the source MAC address is registered in the MAC address table, the access switch checks whether the source MAC address is registered in a blacklist, and if the source MAC address is registered in the MAC address table, blocks the second forwarding for the packet, and if the source MAC address is not registered in the blacklist, performs the second forwarding for the packet; and (ii) as a result of checking whether the source MAC address is registered in the MAC address table, if it is confirmed that the source MAC address is not registered in the MAC address table, the access switch registers the source MAC address in the MAC address table through the MAC address learning, checks whether the source MAC address is registered in the blacklist, and if the source MAC address is registered in the blacklist, blocks the second forwarding for the packet, and if the source MAC address is not registered in the blacklist, performs the second forwarding for the packet.

12. The processor, in the process (I), the specific user security policy includes a first whitelist mode in which MAC address learning for all MAC addresses is disabled, only MAC addresses registered in a whitelist are registered in the MAC address table and forwarded, and the remaining MAC addresses are dropped; 10. The access switch of claim 9, wherein, in the first whitelist mode, when the MAC address learning is disabled, (i) a check is made to see whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is registered in the MAC address table, the second forwarding is performed for the packet; and (ii) a check is made to see whether the source MAC address is registered in the MAC address table, and if it is confirmed that the source MAC address is not registered in the MAC address table, the access switch checks whether the source MAC address is registered in a whitelist, and if it is registered in the whitelist, registers the source MAC address in the MAC address table and performs the second forwarding for the packet; and if the source MAC address is not registered in the whitelist, the access switch blocks the second forwarding for the packet.

13. The processor, in the process (II), the specific service security policy includes one of a second blacklist mode for forwarding a remaining destination IP address or a remaining service port excluding a set destination IP address or a set service port, and a second whitelist mode for dropping a remaining destination IP address or a remaining service port excluding a set destination IP address or a set service port, (i) if the specific service security policy is the second blacklist mode, confirm whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in a blacklist, and if it is determined that the destination IP address or the service port is registered in the blacklist, block the third forwarding for the packet, and if it is determined that the destination IP address or the service port is not registered in the blacklist, allow the third forwarding for the packet; (ii) when the specific service security policy is the second whitelist mode, the access switch checks whether the destination IP address or the service port of the packet for which the third forwarding is performed is registered in a whitelist, and if it is confirmed that the destination IP address or the service port is registered in the whitelist, allows the third forwarding for the packet, and if it is confirmed that the destination IP address or the service port is not registered in the whitelist, blocks the third forwarding for the packet.

14. The access switch of claim 13, wherein when the processor blocks the third forwarding for the packet, the processor transmits information regarding the packet for which the third forwarding is blocked to a network controller, and enables the network controller to refer to the information regarding the packet for which the third forwarding is blocked and update at least one of the specific user security policy and the specific service security policy corresponding to the specific micro-segmentation, or to reconfigure the specific micro-segmentation corresponding to the specific port of the specific access switch.

15. The access switch of claim 9, wherein in the process (II), if the packet on which the first forwarding is performed is an ARP packet, the processor does not perform the third forwarding on the packet, and floods the packet to remaining ports of the specific access switch except for the specific port.

16. The access switch of claim 15, wherein the processor (III) transmits the packet on which the third forwarding is performed to a security module, and has the security module analyze the packet to determine whether the packet is an abnormal packet, and if the packet is determined to be an abnormal packet, further performs a process of blocking the third forwarding for the packet.

Images