Terminal management device and method in a network

Abstract

A terminal management method according to one embodiment includes the steps of: collecting address data of a plurality of terminals connected to a network from packets received from the plurality of terminals and status information indicating the network connection status of each of the plurality of terminals; acquiring a first IP address and a first MAC address of a first terminal that transmitted the ARP probe packet from the received ARP probe packet; and, when address data including the same IP address and MAC address as the first IP address and the first MAC address is searched for among the already-stored address data, determining whether the first terminal has copied the address data of another terminal and is a stolen terminal according to the status information of a terminal among the plurality of terminals that has address data the same as the first IP address and the first MAC address.

Description

[Technical Field]

[0001] The present disclosure relates to a terminal management device and method in a network, and more particularly to a terminal management device and method for blocking a stolen terminal that uses duplicated IP / MAC addresses on a network. [Background technology]

[0002] In a typical communication network environment, terminals communicate using IP (Internet Protocol) addresses and MAC (Media Access Control) addresses.

[0003] The IP protocol identifies communication targets using IP addresses and MAC addresses without any special verification procedures. Therefore, in networks that use the IP protocol, malicious users can easily clone the IP / MAC addresses of legitimate devices connected to the network. A pirated device that has cloned the IP / MAC address of a legitimate device can directly modify the IP / MAC address of the legitimate device on the network, causing IP collisions and causing problems for legitimate devices using the network. In addition, a pirated device can intercept packets sent to legitimate devices, causing security problems such as hacking, cracking, and eavesdropping. Summary of the Invention [Problem to be solved by the invention]

[0004] The problem to be solved by the present disclosure is to provide a terminal management device and method that can identify and block stolen terminals that use duplicated IP / MAC addresses on a network. [Means for solving the problem]

[0005] According to one embodiment of the present invention, a method for managing terminals in a network system includes the steps of: analyzing packets received from a plurality of terminals connected to a network, and collecting and storing address data of the plurality of terminals and status information indicating the network connection status of each of the plurality of terminals; receiving an Address Resolution Protocol (ARP) probe packet; acquiring a first Internet Protocol (IP) address and a first Media Access Control (MAC) address of a first terminal that transmitted the ARP probe packet from the ARP probe packet; determining, when address data including the same IP address and MAC address as the first IP address and the first MAC address is found among the stored address data, whether the first terminal is a stolen terminal that has copied the address data of another terminal according to the status information of a terminal having the same address data as the first IP address and the first MAC address; and, when the first terminal is determined to be a stolen terminal, transmitting a response packet to the ARP probe packet to the first terminal so that the IP address of the first terminal is reset to a second IP address using an Automatic Private IP Addressing (APIPA) function of the first terminal.

[0006] In the terminal management method, the second IP address may be an IP address whose connection to the network is blocked.

[0007] The terminal management method may further include a step of transmitting a response packet to the ARP probe packet to the first terminal according to a pre-set preemptive IP protection / MAC fixation policy when address data including the same IP address as the first IP address and including a MAC address different from the first MAC address is found among the address data.

[0008] The terminal management method may further include a step of storing address data binding the first IP address and the first MAC address when address data including the same IP address and MAC address as the first IP address and the first MAC address is not found among the address data.

[0009] The terminal management method may further include updating a MAC table of the switch using the pre-stored address data and a Simple Network Management Protocol.

[0010] In the terminal management method, in the header of the ARP probe packet, the Opcode may be 1, the sender MAC address may be the first MAC address, the sender IP address may be 0.0.0.0, the target MAC address may be 00:00:00:00:00:00, and the target IP address may be the first IP address.

[0011] In the terminal management method, in the header of the response packet, the Opcode may be 2, the sender MAC address may be the first MAC address, the sender IP address may be the first IP address, the target MAC address may be the first MAC address, and the target IP address may be the first IP address.

[0012] In the terminal management method, the collecting and storing step may include a step of setting the status information of the second terminal to indicate an online state when an IP packet or an ARP packet is received from the second terminal within the network.

[0013] In the terminal management method, the collecting and storing step may include a step of transmitting an ARP request packet to a third terminal among the plurality of terminals if the IP packet or the ARP packet is not received from the third terminal within a first time period, and a step of setting the status information of the third terminal to indicate an offline state if a response packet to the ARP request packet is not received within a second time period.

[0014] In the terminal management method, the determining step may include a step of determining that a first terminal is a stolen terminal when the status information of a terminal among the plurality of terminals corresponding to the first IP address and the first MAC address indicates the online state.

[0015] According to one embodiment, the terminal management device may include a communication unit that communicates with a plurality of terminals connected to a network; a storage unit that stores state information and address data indicating a network connection state for each of the plurality of terminals; and a control unit that analyzes packets received from the plurality of terminals to collect the state information and the address data. When an ARP probe packet is received, the device acquires a first IP address and a first MAC address of a first terminal that transmitted the ARP probe packet from the ARP probe packet. When address data including the same IP address and MAC address as the first IP address and the first MAC address is found among the address data stored in the storage unit, the device determines whether the first terminal is a stolen terminal that has copied the address data of another terminal according to the state information of a terminal that has the same address data as the first IP address and the first MAC address. If the first terminal is determined to be a stolen terminal, the device transmits a response packet to the ARP probe packet to the first terminal so that the IP address of the first terminal is reset to a second IP address using the APIPA function of the first terminal.

[0016] In the terminal management device, the second IP address may be an IP address whose connection to the network is cut off.

[0017] When the control unit of the terminal management device finds address data among the address data that includes an IP address that is the same as the first IP address and a MAC address that is different from the first MAC address, it can transmit a response packet to the ARP probe packet to the first terminal according to a pre-set preemptive IP protection / MAC fixation policy.

[0018] If the control unit of the terminal management device does not find address data including the same IP address and MAC address as the first IP address and the first MAC address among the address data, the control unit of the terminal management device can store address data binding the first IP address and the first MAC address in the storage unit.

[0019] The control unit of the terminal management device can update the MAC table of the switch using the address data stored in the storage unit and a simple network management protocol.

[0020] In the terminal management device, in the header of the ARP probe packet, the Opcode is 1, the sender MAC address is the first MAC address, the sender IP address is 0.0.0.0, the target MAC address is 00:00:00:00:00:00, and the target IP address is the first IP address.

[0021] In the terminal management device, in the header of the response packet, the Opcode can be 2, the sender MAC address can be the first MAC address, the sender IP address can be the first IP address, the target MAC address can be the first MAC address, and the target IP address can be the first IP address.

[0022] The control unit of the terminal management device can set the status information of the second terminal to indicate an online status when an IP packet or an ARP packet is received from the second terminal in the network.

[0023] The control unit of the terminal management device is a terminal management device that, if the IP packet or the ARP packet is not received from a third terminal among the plurality of terminals within a first time period, transmits an ARP request packet to the third terminal, and, if a response packet to the ARP request packet is not received within a second time period, sets the status information of the third terminal to indicate an offline state.

[0024] The control unit of the terminal management device may include a step of determining that the first terminal is a stolen terminal when the status information of a terminal among the plurality of terminals corresponding to the first IP address and the first MAC address indicates the online status. [Effects of the Invention]

[0025] According to the present disclosure, it is possible to identify and block terminals that use duplicated IP / MAC addresses on a network, thereby protecting the network usage of terminals that are using the network normally. [Brief explanation of the drawings]

[0026] [Figure 1] 1 is a diagram illustrating a network system according to an embodiment of the present invention; [Figure 2] 1 is a diagram illustrating a terminal management method in a network system according to an embodiment of the present invention; [Figure 3] 10 illustrates an example in which the terminal management device according to an embodiment blocks a stolen terminal. DETAILED DESCRIPTION OF THE INVENTION

[0027] Hereinafter, the embodiments disclosed herein will be described in detail with reference to the accompanying drawings. Identical or similar elements will be designated by the same or similar reference numerals, and redundant descriptions thereof will be omitted. The suffixes "module" and "unit" used in the following description are used or interchangeable with the elements for the sake of ease of description, and do not have any distinct meanings or roles. Furthermore, when describing the embodiments disclosed herein, if a detailed description of related publicly known technology is deemed to detract from the gist of the embodiments disclosed herein, such a detailed description will be omitted. Furthermore, the accompanying drawings are provided to facilitate understanding of the embodiments disclosed herein, and the technical concepts disclosed herein should not be limited by the accompanying drawings. It should be understood that the accompanying drawings include all modifications, equivalents, and alternatives within the concept and scope of the present invention.

[0028] Terms including ordinal numbers such as first, second, etc. may be used to describe various components, but the components are not limited by the terms. The terms are used only to distinguish one component from another.

[0029] Singular expressions include plural expressions unless the context clearly indicates otherwise.

[0030] In this application, terms such as "comprise" or "have" are to be understood as specifying the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but without precluding the possible presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0031] Hereinafter, a terminal management device and method in a network according to an embodiment will be described in detail with reference to the necessary drawings.

[0032] FIG. 1 is a diagram illustrating a network system according to an embodiment.

[0033] In the following explanation, a terminal that is normally connected to the network will be referred to as a "normal terminal," and a terminal that uses the stolen IP address and MAC address of a normal terminal will be referred to as a "stolen terminal."

[0034] Referring to FIG. 1, a network system according to one embodiment may include a policy server 10, a terminal management device 20, and a switch 30.

[0035] The policy server 10 can set and manage policies (access control policies) for connection authentication, authorization, accounting, etc. for network access in a network system. The access control policy can include bound address data (IP addresses and MAC addresses) of hosts connected to the network in the form of a table. The access control policy can also include a network management scope for managing IP collisions, and a response policy when an IP collision occurs (e.g., whether to transmit an IP collision response packet (ARP (Address Resolution Protocol) Probe Reply packet), whether to apply an advertised IP protection / MAC fixation policy, etc.).

[0036] The policy server 10 may include a database 11 that stores policy information such as access control policies, and a policy management unit 12 that manages the policy information stored in the database 11 .

[0037] The policy management unit 12 can receive bound address data (IP address and MAC address) from the control unit 23 of the terminal management device 20 and store it in the database 11. The policy management unit 12 can also transmit policy information to the terminal management device 20 upon request from the terminal management device 20.

[0038] The terminal management device 20 can detect a stolen terminal on the network and block the stolen terminal from using the network.

[0039] The terminal management device 20 may include a storage unit 21, a communication unit 22, and a control unit 23.

[0040] The storage unit 21 can store various information, data, etc. processed by the terminal management device 20. For example, the storage unit 21 can store address data (IP address and MAC address) of the terminal collected by the terminal management device 20. It can also store, for example, terminal status information (online or offline status) collected by the terminal management device 20, the time when the last packet was generated for each terminal, etc. For example, the storage unit 21 can also store policy information received from the policy server 10.

[0041] The communication unit 22 can perform communication functions such as transmitting and receiving packets between the terminal management device 20 and an external device (for example, a terminal (not shown), the policy server 10, the switch 30, etc.).

[0042] The control unit 23 can control the overall operation of the terminal management device 20.

[0043] The control unit 23 can operate as a probe device that collects packets (e.g., ARP packets or IP packets) from terminals connected to the same network as the terminal management device 20 through the communication unit 22. Here, the range of the same network can be divided based on the use of a router and can be designated as the same broadcast domain. In a network system, a router divides a network and blocks broadcasts from being transmitted to other networks. In this case, the range that a broadcast reaches is called a broadcast domain.

[0044] The control unit 23 can analyze the collected packets (e.g., ARP packets or IP packets) to acquire address data (IP address and MAC address) of each terminal. That is, when a packet is received, the control unit 23 can acquire address data of the sender terminal (sender IP address (Source IP or Sender IP) and sender MAC address (Source MAC or Sender MAC)) from the packet. When the control unit 23 acquires the address data of the sender terminal from the received packet, the control unit 23 can compare the address data with previously stored terminal address data to determine whether the terminal is a new terminal. That is, when the control unit 23 does not find the same address data as the address data acquired from the received packet among the previously stored terminal address data, the control unit 23 can determine that the terminal that transmitted the packet is a new terminal that has newly connected to the network. When the control unit 23 determines that the terminal that transmitted the packet is a new terminal, the control unit 23 can bind the IP address and MAC address of the sender terminal acquired from the packet by one-to-N mapping and store the bound address data (IP address and MAC address) in the storage unit 21. The control unit 23 can also transmit the bound address data to the policy server 10 .

[0045] The control unit 23 can also analyze the collected packets to obtain status information (online status or offline status) of each terminal. Here, the online status may indicate a state in which the connection between the terminal and the network is active, and the offline status may indicate a state in which the connection between the terminal and the network is inactive. When the control unit 23 identifies the terminal that transmitted the packet based on the sender address data of the packet received from the terminal, it can set the status information of the terminal to indicate the online status.

[0046] The control unit 23 analyzes the collected packets and, when it identifies a terminal whose address data is stored in the storage unit 21 (i.e., a terminal registered as connected to the network) that has not transmitted a packet for a predetermined period of time, transmits an ARP request packet to the terminal to check the status of the terminal. Thereafter, the control unit 23 waits for a response packet to the ARP request packet from the terminal for a predetermined period of time (e.g., 3 seconds), and if no response packet is received within the predetermined period of time, it can determine that the terminal is in an offline state. Accordingly, the control unit 23 can change the corresponding status information of the terminal so that the status information indicates an offline state. To this end, the control unit 23 can continuously acquire the last packet reception time (or the last packet generation time) for each terminal and store and manage the acquired last packet reception time in the storage unit 21 for each terminal.

[0047] The control unit 23 can also obtain additional data such as the NetBIOS (Network Basic Input / Output System) name of each terminal and the network activation time from the collected packets, and store the obtained additional data in the storage unit 21.

[0048] The control unit 23 can also operate as an anti-theft detection device that collects ARP probe packets transmitted from terminals connected to the same network and uses the collected packets to detect an pirated terminal within a network management range managed by the terminal management device 20. The control unit 23 can receive information about the network management range from the policy server 10 through the communication unit 22. The network management range can include information about an IP address band that must be managed in order for the terminal management device 20 to detect an pirated terminal. Upon receiving the network management range from the policy server 10, the control unit 23 can collect address data in the IP address band defined by the network management range and detect IP address collisions.

[0049] RFC5227, the proposed standard for IPv4 Address Conflict Detection, specifies ACD (Address Conflict Detection) using ARP probe packets and ARP Announcement packets.

[0050] In ACD, ARP probe packets are used by hosts to check whether their IP address is already in use within their own network (broadcast domain) and to prevent IP collisions. A host broadcasts an ARP probe packet with an ARP Opcode of 1 set to an ARP request within its own network and waits for a response packet (a packet with an ARP Opcode of 2). When transmitting an ARP probe packet (ARP request), a host can set the sender MAC address in the header to its own MAC address and the sender IP address to 0.0.0.0. A host can also set the target MAC address in the ARP probe packet header to 00:00:00:00:00:00 and the target IP address to its own IP address. Such ARP probe packets may differ from Gratuitous ARP (GARP) packets in that they do not update the ARP caches of other hosts on the same network to prevent IP address collisions. When a host transmits a GARP packet, all hosts connected to the same network as that host can use it to update their ARP caches.

[0051] In ACD, an ARP announcement packet is a packet used to claim the use of an IP address if no response is received after sending an ARP probe packet. If a host sends an ARP probe packet but no response packet is received, it can send an ARP announcement packet to claim the use of the IP address. This ARP announcement packet is similar to a GARP packet in that it updates the ARP cache of other hosts, but differs from a GARP packet in that its Opcode is set to 1, indicating a solicitation packet, rather than 2.

[0052] In a network system, a terminal repeatedly broadcasts an ARP probe packet when its IP address changes. Therefore, a pirating terminal that copies another terminal's address data and changes its own IP address and MAC address broadcasts the ARP probe packet within the network to which the copied IP address belongs. As described above, an ARP probe packet (ARP request) transmitted from each host (terminal) can include the IP address and MAC address of the transmitting host. Therefore, when the control unit 23 receives an ARP probe packet transmitted in an ARP request from a terminal, it detects the corresponding terminal's IP address and MAC address from the collected ARP probe packet and compares them with the address data stored in the storage unit 21 to determine whether the terminal is a pirating terminal that copies and uses another terminal's address data.

[0053] Because IP addresses on a network are arbitrarily assigned by users, IP collisions can occur due to user error rather than malicious access. Furthermore, duplicate IP addresses can be issued due to a Dynamic Host Configuration Protocol (DHCP) server error. Therefore, in this embodiment, to distinguish between IP address collisions due to user error or a DHCP server error and malicious theft, the system determines whether or not there is a MAC address collision in addition to the IP address, thereby detecting a maliciously theft-using terminal. Because a MAC address is unique identification information for a terminal, a situation in which a MAC address is duplicated with another terminal due to user error cannot occur. Therefore, if an ARP probe packet is generated with the same IP address and MAC address as previously stored address data, the terminal transmitting the packet may be attempting to maliciously intrude into the network or may be attempting to snip packets from legitimate terminals in an attempt to eavesdrop or steal data.

[0054] Therefore, if address data that has the same IP address and MAC address as the address data newly collected through the ARP probe packet already exists in the storage unit 21, the control unit 23 can determine that the terminal that transmitted the ARP probe packet is an eavesdropping terminal.

[0055] Meanwhile, in a network system, a terminal can transmit ARP probe packets not only when its IP address is changed, but also when its network interface switches from an inactive state to an active state, when the terminal returns from a power-saving mode to a normal mode, when a change occurs in the link status with the network system (e.g., the connection status of the Internet cable), when the 802.11 wireless interface is associated with a new base station, etc. In other words, even a normal terminal that is not a pirating terminal can repeatedly broadcast ARP probe packets when its network connection switches from an offline state to an online state.

[0056] Therefore, in this embodiment, in order to prevent a normal terminal from being mistakenly identified as a stolen terminal, the control unit 23 can further check the status information of the terminal that transmitted the ARP probe packet. If address data having the same IP address and MAC address as the address data newly collected through the ARP probe packet already exists in the storage unit 21, the control unit 23 can further check the status information of the corresponding terminal before receiving the ARP probe packet and finally determine whether the terminal is a stolen terminal. That is, if the status information of the corresponding terminal indicates an offline state before receiving the ARP probe packet, the control unit 23 can determine that the received ARP probe packet was received from a normal terminal whose connection state with the network has changed to an online state, and can finally determine that the corresponding terminal is a normal terminal rather than a stolen terminal.

[0057] When a pirated terminal is detected, the control unit 23 can transmit a network use blocking packet (a response packet to an ARP probe packet (ARP Probe Reply packet)) and operate as a blocking device that blocks the pirated terminal from using the network.

[0058] When a device using an operating system (OS) such as Windows 8 or later, or MAC OS 9 or later, receives a response packet in response to an ARP probe packet it transmitted, it sets its own IP address to an automatically assigned IP address using the Automatic Private IP Addressing (APIPA) function, rather than the IP address set by the user. APIPA is a function that automatically assigns IP addresses in the Windows operating system in network environments where there is no DHCP server or where a DHCP server cannot be used. The Internet Assigned Numbers Authority (IANA) has reserved IP addresses 169.254.0.0 to 169.254.255.255 for APIPA. Therefore, IP addresses automatically assigned by APIPA are guaranteed not to conflict with routing addresses.

[0059] As mentioned above, when a stolen terminal receives a response packet to the ARP probe packet it transmitted via the control unit 23, it is automatically assigned the IP address 169.254.xy (where x and y are the terminal's unique identifiers) by the APIPA function, and is no longer able to connect to the network to which the stolen IP address belongs.

[0060] Whether to transmit an ARP probe response packet when a pirated terminal is detected can be determined according to the access management policy stored in the policy server 10. That is, if the policy information received from the policy server 10 instructs transmission of a blocking packet when a pirated terminal is detected, the control unit 23 can transmit an ARP probe response packet when a pirated terminal is detected.

[0061] Meanwhile, the control unit 23 can determine that an IP address duplication has occurred if the address data newly collected through the ARP probe packet has the same IP address but a different MAC address as the address data of another terminal that has already been bound. The control unit 23 can transmit a response packet to the ARP probe packet to the corresponding terminal even if the IP address duplication is not due to address theft but is due to an access control policy. That is, the control unit 23 can transmit a response packet to the ARP probe packet even if an IP duplication is detected according to the preemptive IP protection / MAC fixation policy of the access control policy. Even in this case, the terminal that receives the response packet to the ARP probe packet it transmitted is automatically assigned the IP address 169.254.xy by the APIPA function.

[0062] On the other hand, if a terminal that has been automatically assigned the IP address 169.254.xy by the APIPA function is a terminal that uses the Windows operating system, the terminal can transmit an ARP probe packet to use the IP address assigned by APIPA.

[0063] Therefore, when an ARP probe packet including IP address 169.254.xy is received through communication unit 22, control unit 23 can determine that the operating system of the terminal that transmitted it is WINDOWS. On the other hand, when control unit 23 transmits a response packet to the ARP probe packet and then does not transmit an ARP probe packet from the terminal, control unit 23 can determine that the terminal uses an operating system other than WINDOWS.

[0064] The control unit 23 can periodically update the MAC table of the switch 30 using a Simple Network Management Protocol (SNMP) to update the MAC table (port-MAC binding data table) of the switch 30 according to packets transmitted by the pirating terminal and prevent packets from a normal terminal from being transmitted to the pirating terminal. That is, the control unit 23 can periodically update the MAC table of the switch 30 based on the address data stored in the storage unit 21.

[0065] In the above-described terminal management device 20, the control unit 23 can be configured with a processor realized by a central processing unit (CPU) or other chipset, a microprocessor, or the like.

[0066] Hereinafter, the terminal management method of the terminal management device 20 according to one embodiment will be described in detail with reference to FIGS.

[0067] 2 is a diagram illustrating a terminal management method in a network according to an embodiment of the present invention, which can be performed by the terminal management device 20 described above with reference to FIG.

[0068] Referring to FIG. 2, the terminal management device 20 can collect address data and status information of terminals connected to the network to which it belongs (S10).

[0069] In step S10, the terminal management device 20 analyzes the IP packet or ARP packet received from the terminal and can acquire the address data of each terminal. When the terminal management device 20 receives an IP packet or ARP packet from the terminal, it can acquire the sender's address data (sender IP address and sender MAC address) from the packet. When the terminal management device 20 acquires the sender's address data from the received packet, it can compare it with the previously stored terminal address data to determine whether the sender of the packet is a new terminal. That is, if the terminal management device 20 does not find the same address data as the address data acquired from the received packet among the previously stored terminal address data, it can determine that the terminal that transmitted the packet is a new terminal that has newly connected to the network. When the terminal management device 20 determines that the terminal that transmitted the packet is a new terminal, it can bind the sender's (terminal's) IP address and MAC address acquired from the packet by one-to-many mapping and store the bound address data (IP address and MAC address) in the storage unit 21.

[0070] In step S10, the terminal management device 20 may analyze an IP packet or ARP packet received from a terminal and obtain status information indicating the network connection status of each terminal. When the terminal management device 20 receives an IP packet or ARP packet from a terminal, the terminal management device 20 may identify the terminal that transmitted the packet based on the sender address data of the received packet and set the status information of the terminal whose packet transmission has been confirmed to indicate an online state. Meanwhile, when the terminal management device 20 identifies a terminal that has not transmitted an IP packet or ARP packet within a predetermined time period among terminals connected to the same network as the terminal management device 20, the terminal management device 20 may transmit an ARP request packet to the terminal to check the status of the terminal. Thereafter, the terminal management device 20 may wait for a predetermined time period (e.g., 3 seconds) to receive a response packet to the ARP request packet from the terminal. If no response packet is received from the terminal within the predetermined time period, the terminal management device 20 may determine that the terminal is offline. As a result, the terminal management device 20 may change the corresponding status information to indicate the offline state of the terminal. The terminal management device 20 can identify terminals connected to the same network as the terminal management device 20 based on the address data stored in the storage unit 21.

[0071] When an ARP probe packet is received within the network (broadcast domain) to which the device belongs (S11), the IP address and MAC address of the corresponding terminal can be obtained from the ARP probe packet (S12).

[0072] In step S12, the terminal management device 20 checks the IP address band assigned to it based on the network management range (IP address band) received from the policy server 10, and can acquire IP addresses and MAC addresses within the IP address band assigned to it. That is, the terminal management device 20 can collect IP addresses and MAC addresses only for ARP probe packets that contain IP addresses belonging to the IP address band assigned to it, among ARP probe packets broadcast within the network to which it belongs. Therefore, the IP address band from which the terminal management device 20 collects IP addresses may be the entire IP address band used in the network to which the terminal management device 20 belongs, or may be a part of the IP address band used in the network to which the terminal management device 20 belongs, depending on the network management range received from the policy server 10.

[0073] The terminal management device 20, which has collected the IP address and MAC address from the ARP probe packet, can compare the IP address acquired in step S11 with the address data (IP address and MAC address) already stored to determine whether or not an IP address collision has occurred (S13). In step S13, the terminal management device 20 can determine that an IP address collision has occurred if there is address data among the already stored address data that has the same IP address as the IP address acquired in step S12.

[0074] If it is determined that an IP address collision has occurred, the terminal management device 20 can compare the MAC address acquired through step S12 with the address data (IP address and MAC address) that has already been stored to determine whether or not a MAC address collision has occurred (S14). In step S14, if the terminal management device 20 detects address data that includes the same IP address as the IP address acquired through step S12, it compares whether the MAC address of the address data is the same as the MAC address acquired through step S12, and if the two MAC addresses are the same, it can determine that a MAC address collision has occurred.

[0075] If it is determined through steps S13 and S14 that a collision has occurred in all IP addresses and MAC addresses, the terminal management device 20 can determine whether the ARP probe packet is a packet generated due to a state transition of a normal terminal based on the previously stored terminal state information (S15).

[0076] In step S15, the terminal management device 20 can check the state information of the terminal indicated by the IP address and MAC address acquired in step S12 from among the stored state information. If the terminal management device 20 finds from the state information that the previous state of the terminal, i.e., the state before receiving the ARP probe packet, was offline, it can determine that the ARP probe packet received in step S11 is a packet generated by a normal terminal that is not address theft switching its connection state from offline to online.

[0077] On the other hand, if the terminal management device 20 checks the status information and determines that the previous state of the terminal, i.e., the state before receiving the ARP probe packet, is online, it can determine that the ARP probe packet received through step S11 is a packet generated by a stolen terminal.

[0078] If it is determined in step S15 that the ARP probe packet is not a packet generated by a state transition of a normal terminal, i.e., that the packet is generated by a stolen terminal, the terminal management device 20 can transmit an ARP probe response packet, which is a network usage blocking packet, in accordance with the policy information received from the policy server 10 (S17).

[0079] If it is determined in step S14 that no MAC address collision has occurred, the terminal management device 20 can determine that the IP address collision is due to IP address duplication, not theft. In this case, the terminal management device 20 checks the policy information received from the policy server 10 to determine whether the preemptive IP protection / MAC fix policy is applied (S16), and if the policy is applied, it can transmit an ARP probe response packet (S17).

[0080] As a result, a terminal that receives an ARP probe response packet in response to its own ARP probe packet is automatically assigned the IP address 169.254.xy by the APIPA function. Also, if the operating system it uses is WINDOWS, the terminal can retransmit the ARP probe packet to use the IP address assigned by APIPA.

[0081] Therefore, after transmitting the ARP probe response packet, the terminal management device 20 checks whether an ARP probe packet containing an IP address (169.254.xy) automatically assigned by APIPA is received within a predetermined time (S18), and if the ARP probe packet is received, it can determine that the operating system of the corresponding terminal is windowed (S19).On the other hand, if the reception of an ARP probe packet containing the IP address 169.254.xy is not confirmed for a predetermined time or more, it can determine that the operating system of the corresponding terminal is non-windowed (e.g., MAC OS) (S20).

[0082] Thereafter, the terminal management device 20 periodically updates the MAC table of the switch 30 using the SNMP protocol (S21), thereby updating the MAC table (port-MAC binding data table) of the switch 30 with packets transmitted by the pirated terminal, thereby preventing packets from a normal terminal from being transmitted to the pirated terminal.

[0083] Meanwhile, if it is determined through step S12 that the received ARP probe packet does not correspond to an IP address collision, the terminal management device 20 can store the bound address data of the IP address and MAC address acquired from the ARP probe packet in the internal storage unit 21 (S22). In addition, the terminal management device 20 can synchronize the address data (bound IP address and MAC address) stored in the policy server 10 with the address data (bound IP address data and MAC address) stored in its own internal storage unit 21 by transmitting the bound address data to the policy server 10 (S23).

[0084] FIG. 3 shows an example in which the terminal management device 20 according to an embodiment blocks the theft terminal 1a.

[0085] Referring to Figure 3, the stolen terminal 1a copies the IP address (10.1.2.33) and MAC address (00:E0:4C:65:7E:35) of a normal terminal (not shown) that is already connected to the network, and changes its own IP address (null) and MAC address (00:E0:4C:00:E0:4C) (S30).

[0086] When the IP address is changed, the pirating terminal 1a transmits an ARP probe packet (S31). At this time, the ARP probe packet may include Opcode 1, sender IP address (sender IP) 0.0.0.0, sender MAC address (sender MAC) 00:E0:4C:65:7E:35 (the stolen MAC address), target IP address (target IP) 10.1.2.33 (the stolen IP address), and target MAC address (target MAC) 00:00:00:00:00;00.

[0087] The terminal management device 20 receives the ARP probe packet transmitted by the stolen terminal 1a (S32). The terminal management device 20 also detects the IP address and MAC address of the terminal that transmitted the received ARP probe packet, and compares this with the address data already stored to check for any IP address and MAC address collisions (S33).

[0088] The normal terminal whose IP address and MAC address have been duplicated by the theft terminal 1a is already using the network, and therefore the IP address (10.1.2.33) and MAC address (00:E0:4C:65:7E:35) of the normal terminal duplicated by the theft terminal 1a have already been collected by the terminal management device 20 and stored in the internal storage unit 21 of the terminal management device 20. Therefore, the IP address (10.1.2.33) and MAC address (00:E0:4C:65:7E:35) extracted from the ARP probe packet transmitted by the theft terminal 1a will collide with the address data already stored in the terminal management device 20.

[0089] Having confirmed the IP address and MAC address collision, the terminal management device 20 checks the previous connection state of the terminal (normal terminal) indicated by the IP address and MAC address, i.e., the connection state before transmitting the ARP probe packet, based on the previously saved state information (S34). Because the stolen terminal 1a has a duplicated IP address and MAC address of a normal terminal currently connected to the network, the previous connection state of the terminal (normal terminal) indicated by the IP address and MAC address can be confirmed in an online state.

[0090] As a result, the terminal management device 20 determines that a collision of IP addresses and MAC addresses has occurred due to address duplication, and transmits a response packet to the ARP probe packet to block the pirating terminal 1a from using the network (S35). At this time, the ARP probe response packet includes Opcode 2, a sender IP address of 10.1.2.33 (the IP address of the pirating terminal 1a), a sender MAC address of 00:E0:4C:65:7E:35 (the MAC address of the pirating terminal 1a), a target IP address (Target IP) of 10.1.2.33 (the IP address of the pirating terminal 1a), and a target MAC address (Target MAC) of 00:00:00:00:00:00.

[0091] Upon receiving the ARP probe response packet from the terminal management device 20 (S36), the pirating terminal 1a recognizes that the IP address 10.1.2.33 cannot be used and changes its own IP address to 169.254.xy using the APIPA function (S37). If the operating system of the pirating terminal 1a is WINDOWS, the pirating terminal 1a retransmits the ARP probe packet reflecting the changed IP address (S37). At this time, the ARP probe packet contains Opcode 1, sender IP address 0.0.0.0, sender MAC address 00:E0:4C:65:7E:35, target IP address 169.254.x,y (the changed IP address), and target MAC address 00:00:00:00:00;00.

[0092] The theft-tapping terminal 1a then waits to receive a response packet to the ARP probe packet, and if no response packet is received, it transmits an ARP announcement packet to determine its own IP address. Since the determined IP address 169.254.x, y cannot be used to connect to the network to which the legitimate terminals copied by the theft-tapping terminal 1a belong, malicious network use by the theft-tapping terminal 1a can be blocked. Furthermore, network use by legitimate terminals can be protected.

[0093] The above-described embodiments can be implemented as computer-readable code stored on a medium having a program recorded thereon. Computer-readable media include any storage device that stores data readable by a computer system. Examples of computer-readable media include hard disk drives (HDDs), solid-state disks (SSDs), silicon disk drives (SDDs), ROMs, RAMs, CD-ROMs, magnetic tapes, floppy disks, and optical data storage devices, as well as media implemented in the form of carrier waves (e.g., transmissions via the Internet). The computer may also include a controller of a terminal. Therefore, the above detailed description should not be construed as limiting in all respects but should be considered as illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims. All modifications within the scope of the present invention are encompassed within the scope of the present invention.

Claims

1. A terminal management method in a network system, analyzing packets received from a plurality of terminals connected to the network to collect and store address data of the plurality of terminals and status information indicating the network connection status of each of the plurality of terminals; receiving an Address Resolution Protocol (ARP) probe packet; acquiring a first Internet Protocol (IP) address and a first Media Access Control (MAC) address of a first terminal that transmitted the ARP probe packet from the ARP probe packet; When address data including the same IP address and MAC address as the first IP address and the first MAC address is found from among the stored address data, determining whether the first terminal is a stolen terminal that has copied the address data of another terminal according to the state information of a terminal having the same address data as the first IP address and the first MAC address among the plurality of terminals; A terminal management method including a step of transmitting a response packet to the ARP probe packet to the first terminal so that the IP address of the first terminal is reset to a second IP address by an APIPA (Automatic Private IP Addressing) function of the first terminal when the first terminal is determined to be a stolen terminal.

2. The terminal management method according to claim 1 , wherein the second IP address is an IP address whose connection to the network is blocked.

3. 2. The terminal management method of claim 1, further comprising: when address data including the same IP address as the first IP address and including a MAC address different from the first MAC address is found among the address data, transmitting a response packet to the ARP probe packet to the first terminal according to a pre-set preemptive IP protection / MAC fixation policy.

4. 2. The terminal management method of claim 1, further comprising: if address data including the same IP address and MAC address as the first IP address and the first MAC address is not found among the address data, storing address data binding the first IP address and the first MAC address.

5. The terminal management method of claim 1, further comprising updating a MAC table of a switch using the pre-stored address data and a Simple Network Management Protocol.

6. 2. The terminal management method of claim 1, wherein in the header of the ARP probe packet, the Opcode is 1, the sender MAC address is the first MAC address, the sender IP address is 0.0.0.0, the target MAC address is 00:00:00:00:00:00, and the target IP address is the first IP address.

7. 2. The terminal management method according to claim 1, wherein in the header of the response packet, Opcode is 2, the sender MAC address is the first MAC address, the sender IP address is the first IP address, the target MAC address is the first MAC address, and the target IP address is the first IP address.

8. The collecting and storing step includes:

2. The terminal management method of claim 1, further comprising the step of: when an IP packet or an ARP packet is received from a second terminal within the network, setting the status information of the second terminal to indicate an online status.

9. The collecting and storing step includes: transmitting an ARP request packet to a third terminal among the plurality of terminals if the IP packet or the ARP packet is not received from the third terminal within a first time period; and 9. The terminal management method of claim 8, further comprising the step of setting the status information of the third terminal to indicate an offline state if a response packet to the ARP request packet is not received within a second time period.

10. The determining step includes:

10. The terminal management method according to claim 9, further comprising the step of determining, when the status information of a terminal among the plurality of terminals that corresponds to the first IP address and the first MAC address indicates the online status, that the first terminal is a stolen terminal.

11. A terminal management device, a communication unit that communicates with a plurality of terminals connected to the network; a storage unit for storing status information indicating a network connection status and address data for each of the plurality of terminals; a control unit that analyzes packets received from the plurality of terminals to collect the status information and the address data; when an ARP probe packet is received, acquires a first IP address and a first MAC address of a first terminal that transmitted the ARP probe packet from the ARP probe packet; when address data including the same IP address and MAC address as the first IP address and the first MAC address is searched for among the address data stored in the storage unit, determines whether the first terminal is a stolen terminal that has copied the address data of another terminal according to the status information of a terminal that has the same address data as the first IP address and the first MAC address among the plurality of terminals; and when the first terminal is determined to be a stolen terminal, transmits a response packet to the ARP probe packet to the first terminal so that the IP address of the first terminal is reset to a second IP address using an APIPA function of the first terminal.

12. The terminal management device according to claim 11 , wherein the second IP address is an IP address whose connection to the network is cut off.

13. 12. The terminal management device of claim 11, wherein when address data including an IP address that is the same as the first IP address and a MAC address that is different from the first MAC address is found among the address data, the control unit transmits a response packet to the ARP probe packet to the first terminal according to a pre-set preemptive IP protection / MAC fixation policy.

14. The terminal management device of claim 11, wherein the control unit stores address data binding the first IP address and the first MAC address in the storage unit when address data including the same IP address and MAC address as the first IP address and the first MAC address is not found among the address data.

15. The terminal management device of claim 11 , wherein the control unit updates a MAC table of a switch using the address data stored in the storage unit and a simple network management protocol.

16. 12. The terminal management device of claim 11, wherein in the header of the ARP probe packet, the Opcode is 1, the sender MAC address is the first MAC address, the sender IP address is 0.0.0.0, the target MAC address is 00:00:00:00:00:00, and the target IP address is the first IP address.

17. 12. The terminal management device of claim 11, wherein in the header of the response packet, Opcode is 2, the sender MAC address is the first MAC address, the sender IP address is the first IP address, the target MAC address is the first MAC address, and the target IP address is the first IP address.

18. The terminal management device according to claim 11 , wherein the control unit sets the status information of the second terminal to indicate an online status when an IP packet or an ARP packet is received from the second terminal within the network.

19. 19. The terminal management device of claim 18, wherein the control unit transmits an ARP request packet to a third terminal among the plurality of terminals if the IP packet or the ARP packet is not received from the third terminal within a first time period, and sets the status information of the third terminal to indicate an offline state if a response packet to the ARP request packet is not received within a second time period.

20. 20. The terminal management device according to claim 19, wherein the control unit includes a step of determining that a first terminal is a stolen terminal when the status information of a terminal among the plurality of terminals that corresponds to the first IP address and the first MAC address indicates the online status.

Images