Electronic apparatus and providing information method thereof

Abstract

A method for providing information of an electronic device is disclosed. The method for providing information may include: a step of obtaining information regarding a network topology, routing information, and information regarding access control rules of a network; a step of generating a network reachability matrix including information regarding reachability between one or more terminals within a network based on the information regarding the network topology, the routing information, and the information regarding access control rules of a network; a step of generating a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals based on the network reachability matrix; and a step of providing information regarding the network reachability graph.

Description

Technology Field

[0001] The present disclosure relates to an electronic device and a method for controlling the same for providing information regarding a network reachability graph with improved readability. Background Technology

[0002] Network reachability information indicates the end-to-end network connectivity of cyber assets and is critically utilized not only in network management but also in the field of cybersecurity. More specifically, network reachability information can be used to verify the consistency of access control rules regarding whether network access control is functioning as expected, especially when networks grow in scale, access control rules become complex, and multiple firewalls exist on the network. Additionally, network reachability information can be used when generating attack graphs that are utilized to assess the risk level of cyber assets.

[0003] The information most commonly used to manage network connection relationships in the past was physical network topology, which represents the physical connections between hosts and network devices in the form of a graph. However, since physical network topology generally does not represent access control policies and routing information, there is a limitation in that it is impossible to verify whether cyber assets can establish actual sessions through network connections.

[0004] Furthermore, the network reachability matrix, which represents the end-to-end connectivity potential of cyber assets on a network, arranges all assets in rows and columns and indicates the connectivity status for every pair. However, since the network reachability matrix only indicates the connectivity between two assets, there are limitations in comprehensively understanding the connectivity relationships between assets at the network level. In particular, visualizing the network reachability matrix as is generates a highly complex, spaghetti-like graph, which poses a limitation in terms of readability.

[0005] NetSPA, developed at MIT Lincoln Lab, is a tool that evaluates network risk by utilizing attack graphs. It introduces the concept of reachability groups to represent network reachability information. In NetSPA, reachability groups are managed by grouping nodes within the same subnet that are subject to the same network access control within the network reachability matrix. This resolves the "firewall explosion" problem, where the number of edges in the attack graph suddenly increases explosively upon encountering a firewall. However, while the readability of the network reachability graph visualization has significantly improved compared to the network reachability matrix, it still has limitations due to the high complexity of the network. This is because the grouping targets are limited to cyber assets within individual subnets, and only terminal hosts can participate as members in reachability groups. The problem to be solved

[0006] The problem that the present embodiment aims to solve is to provide an electronic device that provides information regarding a network reachability graph with improved readability, and a method for controlling the same.

[0007] More specifically, the present disclosure provides a method for generating a network reachability graph with significantly improved readability by not limiting the targets of grouping to cyber assets within individual subnets and by removing the restriction that only terminal hosts can participate as members of the reachability group.

[0008] The technical problems that this embodiment aims to solve are not limited to those described above, and other technical problems can be inferred from the following embodiments. means of solving the problem

[0009] One aspect of the present disclosure may provide a method for providing information, comprising: obtaining information regarding a network topology, routing information, and information regarding access control rules of a network; generating a network reachability matrix including information regarding reachability between one or more terminals within a network based on the information regarding the network topology, the routing information, and the information regarding access control rules of a network; generating a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals based on the network reachability matrix; and providing information regarding the network reachability graph.

[0010] In addition, in one embodiment of the present disclosure, the network reachability matrix may provide an information provision method comprising a plurality of edges having a form from a source to a destination, which represent information regarding reachability between one or more terminals within the network.

[0011] Additionally, in one embodiment of the present disclosure, the step of generating the network reachability graph comprises: generating one or more edges having a form from a source set to a destination by merging edges having the same destination among a plurality of edges based on the network reachability matrix; generating at least one edge having a form from a source set to a destination set by merging edges having the same source set among the one or more edges; replacing the symbol of at least one terminal included in the source set and destination set of the at least one edge with a corresponding subnet symbol; and connecting the source set and destination set of the at least one edge to a remote reachability node.

[0012] Additionally, in one embodiment of the present disclosure, the step of generating the at least one edge may include, when the set of origins of the first edge among the at least one edge is included in the set of origins of the second edge and the set of destinations of the second edge is included in the set of origins of the first edge, the set of destinations of the first edge is replaced with the union of the set of destinations of the first edge and the set of destinations of the second edge, and the set of origins of the second edge is replaced with the difference of the set of origins of the first edge with respect to the set of origins of the second edge, thereby providing an information providing method.

[0013] In addition, in one embodiment of the present disclosure, the step of generating the network reachability graph may further include the step of identifying a subnet corresponding to one or more terminals based on at least one of the IP (internet protocol) address, network mask, and gateway address of one or more terminals, thereby providing an information providing method.

[0014] Additionally, in one embodiment of the present disclosure, the step of generating the network reachability graph may further include the step of identifying a fully connected edge among the at least one edge in which the source set and the destination set are the same, thereby providing an information providing method.

[0015] Additionally, in one embodiment of the present disclosure, the step of connecting the source set and destination set of the at least one edge to a remote reachable node may be omitted with respect to a third edge among the at least one edge that includes a single subnet symbol in which the source set and destination set are the same. This may provide an information providing method.

[0016] Additionally, in one embodiment of the present disclosure, the step of generating the network reachability matrix may include: identifying a plurality of routing paths between one or more terminals based on information regarding the network topology and the routing information; and generating the plurality of edges by applying access control rules of the network to the plurality of routing paths.

[0017] Additionally, in one embodiment of the present disclosure, the step of generating the plurality of edges may include: a step of determining whether the first routing path is reachable based on information regarding an access control rule of at least one firewall existing on the first routing path among the plurality of routing paths; and a step of generating a third edge corresponding to the first routing path when it is determined that the first routing path is reachable.

[0018] Another aspect of the present disclosure may provide an electronic device comprising a transceiver, a memory for storing instructions, and a processor, wherein the processor connected to the transceiver and the memory acquires information regarding a network topology, routing information, and information regarding access control rules of a network, and based on the information regarding the network topology, routing information, and information regarding access control rules of a network, generates a network reachability matrix comprising information regarding reachability between one or more terminals within a network, and based on the network reachability matrix, generates a network reachability graph comprising one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals, and provides information regarding the network reachability graph.

[0019] Another aspect of the present disclosure may provide a computer-readable recording medium on which a program for implementing a method performed by an electronic device is recorded.

[0020] Specific details of other embodiments are included in the detailed description and drawings. Effects of the invention

[0021] According to the proposed embodiment, one or more of the following effects can be expected.

[0022] According to the present disclosure, network reachability information that takes into account network routing information and firewall access control rules is compressed, thereby significantly reducing the complexity of the network reachability graph compared to conventional technology, and thus the readability of the network reachability graph can be improved.

[0023] Furthermore, since network reachability graphs display network connectivity between endpoint hosts, they are essential information for verifying the consistency of firewall access control policies at the network level; therefore, securing highly readable network reachability graphs is very important. Attack graphs are one of the important tools in cybersecurity because they identify and display in graph form all assets and paths that can be attacked by external attackers within an organization's network. However, since such attack graphs are generated based on network reachability graphs, securing highly readable network reachability graphs becomes essential, especially in large-scale network environments. Accordingly, according to the present disclosure, an electronic device can contribute more to enhancing cybersecurity by providing highly readable network reachability graphs.

[0024] The effects of the invention are not limited to those mentioned above, and other unmentioned effects will be clearly understood by a person skilled in the art from the description in the claims. Brief explanation of the drawing

[0025] FIG. 1 illustrates an example of a network reachability graph generated by an electronic device according to one embodiment of the present disclosure. FIG. 2 illustrates the process of an electronic device generating a network reachability graph according to one embodiment of the present disclosure. FIG. 3 illustrates the process of an electronic device generating a network reachability matrix according to one embodiment of the present disclosure. FIGS. 4a to 4c illustrate the process of an electronic device generating a network reachability graph according to one embodiment of the present disclosure. FIGS. 5a to 5e illustrate the process of an electronic device generating a network reachability graph according to one embodiment of the present disclosure. FIGS. 6a to 6e illustrate the process of an electronic device generating a network reachability graph according to one embodiment of the present disclosure. FIG. 7 shows a flowchart of an information provision method of an electronic device according to one embodiment. FIG. 8 shows a block diagram of an electronic device according to one embodiment. Specific details for implementing the invention

[0026] The terms used in the embodiments have been selected to be as widely used as possible, taking into account their functions in the present disclosure; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, terms have been arbitrarily selected by the applicant, and in such cases, their meanings will be described in detail in the relevant explanatory section. Therefore, terms used in the present disclosure should be defined not merely by their names, but based on their meanings and the overall content of the present disclosure.

[0027] When a part of a specification is described as "including" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0028] The expression "at least one of a, b, and c" described throughout the specification may include 'a alone', 'b alone', 'c alone', 'a and b', 'a and c', 'b and c', or 'a, b, and c all'.

[0029] The "terminal" mentioned below may be implemented as a computer or portable terminal capable of connecting to a server or other terminal via a network. Here, the computer includes, for example, a notebook, desktop, or laptop equipped with a web browser, and the portable terminal may include, for example, a wireless communication device that ensures portability and mobility, and may include all types of handheld-based wireless communication devices such as communication-based terminals like IMT (International Mobile Telecommunication), CDMA (Code Division Multiple Access), W-CDMA (W-Code Division Multiple Access), and LTE (Long Term Evolution), smartphones, tablet PCs, etc.

[0030] Embodiments of the present disclosure are described below with reference to the attached drawings so that those skilled in the art can easily implement them. However, the present disclosure may be embodied in various different forms and is not limited to the embodiments described herein.

[0031] Embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0032] FIG. 1 illustrates an example of a network reachability graph generated by an electronic device (100) according to one embodiment of the present disclosure.

[0033] According to one embodiment, the electronic device (100) can generate a network reachability graph representing reachability information between one or more terminals existing within a network. For example, the electronic device (100) can analyze the possibility of network connectivity between each asset within the network based on information regarding the physical topology of the network, routing information, or information regarding firewall access control policies. Subsequently, based on the analysis results, the electronic device (100) can represent only the information regarding the possibility of connectivity between assets within the network, without information regarding routing paths, as a network reachability graph (110) including nodes and directional edges.

[0034] In this context, reachability refers to the possibility of end-to-end network connectivity among cyber assets, indicating whether data can be transmitted from one terminal to another due to access restrictions, such as firewalls existing within the network. However, the terminology used to refer to this is not limited to what is described above and may be referred to as network connectivity, connectivity, or reachability.

[0035] According to one embodiment, the electronic device (100) can generate a network reachability graph including one or more terminal nodes. More specifically, the electronic device (100) can identify one or more terminals existing within the network and generate a terminal node corresponding to each of the one or more terminals.

[0036] For example, referring to FIG. 1, the electronic device (100) can identify terminals A, B, C, D, E, F, G, H, I, and J existing in the network. Subsequently, the electronic device (100) can generate terminal nodes A (120), B (125), C (130), D (135), E (140), F (145), G (150), H (155), I (160), and J (165) corresponding to each of the identified terminals.

[0037] According to one embodiment, the electronic device (100) can generate a network reachability graph including one or more subnet nodes. More specifically, the electronic device (100) can identify subnet groups existing within a network and generate subnet nodes corresponding to each subnet group.

[0038] For example, referring to FIG. 1, the electronic device (100) can identify a subnet S1 corresponding to terminals A, B, C, D, and E, a subnet S2 corresponding to terminals F, G, and H, and a subnet S3 corresponding to terminals I and J. Subsequently, the electronic device (100) can create subnet nodes S1 (170), S2 (175), and S3 (180) corresponding to each of the identified subnets.

[0039] Meanwhile, since firewall access control policies are generally not applied to subnets, terminal nodes connected to subnet nodes can be fully connected to each other. That is, data can be freely transmitted between terminal nodes A (120), B (125), C (130), D (135), and E (140) connected to subnet node S1 (170), data can be freely transmitted between terminal nodes F (145), G (150), and H (155) connected to subnet node S2 (175), and data can be freely transmitted between terminal nodes I (160) and J (165) connected to subnet node S3 (180).

[0040] According to one embodiment, the electronic device (100) can generate a network reachability graph including one or more remote reachability nodes. More specifically, the electronic device (100) can represent network connectivity between one or more terminals by connecting one or more subnet nodes as well as one or more terminal nodes to the remote reachability nodes. In this case, the connection of a subnet node to a remote reachability node may mean that all terminal nodes connected to the said subnet node are equally connected by the remote reachability node.

[0041] For example, referring to FIG. 1, the electronic device (100) can indicate that data can be freely transmitted between the terminal node connected to the subnet node S1 (170) and the terminal node connected to the subnet node S2 (175) by connecting the subnet node S1 (170) and the remote reachability node R1 (190) with a bidirectional arrow.

[0042] For another example, referring to FIG. 1, the electronic device (100) can indicate that by connecting the subnet node S3 (180) and the remote reachability node R1 (190) with a unidirectional arrow, data can be transmitted from the terminal node connected to the subnet node S3 (180) to the terminal node connected to the subnet node S1 (170) and the terminal node connected to the subnet node S2 (175), but data transmission from the terminal node connected to the subnet node S1 (170) and the terminal node connected to the subnet node S2 (175) to the terminal node connected to the subnet node S3 (180) may be restricted.

[0043] For another example, referring to FIG. 1, the electronic device (100) can indicate that data can be transmitted from terminal node H (155) to terminal node I (160) by connecting terminal node H (155) and terminal node I (160) and remote reachability node R2 (195) with a unidirectional arrow.

[0044] In this way, by connecting one or more terminal nodes as well as one or more subnet nodes as remote reachability nodes, the network complexity of the network reachability graph can be significantly reduced.

[0045] FIG. 2 illustrates the process of an electronic device (100) generating a network reachability graph according to one embodiment of the present disclosure.

[0046] According to one embodiment, the electronic device (100) can obtain information (230) regarding network topology, routing information (240), and information (250) regarding network access control rules. For example, a network reachability matrix generation module (200) can obtain information (230) regarding network topology, routing information (240), and information (250) regarding network access control rules.

[0047] According to one embodiment, the electronic device (100) can generate a network reachability matrix (260) based on information regarding network topology (230), routing information (240), and information regarding network access control rules (250). For example, the network reachability matrix generation module (200) can analyze network connectivity between terminal hosts based on information regarding network topology (230), routing information (240), and information regarding network access control rules (250), and generate a list of reachability edges between terminal hosts based on the analysis results.

[0048] Meanwhile, the process of the electronic device (100) or the network reachability matrix generation module (200) generating the network reachability matrix (260) will be explained in more detail with reference to FIG. 3.

[0049] According to one embodiment, the electronic device (100) can generate a network reachability graph (270) based on a network reachability matrix (260). For example, the network reachability graph generation module (210) can generate a concise and highly readable network reachability graph (270) by grouping reachability edges having the same network connection characteristics among the reachability edges between generated terminal hosts into subnet reachability nodes and remote reachability nodes.

[0050] Meanwhile, the process of the electronic device (100) or the network reachability graph generation module (210) generating the network reachability graph (270) will be explained in more detail with reference to FIGS. 4a to 4c.

[0051] According to one embodiment, the electronic device (100) can provide a network reachability graph (270) to a user. For example, a network reachability graph visualization module (220) can visualize the network reachability graph (270) based on various open source libraries for graph visualization and provide it to the user so that the user can easily understand the generated network reachability graph (270).

[0052] FIG. 3 illustrates the process of an electronic device (100) generating a network reachability matrix according to one embodiment of the present disclosure.

[0053] In step S300, the electronic device (100) can determine a routing path between one or more terminals within a network based on information regarding network topology and routing information according to one embodiment. For example, a network reachability matrix generation module can extract a routing path between all pairs of terminal hosts within a network by using a shortest path extraction algorithm based on information regarding network topology and routing information.

[0054] In step S320, the electronic device (100) may apply access control rules to each routing path based on information regarding network access control rules according to one embodiment. For example, a network reachability matrix generation module may determine whether a path is connectable based on the access control policies of firewalls existing on the routing path between terminal hosts.

[0055] In step S340, the electronic device (100) may generate a network reachability matrix according to one embodiment. For example, if the network reachability matrix generation module confirms that a routing path between terminal hosts is connectable, it may generate reachability edges between the corresponding terminal hosts in the form of source → destination. The network reachability matrix generation module may aggregate a plurality of generated reachability edges to generate a network reachability matrix or manage them as a list.

[0056] Meanwhile, when the electronic device (100) generates an edge between terminals, it can make it easier to find a bidirectional edge or a fully connected graph later by adding an edge for the terminal itself.

[0057] FIGS. 4a to 4c illustrate the process of an electronic device (100) generating a network reachability graph according to one embodiment of the present disclosure.

[0058] In step S400, the electronic device (100) can identify a subnet corresponding to one or more terminals based on a network reachability matrix according to one embodiment. For example, a network reachability graph generation module can identify a subnet to which one or more terminals within a network belong based on at least one of the IP (internet protocol) address, network mask, and gateway address of one or more terminals.

[0059] Meanwhile, the identified subnet information can be utilized in the field of cybersecurity. For example, subnet information can be used to assess the risk of threats that can only be attacked within the same subnet, such as address resolution protocol (ARP) spoofing attacks.

[0060] In step S410, the electronic device (100) may generate one or more edges by bagging and merging multiple edges based on a destination according to one embodiment. More specifically, the electronic device (100) may obtain a network reachability matrix or a list of multiple edges, bag the edges having the same destination among the multiple edges, and then merge the sources contained in each bag so that a single merged edge is produced for each destination.

[0061] For example, the network reachability graph generation module can bag and merge reachability edges based on destinations as follows, based on the destination-based merging algorithm illustrated in FIG. 4b.

[0062] [Bagging based on destination]

[0063] Bag 'A': A → A, B → A, C → A

[0064] Bag 'B': B → B, A → B, D → B, E → B

[0065] Bag 'C': C → C, A → C, F → C

[0066] ...

[0067] [Merge based on destination]

[0068] Bag 'A': {A, B, C} → {A}

[0069] Bag 'B': {B, A, D, E} → {B}

[0070] Bag 'C': {C, A, F} → {C}

[0071] ...

[0072] In step S420, the electronic device (100) can generate at least one edge by bagging and merging one or more edges based on a source according to one embodiment. More specifically, the electronic device (100) can bag edges having the same source among one or more edges merged based on a destination, and then merge the destinations contained in each bag so that one merged edge is produced for each source.

[0073] For example, the network reachability graph generation module can re-bagged and merge reachability edges based on the source as follows, based on the source-based merging algorithm shown in code lines 4-10 of FIG. 4c.

[0074] [Bagging based on the starting point]

[0075] Bag '{A, B, C}': {A, B, C} → {A}, {A, B, C} → {B}, {A, B, C} → {C}

[0076] Bag '{B, A, D, E}': {B, A, D, E} → {B}, {B, A, D, E} → {A}

[0077] Bag '{C, A, F}': {C, A, F} → {C}, {C, A, F} → {D}

[0078] ...

[0079] [Merge based on origin]

[0080] Bag '{A, B, C}': {A, B, C} → {A, B, C}

[0081] Bag '{B, A, D, E}': {B, A, D, E} → {A, B}

[0082] Bag '{C, A, F}': {C, A, F} → {C, D}

[0083] ...

[0084] According to one embodiment, the electronic device (100) can adjust the set of origins or the set of destinations of the edge when the sets of origins intersect each other during additional merging based on the origin of at least one edge.

[0085] For example, based on the algorithm shown in code lines 11-21 of FIG. 4c, if the source set of the first edge among at least one edge is included in the source set of the second edge and the destination set of the second edge is included in the source set of the first edge, the destination set of the first edge can be replaced with the union of the destination set of the first edge and the destination set of the second edge, and the source set of the second edge can be replaced with the difference of the source set of the first edge with respect to the source set of the second edge.

[0086] In this way, the electronic device (100) can more easily verify the complete connection relationship between subnets by coordinating the source set or destination set of the edge where the source sets intersect each other.

[0087] In step S430, the electronic device (100) can identify a fully connected edge among at least one edge according to one embodiment. More specifically, the electronic device (100) can identify an edge among at least one edge in which the terminal hosts of the source set and the destination set are fully connected to each other.

[0088] For example, the network reachability graph generation module can identify reachability edges from {A, B, C} to {A, B, C}, where the source and destination sets are the same, as fully connected edges.

[0089] In step S440, the electronic device (100) may, according to one embodiment, replace the symbol of at least one terminal included in the source set and destination set of at least one edge with a corresponding subnet symbol.

[0090] For example, the network reachability graph generation module can identify subnets in the source and destination sets of merged reachability edges and replace them with corresponding subnet symbols. That is, if the source or destination set contains all terminal hosts belonging to a specific subnet, the network reachability graph generation module can replace the symbols of the terminal hosts belonging to that subnet with the symbols of that subnet.

[0091] In step S450, the electronic device (100) may connect at least one edge's source set and destination set to a remote reachability node according to one embodiment. More specifically, the electronic device (100) may generate an edge of a graph that starts from a source set and passes through a remote reachability node to connect to a destination set. At this time, the electronic device (100) may connect the subnet nodes in the source set and destination set directly to the remote reachability node.

[0092] For example, a network reachability graph generation module can generate and connect terminal nodes and subnet nodes corresponding to each of the terminal symbols or subnet symbols included in the source set and destination set of at least one edge. Additionally, the electronic device (100) can generate a remote reachability node corresponding to a reachability edge and connect a terminal node or subnet node to the generated remote reachability node.

[0093] FIGS. 5a through 5e illustrate the process of an electronic device (100) generating a network reachability graph according to an embodiment of the present disclosure. Content overlapping with FIGS. 2, 3 and 4 will be briefly described or omitted.

[0094] According to one embodiment, the electronic device (100) can obtain information regarding network topology, routing information, and network access control rules.

[0095] For example, referring to FIG. 5a, the electronic device (100) can obtain information regarding terminal A (500), terminal B (502), terminal C (504), terminal D (506), terminal E (508), terminal F (510), terminal G (512), terminal H (514), terminal I (516) and terminal J (518). Additionally, the electronic device (100) can obtain information regarding a first switch (520) to which terminal A (500), terminal B (502), terminal C (504), terminal D (506) and terminal E (508) are connected, information regarding a second switch (522) to which terminal F (510), terminal G (512) and terminal H (514) are connected, and information regarding a third switch (524) to which terminal I (516) and terminal J (518) are connected. The electronic device (100) can confirm information that the first switch (520), the second switch (522), and the third switch (524) are each connected to the network (540) through the first router (530), the second router (532), and the third router (534).

[0096] According to one embodiment, the electronic device (100) can generate a network reachability matrix based on information regarding network topology, routing information, and information regarding network access control rules.

[0097] For example, the electronic device (100) can identify routing paths between terminals A (500), B (502), C (504), D (506), E (508), F (510), G (512), H (514), I (516), and J (518) based on information regarding network topology, routing information, and information regarding network access control rules, and can confirm that all routing paths are connectable. Then, referring to FIG. 5b, the electronic device (100) can generate a network reachability matrix (550) or a list of reachability edges between terminals corresponding to the reachability analysis results of the routing paths.

[0098] According to one embodiment, the electronic device (100) can generate one or more edges by bagging and merging multiple edges based on a destination.

[0099] For example, the electronic device (100) can bag and merge reachable edges based on a destination based on a destination-based merging algorithm as follows.

[0100] [Bagging based on destination]

[0101] Bag 'A': A → A, B → A, C → A, ..., J → A

[0102] Bag 'B': A → B, B → B, C → B, ..., J → B

[0103] Bag 'C': A → C, B → C, C → C, ..., J → C

[0104] ...

[0105] Bag 'J': A → J, B → J, C → J, ..., J → J

[0106] [Merge based on destination]

[0107] Bag 'A': {A, B, C, ..., J} → {A}

[0108] Bag 'B': {A, B, C, ..., J} → {B}

[0109] Bag 'C': {A, B, C, ..., J} → {C}

[0110] ...

[0111] Bag 'J': {A, B, C, ..., J} → {J}

[0112] According to one embodiment, the electronic device (100) can generate at least one edge by bagging and merging one or more edges based on a starting point.

[0113] For example, the electronic device (100) can re-bagged and merge reachable edges based on the source as follows, based on a source-based merging algorithm.

[0114] [Bagging based on the starting point]

[0115] Bag '{A, B, C, ..., J}': {A, B, C, ..., J} → {A}, {A, B, C, ..., J} → {B}, {A, B, C, ..., J} → {C}, ..., {A, B, C, ..., J} → {J}

[0116] [Merge based on origin]

[0117] Bag '{A, B, C, ..., J}': {A, B, C, ..., J} → {A, B, C, ..., J}

[0118] According to one embodiment, the electronic device (100) can identify a fully connected edge among at least one edge. For example, the electronic device (100) can identify a reachable edge of {A, B, C, ..., J} → {A, B, C, ..., J}, where the source set and destination set are the same, as a fully connected edge.

[0119] According to one embodiment, the electronic device (100) can replace the symbol of at least one terminal included in the source set and destination set of at least one edge with a corresponding subnet symbol.

[0120] For example, the electronic device (100) may replace each of the symbols of terminal A (500), terminal B (502), terminal C (504), terminal D (506), and terminal E (508) with the subnet symbol S1 of the corresponding first switch (520), replace each of the symbols of terminal F (510), terminal G (512), and terminal H (514) with the subnet symbol S2 of the corresponding second switch (522), and replace each of the symbols of terminal I (516) and terminal J (518) with the subnet symbol S3 of the corresponding third switch (524) as follows.

[0121] {A, B, C, ..., J} → {A, B, C, ..., J} ⇒ {S1, S2, S3} → {S1, S2, S3}

[0122] According to one embodiment, the electronic device (100) can connect at least one set of origins and a set of destinations of an edge to a remote reachability node.

[0123] For example, referring to FIG. 5c, the electronic device (100) can generate terminal nodes A (560), terminal node B (562), terminal node C (564), terminal node D (566), terminal node E (568), terminal node F (570), terminal node G (572), terminal node H (574), terminal node I (576) and terminal node J (578) corresponding to terminal A (500), terminal B (502), terminal C (504), terminal D (506), terminal node E (568), terminal node F (570), terminal node G (572), terminal node H (574), terminal node I (576) and terminal node J (578), and subnet nodes S1 (580), subnet node S2 (582) and subnet node S3 (584) corresponding to subnet symbols S1, subnet symbol S2 and subnet symbol S3. Afterwards, the electronic device (100) can connect terminal node A (560), terminal node B (562), terminal node C (564), terminal node D (566) and terminal node E (568) to subnet node S1 (580) with a bidirectional arrow, connect terminal node F (570), terminal node G (572) and terminal node H (574) to subnet node S2 (582) with a bidirectional arrow, and connect terminal node I (576) and terminal node J (578) to subnet node S3 (584) with a bidirectional arrow.

[0124] Additionally, the electronic device (100) can generate a remote reachability node R1 (590) corresponding to reachability edges {S1, S2, S3} → {S1, S2, S3} and connect subnet nodes S1 (580), S2 (582), and S3 (584) to the remote reachability node R1 (590) with a bidirectional arrow.

[0125] As such, the network reachability graph generated according to one embodiment of the present invention can improve the readability of the graph by significantly reducing the cyclomatic complexity compared to the network reachability graph generated according to the prior art. For example, the complexity of the network reachability graph generated according to one embodiment of the present invention shown in FIG. 5c is 1, whereas the complexity of the network reachability graph generated based on the network reachability matrix shown in FIG. 5d is 37, and the complexity of the network reachability graph generated by the NetSPA method shown in FIG. 5e is 26.

[0126] FIGS. 6a through 6e illustrate the process of an electronic device (100) generating a network reachability graph according to an embodiment of the present disclosure. Content overlapping with FIGS. 2, 3 and 4 will be briefly described or omitted.

[0127] According to one embodiment, the electronic device (100) can obtain information regarding network topology, routing information, and network access control rules.

[0128] For example, referring to FIG. 6a, the electronic device (100) can obtain information regarding terminal A (600), terminal B (602), terminal C (604), terminal D (606), terminal E (608), terminal F (610), terminal G (612), terminal H (614), terminal I (616) and terminal J (618). Additionally, the electronic device (100) can obtain information regarding a first switch (620) to which terminal A (600), terminal B (602), terminal C (604), terminal D (606) and terminal E (608) are connected, information regarding a second switch (622) to which terminal F (610), terminal G (612) and terminal H (614) are connected, and information regarding a third switch (624) to which terminal I (616) and terminal J (618) are connected. The electronic device (100) can confirm information that the first switch (620), the second switch (622), and the third switch (624) are each connected to the network (640) through the first router (630), the second router (632), and the third router (634).

[0129] According to one embodiment, the electronic device (100) can generate a network reachability matrix based on information regarding network topology, routing information, and information regarding network access control rules.

[0130] For example, the electronic device (100) can determine routing paths between terminal A (600), terminal B (602), terminal C (604), terminal D (606), terminal E (608), terminal F (610), terminal G (612), terminal H (614), terminal I (616) and terminal J (618) based on information regarding network topology, routing information, and information regarding network access control rules, and can determine that routing paths other than the routing path from terminal A (600), terminal B (602), terminal C (604), terminal D (606), terminal E (608), terminal F (610) and terminal G (612) to terminal I (616) and terminal J (618) and the routing path from terminal H (614) to terminal J (618) are possible. Then, referring to FIG. 6b, the electronic device (100) can generate a network reachability matrix (650) or a list of reachability edges between terminals corresponding to the reachability analysis results of the routing path.

[0131] According to one embodiment, the electronic device (100) can generate one or more edges by bagging and merging multiple edges based on a destination.

[0132] For example, the electronic device (100) can bag and merge reachable edges based on a destination based on a destination-based merging algorithm as follows.

[0133] [Bagging based on destination]

[0134] Bag 'A': A → A, B → A, C → A, ..., J → A

[0135] Bag 'B': A → B, B → B, C → B, ..., J → B

[0136] Bag 'C': A → C, B → C, C → C, ..., J → C

[0137] ...

[0138] Bag 'H': A → H, B → H, C → H, ..., J → H

[0139] Bag 'I': H → I, I → I, J → I

[0140] Bag 'J': I→ J, J → J

[0141] [Merge based on destination]

[0142] Bag 'A': {A, B, C, ..., J} → {A}

[0143] Bag 'B': {A, B, C, ..., J} → {B}

[0144] Bag 'C': {A, B, C, ..., J} → {C}

[0145] ...

[0146] Bag 'H': {A, B, C, ..., J} → {H}

[0147] Bag 'I': {H, I, J} → {I}

[0148] Bag 'J': {I, J} → {J}

[0149] According to one embodiment, the electronic device (100) can generate at least one edge by bagging and merging one or more edges based on a starting point.

[0150] For example, the electronic device (100) can re-bagged and merge reachable edges based on the source as follows, based on a source-based merging algorithm.

[0151] [Bagging based on the starting point]

[0152] Bag '{A, B, C, ..., J}': {A, B, C, ..., J} → {A}, {A, B, C, ..., J} → {B}, {A, B, C, ..., J} → {C}, ..., {A, B, C, ..., J} → {H}

[0153] Bag '{H, I, J}': {H, I, J} → {I}

[0154] Bag '{I, J}': {I, J} → {J}

[0155] [Merge based on origin]

[0156] Bag '{A, B, C, ..., J}': {A, B, C, ..., J} → {A, B, C, ..., H}

[0157] Bag '{H, I, J}': {H, I, J} → {I}

[0158] Bag '{I, J}': {I, J} → {J}

[0159] According to one embodiment, the electronic device (100) can adjust the set of origins or the set of destinations of the edge when the sets of origins intersect each other based on the origin of at least one edge.

[0160] For example, as it is confirmed that the starting set ({I, J}) of the first edge ({I, J} → {J}) is included in the starting set ({H, I, J}) of the second edge ({H, I, J} → {I}) and the destination set ({I}) of the second edge is included in the starting set of the first edge ({I, J}), the electronic device (100) can substitute the destination set ({J}) of the first edge with the union ({I, J}) of the destination set ({J}) of the first edge and the destination set ({I}) of the second edge, as shown below, and substitute the starting set ({H, I, J}) of the second edge with the difference set ({H}) of the starting set ({I, J}) of the first edge with respect to the starting set ({H, I, J}) of the second edge.

[0161] {H, I, J} → {I} ⇒ {H} → {I}

[0162] {I, J} → {J} ⇒ ​​{I, J} → {I, J}

[0163] According to one embodiment, the electronic device (100) can identify a fully connected edge among at least one edge. For example, the electronic device (100) can identify a reachable edge of {I, J} → {I, J} where the source set and destination set are the same as a fully connected edge.

[0164] According to one embodiment, the electronic device (100) can replace the symbol of at least one terminal included in the source set and destination set of at least one edge with a corresponding subnet symbol.

[0165] For example, the electronic device (100) may replace each of the symbols of terminal A (600), terminal B (602), terminal C (604), terminal D (606), and terminal E (608) with the subnet symbol S1 of the corresponding first switch (620), replace each of the symbols of terminal F (610), terminal G (612), and terminal H (614) with the subnet symbol S2 of the corresponding second switch (622), and replace each of the symbols of terminal I (616) and terminal J (618) with the subnet symbol S3 of the corresponding third switch (624) as follows.

[0166] {A, B, C, ..., J} → {A, B, C, ..., H} ⇒ {S1, S2, S3} → {S1, S2}

[0167] {H} → {I}

[0168] {I, J} → {J} ⇒ ​​{S3} → {S3}

[0169] According to one embodiment, the electronic device (100) can connect at least one set of origins and a set of destinations of an edge to a remote reachability node.

[0170] For example, referring to FIG. 6c, the electronic device (100) can generate terminal nodes A (660), terminal node B (662), terminal node C (664), terminal node D (666), terminal node E (668), terminal node F (670), terminal node G (672), terminal node H (674), terminal node I (676) and terminal node J (678) corresponding to terminal A (600), terminal B (602), terminal C (604), terminal D (606), terminal node E (668), terminal node F (670), terminal node G (672), terminal node H (674), terminal node I (676) and terminal node J (678), and generate subnet nodes S1 (680), subnet node S2 (682), and subnet node S3 (684) corresponding to subnet symbols S1, subnet symbol S2, and subnet symbol S3. Afterwards, the electronic device (100) can connect terminal node A (660), terminal node B (662), terminal node C (664), terminal node D (666) and terminal node E (668) to subnet node S1 (680) with a bidirectional arrow, connect terminal node F (670), terminal node G (672) and terminal node H (674) to subnet node S2 (682) with a bidirectional arrow, and connect terminal node I (676) and terminal node J (678) to subnet node S3 (684) with a bidirectional arrow.

[0171] Additionally, the electronic device (100) can generate a remote reachable node R1 (690) corresponding to reachable edges {S1, S2, S3} → {S1, S2}, connect subnet node S1 (680) and subnet node S2 (682) to the remote reachable node R1 (690) with a bidirectional arrow, and connect subnet node S3 (684) to the remote reachable node R1 (690) with a unidirectional arrow.

[0172] Additionally, the electronic device (100) can generate a remote reachability node R2 (692) corresponding to the reachability edge {H} → {I}, and connect the terminal node H (674) and terminal node I (676) with the remote reachability node R2 (692) with a unidirectional arrow.

[0173] Meanwhile, the electronic device (100) can omit the process of creating a remote reachability node for the reachability edge {S3} → {S3} and connecting the source set and the destination set to the remote reachability node, as it confirms that the source set and the destination set of the reachability edge {S3} → {S3} contain the same subnet symbol S3.

[0174] As such, the network reachability graph generated according to one embodiment of the present invention can improve the readability of the graph by significantly reducing complexity compared to the network reachability graph generated according to the prior art. For example, the complexity of the network reachability graph generated according to one embodiment of the present invention shown in FIG. 6c is 15, whereas the complexity of the network reachability graph generated based on the network reachability matrix shown in FIG. 6d is 82, and the complexity of the network reachability graph generated by the NetSPA method shown in FIG. 6e is 26.

[0175] FIG. 7 shows a flowchart of a method for providing information of an electronic device according to one embodiment. For overlapping content, the above description may be applied.

[0176] In step S700, the electronic device can obtain information regarding the network topology, routing information, and information regarding the network's access control rules.

[0177] In step S720, the electronic device may generate a network reachability matrix that includes information regarding reachability between one or more terminals within a network, based on information regarding network topology, routing information, and information regarding network access control rules.

[0178] According to one embodiment, a network reachability matrix may include a plurality of edges having a form from a source to a destination, representing information regarding reachability between one or more terminals within a network.

[0179] According to one embodiment, when generating a network reachability matrix, multiple routing paths between one or more terminals are identified based on information regarding network topology and routing information, and multiple edges can be generated by applying network access control rules to the multiple routing paths.

[0180] According to one embodiment, when generating a plurality of edges, based on information regarding an access control rule of at least one firewall existing on a first routing path among a plurality of routing paths, whether the first routing path is reachable is determined, and if it is determined that the first routing path is reachable, a third edge corresponding to the first routing path can be generated.

[0181] In step S740, the electronic device may generate a network reachability graph based on a network reachability matrix, comprising one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals.

[0182] According to one embodiment, when an electronic device generates a network reachability graph, it can generate one or more edges having the form from a source set to a destination by merging edges having the same destination among a plurality of edges based on a network reachability matrix, and can generate at least one edge having the form from a source set to a destination set by merging edges having the same source set among one or more edges. Subsequently, the electronic device can replace the symbols of at least one terminal included in the source set and destination set of at least one edge with corresponding subnet symbols, and connect the source set and destination set of at least one edge to a remote reachability node.

[0183] According to one embodiment, when an electronic device generates at least one edge, if the set of origins of the first edge among the at least one edge is included in the set of origins of the second edge and the set of destinations of the second edge is included in the set of origins of the first edge, the set of destinations of the first edge may be replaced with the union of the set of destinations of the first edge and the set of destinations of the second edge, and the set of origins of the second edge may be replaced with the difference of the set of origins of the first edge with respect to the set of origins of the second edge.

[0184] According to one embodiment, when an electronic device generates a network reachability graph, it can identify a subnet corresponding to one or more terminals based on at least one of the IP (internet protocol) address, network mask, and gateway address of one or more terminals.

[0185] According to one embodiment, when an electronic device generates a network reachability graph, it can identify a fully connected edge in which the source set and the destination set are the same among at least one edge.

[0186] According to one embodiment, the electronic device may omit the step of connecting a source set and a destination set of at least one edge to a remote reachability node with respect to a third edge in which the source set and the destination set of at least one edge include the same subnet symbol.

[0187] In step S760, the electronic device can provide information regarding the network reachability graph.

[0188] FIG. 8 shows a block diagram of an electronic device (100) according to one embodiment.

[0189] According to one embodiment, the electronic device (100) may include a memory (820) and a processor (controller) (840). The electronic device (100) illustrated in FIG. 8 is illustrated only with components related to the present embodiment. Therefore, it can be understood by those skilled in the art related to the present embodiment that other general components may be included in addition to those illustrated in FIG. 8. For example, the electronic device (100) may include a communication device (not illustrated) comprising one or more transceivers. The communication device is a device for performing wired / wireless communication and can communicate with an external electronic device. The external electronic device may be a terminal or a server. In addition, communication technologies used by the communication department may include GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), LTE (Long Term Evolution), 5G, WLAN (Wireless LAN), Wi-Fi (Wireless-Fidelity), Bluetooth, RFID (Radio Frequency Identification), Infrared Data Association (IrDA), ZigBee, NFC (Near Field Communication), etc.

[0190] The processor (840) can control the overall operation of the electronic device (100) and process data and signals. The processor (840) may be composed of at least one hardware unit. Additionally, the processor (840) may be operated by one or more software modules generated by executing program code stored in memory (820). The processor (840) may include a processor and memory, and the processor can control the overall operation of the electronic device (100) and process data and signals by executing program code stored in memory. Additionally, in the embodiment, the processor (840) may include at least one processor.

[0191] The processor (840) obtains information regarding network topology, routing information, and network access control rules, and based on the information regarding network topology, routing information, and network access control rules, generates a network reachability matrix including information regarding reachability between one or more terminals within the network, and based on the network reachability matrix, generates a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals, and can provide information regarding the network reachability graph.

[0192] The electronic device according to the embodiments described above may include a processor, memory for storing and executing program data, permanent storage such as a disk drive, a communication port for communicating with an external device, and user interface devices such as a touch panel, a key, a button, etc. Methods implemented as software modules or algorithms may be stored on a computer-readable recording medium as computer-readable code or program instructions executable on the processor. Here, computer-readable recording media include magnetic storage media (e.g., ROM (read-only memory), RAM (random-access memory), floppy disks, hard disks, etc.) and optical reading media (e.g., CD-ROM, DVD (Digital Versatile Disc)). The computer-readable recording medium may be distributed across networked computer systems, allowing computer-readable code to be stored and executed in a distributed manner. The medium is computer-readable, stored in memory, and can be executed on a processor.

[0193] The present embodiment may be represented by functional block configurations and various processing steps. These functional blocks may be implemented by various numbers of hardware and / or software configurations that execute specific functions. For example, the embodiment may employ integrated circuit configurations such as memory, processing, logic, look-up tables, etc., capable of executing various functions by the control of one or more microprocessors or other control devices. Similar to how components may be implemented as software programming or software elements, the present embodiment may be implemented in programming or scripting languages ​​such as C, C++, Java, assembler, etc., including various algorithms implemented as combinations of data structures, processes, routines, or other programming configurations. Functional aspects may be implemented as algorithms executed on one or more processors. Additionally, the present embodiment may employ prior art for electronic configuration, signal processing, and / or data processing. Terms such as "mechanism," "element," "means," and "configuration" may be used broadly and are not limited to mechanical and physical configurations. The above terms may include the meaning of a series of software processes (routines) in conjunction with processors, etc.

[0194] The aforementioned embodiments are merely examples, and other embodiments may be implemented within the scope of the claims set forth below.

Claims

Claim 1 A method for providing information of an electronic device comprises: a step of obtaining information regarding network topology, routing information, and information regarding network access control rules; a step of generating a network reachability matrix including information regarding reachability between one or more terminals within the network based on the information regarding network topology, the routing information, and the information regarding network access control rules; and a step of generating a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals based on the network reachability matrix. A method for providing information, comprising the step of providing information regarding the network reachability graph, wherein the network reachability matrix comprises a plurality of edges having a form from a source to a destination, representing information regarding reachability between one or more terminals within the network, and the step of generating the network reachability graph comprises: generating one or more edges having a form from a source set to a destination by merging edges having the same destination among the plurality of edges based on the network reachability matrix; generating at least one edge having a form from a source set to a destination set by merging edges having the same source set among the one or more edges; replacing the symbol of at least one terminal included in the source set and destination set of the at least one edge with a corresponding subnet symbol; and connecting the source set and destination set of the at least one edge to a remote reachability node. Claim 2 delete Claim 3 delete Claim 4 A method for providing information according to claim 1, wherein the step of generating at least one edge comprises, when the set of origins of the first edge among the at least one edge is included in the set of origins of the second edge and the set of destinations of the second edge is included in the set of origins of the first edge, replacing the set of destinations of the first edge with the union of the set of destinations of the first edge and the set of destinations of the second edge, and replacing the set of origins of the second edge with the difference of the set of origins of the first edge with respect to the set of origins of the second edge. Claim 5 A method for providing information according to claim 1, wherein the step of generating the network reachability graph further comprises the step of identifying a subnet corresponding to one or more terminals based on at least one of the IP (internet protocol) address, network mask, and gateway address of one or more terminals. Claim 6 A method for providing information according to claim 1, wherein the step of generating the network reachability graph further includes the step of identifying a fully connected edge among the at least one edge in which the source set and the destination set are the same. Claim 7 A method for providing information according to claim 1, wherein the step of connecting the source set and destination set of at least one edge to a remote reachability node is omitted with respect to a third edge in which the source set and destination set of the at least one edge include the same subnet symbol. Claim 8 A method for providing information according to claim 1, wherein the step of generating the network reachability matrix comprises: a step of identifying a plurality of routing paths between one or more terminals based on information regarding the network topology and the routing information; and a step of generating the plurality of edges by applying access control rules of the network to the plurality of routing paths. Claim 9 In claim 8, the step of generating the plurality of edges comprises: a step of determining whether the first routing path is reachable based on information regarding an access control rule of at least one firewall existing on the first routing path among the plurality of routing paths; and a step of generating a third edge corresponding to the first routing path if it is determined that the first routing path is reachable. Claim 10 As an electronic device, memory; The system includes a controller, wherein the controller obtains information regarding network topology, routing information, and information regarding network access control rules, and generates a network reachability matrix including information regarding reachability between one or more terminals within the network based on the information regarding network topology, the routing information, and the information regarding network access control rules, and generates a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals based on the network reachability matrix, and provides information regarding the network reachability graph, wherein the network reachability matrix includes a plurality of edges having a form from a source to a destination representing information regarding reachability between one or more terminals within the network, and when generating the network reachability graph, the controller generates one or more edges having a form from a source set to a destination by merging edges having the same destination among the plurality of edges based on the network reachability matrix, and among the one or more edges having the same source set An electronic device that generates at least one edge having a form from a source set to a destination set by merging edges, replaces the symbols of at least one terminal included in the source set and destination set of the at least one edge with corresponding subnet symbols, and connects the source set and destination set of the at least one edge to a remote reachable node. Claim 11 A computer-readable, non-transient recording medium having a program for executing a method of providing information of an electronic device on a computer, wherein the method of providing information comprises: a step of obtaining information regarding network topology, routing information, and information regarding network access control rules; a step of generating a network reachability matrix including information regarding reachability between one or more terminals within the network based on the information regarding network topology, the routing information, and the information regarding network access control rules; and a step of generating a network reachability graph including one or more subnet nodes, one or more remote reachability nodes, and one or more terminal nodes corresponding to one or more terminals based on the network reachability matrix. A non-transient recording medium comprising: a step of providing information regarding the network reachability graph; wherein the network reachability matrix comprises a plurality of edges having a form from a source to a destination, representing information regarding reachability between one or more terminals within the network; and the step of generating the network reachability graph comprises: a step of generating one or more edges having a form from a source set to a destination by merging edges having the same destination among the plurality of edges based on the network reachability matrix; a step of generating at least one edge having a form from a source set to a destination set by merging edges having the same source set among the one or more edges; a step of replacing the symbol of at least one terminal included in the source set and destination set of the at least one edge with a corresponding subnet symbol; and a step of connecting the source set and destination set of the at least one edge to a remote reachability node.

Images