Data security system in network separation environment and method for implementing same

Abstract

A data security system in a network separation environment according to the present invention may comprise: a message queue located between an external network and an internal network and operating as a server to communicate with a client terminal via a web server of the external network; a processor that operates as a client in the internal network to transmit and receive data between the message queue and a database server; and a database server located in the internal network, where data is stored, that reads out data and provides the data to the processor upon a request from the processor.

Description

Data security system in a network separation environment and its implementation method

[0001] The present invention relates to a data security system in a network separation environment and a method for executing the same, and more specifically, to a data security system in a network separation environment and a method for executing the same, which prevents data from a database server in an internal network from being leaked to an external network by allowing a message queue to operate as a server between an external network and an internal network in the network separation environment and allowing a processor in the internal network to operate as a client.

[0002] Network segmentation refers to separating internal and external networks to prevent external intrusions and internal information leaks. This network segmentation method can be divided into direct and indirect methods.

[0003] Direct linking is a two-way data communication method where a server responds to service or data requests. Direct linking involves directly requesting an unspecified SQL query from the Internet to a defense network server to obtain the desired result, or directly calling a web service (entering a URL) on port 80 and obtaining the result.

[0004] Indirect linking is a one-way communication method that uses file transfers and then terminates. Logs generated on an Internet server are transmitted to the defense network server without a response. Requests and responses are programmed as APIs, allowing only the data agreed upon between the two parties to be transmitted and received. Furthermore, in two-way communication systems, responses that are "yes / no" signals, such as health checks, fall under the indirect linking method.

[0005] Comparing the pros and cons of direct and indirect linking, direct linking uses existing protocols to transmit data, while indirect linking generates and transmits data in file units. In terms of security, direct linking presents protocol vulnerabilities, while indirect linking, due to protocol changes, has no known vulnerabilities.

[0006] In terms of sessions, the direct connection method consists of internal / external separate TCP / IP sessions, but the entire section is connected as one L7 session, whereas the indirect connection method consists of internal / brain separate TCP / IP sessions, and there is no L7 session.

[0007] In terms of transmission performance, direct linking allows for real-time data transmission (such as CCTV footage), while indirect linking does not (except for some links). In terms of malware detection, direct linking complicates real-time monitoring, while indirect linking requires application customization in addition to the cost of building a data exchange system.

[0008] Accordingly, tasks utilizing the network interconnection system can only be operated through indirect linking. While network separation projects have been actively pursued recently, direct linking requires the server to communicate data bidirectionally in response to data requests. Therefore, even with network separation, the actual application's existing protocols and communication methods remain unchanged.

[0009] Therefore, vulnerabilities inherent in existing protocols also exist in network-separated environments. Furthermore, protocol analysis alone makes it difficult to accurately identify data leaks. Furthermore, blocking data transmission requests from existing protocols can cause program failures, and implementing filtering functions for external data, such as malware detection, becomes difficult.

[0010] Therefore, there is a need to develop an indirect linkage device and method with improved security, such as preventing the database server information of an internal network in a network separation environment from being exposed to an external network.

[0011] Korean Patent Publication No. 10-2019-0101608 relates to a method and system for protecting data using a self-identification ID in a network-based network separation environment. The method breaks away from the conventional VPN-style constant tunnel perspective in a network separation environment between a business network and an external network, and discloses that each packet is assigned a self-identification ID at a security gateway, encrypted, and transmitted to the receiving side, and that the receiving side's security gateway verifies and decrypts the self-identification ID and key to maintain stable data security and transmission to the receiving host. However, the method for solving the above-mentioned problem is not disclosed.

[0012] The present invention aims to provide a data security system and an execution method thereof in a network separation environment, which prevents data from a database server in an internal network from leaking to an external network by allowing a message queue to operate as a server between an external network and an internal network in the network separation environment and allowing a processor in the internal network to operate as a client.

[0013] In addition, the present invention aims to provide a data security system and a method for executing the same in a network separation environment in which access from clients can be restricted and security can be strengthened, since the server is responsible for accessing and processing resources of an internal network.

[0014] A data security system in a network separation environment for achieving this purpose may include a message queue located between an external network and an internal network and operating as a server to communicate with a client terminal via a web server of the external network, a processor operating as a client in the internal network to transmit and receive data between the message queue and a database server, and a database server located in the internal network where data is stored and which reads out data and provides it to the processor upon request of the processor.

[0015] In one embodiment, the message queue may receive a data request message from a client terminal via a web server of the external network and provide the data to the processor, and may receive data corresponding to the data request message from the processor and provide the data to the client terminal via the web server of the external network.

[0016] In one embodiment, the processor may receive a data request message from the message queue, provide the data to a database server, and read data corresponding to the data request message from the database server and provide the data to the message queue.

[0017] In one embodiment, the message queue can check at specific time intervals whether a data request message received from a client terminal exists in the web server of the external network.

[0018] In addition, a method for securing data in a network separation environment may include a step in which a message queue located between an external network and an internal network operates as a server and communicates with a client terminal through a web server of the external network, a step in which a processor operates as a client in the internal network and transmits and receives data between the message queue and a database server, and a step in which a database server located in the internal network stores data and reads out data at the request of the processor and provides the data to the processor.

[0019] In one embodiment, the step of allowing a message queue located between the external network and the internal network to operate as a server and communicate with a client terminal via a web server of the external network may include a step of allowing the message queue to receive a data request message from the client terminal via the web server of the external network and provide the data to a processor, and a step of allowing the message queue to receive data corresponding to the data request message from the processor and provide the data to the client terminal via the web server of the external network.

[0020] In one embodiment, the step of the processor operating as a client in the internal network to transmit and receive data between the message queue and the database server may include the step of the processor receiving a data request message from the message queue and providing the data to the database server, and the step of the processor reading data corresponding to the data request message from the database server and providing the data to the message queue.

[0021] In one embodiment, a method for securing data in a network separation environment may include a step of checking at specific time intervals whether a data request message received from a client terminal exists in the message queue of the external network's web server.

[0022] According to the present invention as described above, there is an advantage in that data from a database server in the internal network is prevented from leaking to the external network by allowing a message queue to operate as a server between an external network and an internal network in a network separation environment and allowing a processor in the internal network to operate as a client.

[0023] Additionally, according to the present invention, since the server is responsible for accessing and processing resources of the internal network, there is an advantage in that access from clients can be restricted and security can be strengthened.

[0024] Figure 1 is a network configuration diagram for explaining a data transmission and reception system in a conventional network separation environment.

[0025] Figure 2 is a network configuration diagram for explaining another embodiment of a data transmission and reception system in a conventional network separation environment.

[0026] FIG. 3 is a diagram for explaining a data security system in a network separation environment according to one embodiment of the present invention.

[0027] Figure 4 is a flowchart illustrating one embodiment of a data security method in a network separation environment according to the present invention.

[0028]

[0029] <Explanation of symbols>

[0030] 10: External network

[0031] 11: Client terminal

[0032] 12: Web Server

[0033] 20: Internal network

[0034] 21: WAS Server

[0035] 22: Database

[0036] 30: Network connection device

[0037] The above-described objects, features, and advantages will be described in detail below with reference to the accompanying drawings, so that those skilled in the art can easily practice the technical idea of ​​the present invention. In describing the present invention, if it is determined that a detailed description of known technologies related to the present invention may unnecessarily obscure the gist of the present invention, a detailed description thereof will be omitted. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to indicate the same or similar components.

[0038]

[0039] The “external network” used herein may include an Internet-connected PC capable of accessing the Internet. The external Internet may be implemented as any type of wired / wireless network, such as a Local Area Network (LAN), a Wide Area Network (WAN), a Value Added Network (VAN), a Personal Area Network (PAN), a mobile radio communication network, Wibro (Wireless Broadband Internet), Mobile WiMAX, HSDPA (High Speed ​​Downlink Packet Access), or a satellite communication network.

[0040]

[0041] Figure 1 is a network configuration diagram for explaining one embodiment of a data transmission and reception system in a conventional network separation environment.

[0042] Referring to Figure 1, in a network separation environment, a data transmission and reception system can be configured with an external network (10) and an internal network (20) separated.

[0043] An external network (10) is a communication network accessible not only by internal members of a specific institution or organization but also by other users, and may be, for example, the Internet. The external network (10) may also be configured to include various network devices and communication means.

[0044] That is, a client terminal (11) and a web server (12) used by a user who wishes to view data of an internal network (20) are deployed in an external network (10), and a WAS server (21) and a database (22) are deployed in an internal network (20).

[0045] A user accesses a web server (12) using a client terminal (11) and provides a data request message via the Internet. Accordingly, when the WAS server (21) of the internal network (20) receives a data request message from the web server (12), it can extract data corresponding to the query request message from the database (22) and provide it to the client terminal (11) via the web server (12) of the external network (10).

[0046] Such a client terminal (11) may be a PC that has viewed the data to be transmitted, or may be a PC that has requested the transmission of a file. In this case, the user may include a user who has requested the transmission of data or an administrator for the client terminal (11).

[0047] An internal network (20) is a communication network used only within a specific institution or organization and may be configured to include one or more physical network devices. The internal network (20) may be equipped with a WAS server (21) and a database (22).

[0048] When the WAS server (21) receives a data request message from the web server (12), it can extract data corresponding to the query request message from the database (22) and provide it to the client terminal (11) through the web server (12) of the external network (10).

[0049] As described above, in a network-separated environment without a network link, data transmission and reception between the external and internal networks occurs through indirect routes, ensuring data safety and security. However, the presence of a network link increases the efficiency and security of data exchange, and therefore its use is generally recommended in network-separated environments. Below, with reference to Figure 2, another embodiment of a data transmission and reception system in a conventional network-separated environment will be described.

[0050]

[0051] Figure 2 is a network configuration diagram for explaining another embodiment of a data transmission and reception system in a conventional network separation environment.

[0052] Referring to Fig. 2, in a network separation environment, a data transmission and reception system can be configured with an external network (10) and an internal network (20) separated.

[0053] An external network (10) is a communication network accessible not only by internal members of a specific institution or organization but also by other users, and may be, for example, the Internet. The external network (10) may also be configured to include various network devices and communication means.

[0054] That is, a client terminal (11) and a WAS server (21) used by a user who wishes to inquire about data of an internal network (20) are placed in an external network (10), a network link device (30) that selectively relays data exchange between the internal network (20) and the external network (10) is placed between the internal network (20) and the external network (10), and a database (22) is placed in the internal network (20).

[0055] Between the internal network (20) and the external network (10), a network link device (30) is placed to selectively relay data exchange between the internal network (20) and the external network (10). This network link device (30) operates as a server on the internal network (20) side and as a client on the external network (10) side.

[0056] First, the process by which the network connection device (30) operates as a server on the internal network (20) side will be explained. That is, the network connection device (30) acts as a server that accepts requests from the external network (10), retrieves necessary data from the internal network (20), and provides it to the external network (10).

[0057] The network connection device (30) waits for a request from an external network (10). If a user accesses a web server (12) using a client terminal (11) and provides a data request message to the network connection device (30) via the Internet, the network connection device (30) receives the data request message from the web server (12) of the external network (10).

[0058] Then, when the network connection device (30) receives a data request message from a web server (12) of an external network (10), it provides the data request message to the WAS server (21) of the internal network (20).

[0059] Accordingly, when the network connection device (30) receives data corresponding to a data request message from the WAS server (21) of the internal network (20), it can provide the data corresponding to the data request message to the client terminal (11) via the web server (12) of the external network (10).

[0060] As described above, the network device (30) can generate a response to a request from an external network (10) and transmit it to the external network (10).

[0061] In addition, the network connection device (30) will be described as a process in which it operates as a client on the external network (10). That is, the network connection device (30) acts as a client that requests data transmission to the WAS server (21) in the internal network (20) and then receives data from the WAS server (21).

[0062] When a user accesses a web server (12) using a client terminal (11) and provides a data request message to a network device (30) via the Internet, the network device (30) receives the data request message from a web server (12) of an external network (10).

[0063] Then, when the network connection device (30) receives a data request message from the web server (12) of the external network (10), it provides the data request message to the WAS server (21). That is, the data request message of the external network (10) is transmitted to the internal network (20) through the network connection device (30).

[0064] The network connection device (30) waits for a response to a data request message from the internal network (20). The response to the data request message is provided to the network connection device (30) from the WAS server (21) of the internal network (20) and is provided to the external network (10) via the network connection device (30).

[0065] As described above, the network connection device (30) can provide a response received from the internal network (20) to the client terminal (11) of the external network (10).

[0066] As in commercial environments, this process allows network-connected devices to ensure safe and efficient communication between internal and external networks in a network-separated environment. This ensures seamless connectivity with external networks while maintaining data safety and security.

[0067] However, a security problem may arise when the network connection device (30) operates as a server on the internal network side and as a client on the external network side.

[0068] First, when the network connection device (30) operates as a server on the internal network (20), it is important to protect the internal network from attacks from the external network (10). However, since the network connection device (30) operates as a server on the internal network (20), it may become a target of attacks on the internal network (20).

[0069] In addition, when the network connection device (30) operates as a client on the external network (10), an attacker on the external network (10) who can perform an attack on the internal network (20) may attempt to invade the internal network through the network connection device (30).

[0070] In addition, since the network connection device (30) acts as an intermediary between the internal network (20) and the external network (10), a security flaw may exist in the network connection device (30) itself. This flaw may be used by an attacker to invade the internal network using the network connection device (30).

[0071] Additionally, since the network connection device (30) relays data between the external network and the internal network, there is a risk of unauthorized access to internal data from the outside. This can occur if the network connection device is not protected.

[0072] Additionally, since the network connection device (30) relays data between the external network (10) and the internal network (20), there is a risk of unauthorized access to internal data from the outside. This can occur if the network connection device is not protected.

[0073]

[0074] FIG. 3 is a diagram for explaining a data security system in a network separation environment according to one embodiment of the present invention.

[0075] Referring to FIG. 3, in a network separation environment, a data security system can be configured with an external network (100) and an internal network (200) separated.

[0076] An external network (100) is a communication network accessible not only by internal members of a specific institution or organization but also by other users, and may be, for example, the Internet. The external network (100) may also be configured to include various network devices and communication means.

[0077] That is, a client terminal (110) and a web server (120) used by a user who wishes to view data of an internal network (200) are placed in an external network (100), a message queue (300) that selectively relays data exchange between the external network (100) and the internal network (200) is placed between the external network (100) and the internal network (200), and a processor (210) and a database (220) are placed in the internal network (200).

[0078] A user connects to a web server (120) using a client terminal (110) and provides a data request message via the Internet. Accordingly, when the message queue (300) of the internal network (200) receives a data request message from the web server (120), it can extract data corresponding to the query request message from the database (220) and provide it to the client terminal (110) via the web server (120) of the external network (100).

[0079] Such a client terminal (110) may be a PC that has viewed the data to be transmitted, or may be a PC that has requested the transmission of a file. In this case, the user may include a user who has requested the transmission of data or an administrator for the client terminal (110).

[0080] The web server (120) receives and stores a data request message received from a client terminal (110). The data request message stored in the web server (120) can be monitored and processed at specific time intervals by the message queue (300).

[0081] A message queue (300) is placed between the internal network (200) and the external network (100) to selectively relay data exchange between the internal network (200) and the external network (100). The message queue (300) operates as a server and communicates with a client terminal (110) via a web server (120) of the external network (100).

[0082] The message queue (300) checks at specific time intervals whether a data request message received from a client terminal (110) exists in the web server (120) of the external network (100).

[0083] If there is a data request message received from a client terminal (110) in the web server (120) of the external network (100), the message queue (300) provides the data request message to the processor (210).

[0084] After that, the message queue (300) can receive data corresponding to the data request message from the processor (210) and provide it to the client terminal (110) through the web server (120) of the external network (100).

[0085] The processor (210) operates as a client in the internal network (200) and transmits and receives data between the message queue (300) and the database (220).

[0086] That is, when the processor (210) receives a data request message from the message queue (300), it provides it to the database (220), and can read out data corresponding to the data request message from the database (220) and provide it to the message queue (300).

[0087]

[0088] Figure 4 is a flowchart illustrating one embodiment of a data security method in a network separation environment of the present invention.

[0089] Referring to FIG. 4, a client terminal (110) located in an external network (100) provides a data request message to a web server (120) located in the external network (100) (step S410). The web server (120) located in the external network (100) stores the data request message received from the client terminal (110) (step S415).

[0090] A message queue (300) located between an external network (100) and an internal network (200) and operating as a server monitors whether a data request message has been received by the web server (120) at specific time intervals (step S420).

[0091] When a data request message is received from the web server (120), the message queue (300) provides the data request message to a processor (210) located in the internal network (200) and operating as a client (step S425).

[0092] A processor (210) located in the internal network (200) and operating as a client reads data corresponding to a data request message from a database (220) (step S430).

[0093] A processor (210) located in an internal network (200) and operating as a client provides data corresponding to a data request message to a message queue (300) (step S435a). Accordingly, the message queue (300) can provide data corresponding to the data request message to a client terminal (110) via a web server (120) (steps S435b and S435c).

[0094] As described above, the present invention prevents data from a database server in an internal network from leaking to an external network by allowing a message queue to operate as a server between an external network and an internal network in a network separation environment and allowing a processor in an internal network to operate as a client.

[0095]

[0096] Although the present invention has been described with reference to the above-described embodiments and drawings, it is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications and variations are possible based on this disclosure. Therefore, the scope of the present invention should be understood solely by the scope of the claims set forth below, and all equivalent or equivalent modifications thereof are deemed to fall within the scope of the present invention.

[0097] The present invention prevents data from a database server in an internal network from leaking to an external network by allowing a message queue to operate as a server between an external network and an internal network in a network separation environment and allowing a processor in the internal network to operate as a client. The present invention is a technology that can be widely used in the big data industry to realize its practical and economic value.

Claims

1. A message queue that operates as a server located between the external network and the internal network and communicates with client terminals through the web server of the external network; A processor that operates as a client in the internal network and transmits and receives data between the message queue and the database server; and It is characterized by including a database server located in the internal network and storing data, and reading out data and providing it to the processor upon request of the processor. Data security system in a network separation environment.

2. In paragraph 1, The above message queue is It is characterized in that it receives a data request message from a client terminal through a web server of the external network and provides it to a processor, and receives data corresponding to the data request message from the processor and provides it to the client terminal through a web server of the external network. Data security system in a network separation environment.

3. In paragraph 1, The above processor When a data request message is received from the message queue, it is provided to a database server, and data corresponding to the data request message is read from the database server and provided to the message queue. Data security system in a network separation environment.

4. In paragraph 1, The above message queue is It is characterized in that it checks at specific time intervals whether there is a data request message received from a client terminal in the web server of the external network. Data security system in a network separation environment.

5. A step in which a message queue located between an external network and an internal network operates as a server and communicates with a client terminal through a web server of the external network; A step in which the processor operates as a client in the internal network to transmit and receive data between the message queue and the database server; and A method characterized in that it includes a step of storing data on a database server located in the internal network and reading out data according to a request from the processor and providing the data to the processor. Data security methods in network separation environments.

6. In paragraph 5, The step of the message queue located between the external network and the internal network operating as a server and communicating with the client terminal through the web server of the external network A step in which the message queue receives a data request message from a client terminal through a web server of the external network and provides the data request message to the processor; and The above message queue is characterized by including a step of receiving data corresponding to a data request message from the processor and providing it to a client terminal through a web server of an external network. Data security methods in network separation environments.

7. In paragraph 5, The step of the above processor operating as a client in the internal network to transmit and receive data between the message queue and the database server A step of providing a data request message to a database server when the processor receives the data request message from the message queue; and The above processor is characterized by including a step of reading data corresponding to the data request message from the database server and providing the data to the message queue. Data security methods in network separation environments.

8. In paragraph 5, The above message queue is characterized in that it includes a step of checking at a specific time interval whether a data request message received from a client terminal exists in the web server of the external network. Data security methods in network separation environments.

Images