CN1705262A - Network security protecting system and method - Google Patents

Abstract

A network security protection system and method, wherein the protection system includes: an authentication server, used for network access authentication, and determining whether a user can access the network according to an authentication result containing security information; a security policy server, used for configuring security policy and issue a security policy, and judge whether the user is a secure user or a non-secure user, and send the judgment result to the authentication server; the broadband access server is used for user network access, receives the security policy and according to the The security policy described above monitors the messages of the users accessing the network, and sends the monitoring information to the security policy server to determine the security of the users, and the broadband access server according to the judgment result from the authentication server or authentication The security information in the result denies access to the network for non-secure users. Correspondingly, the invention also discloses a network security protection method.

Description

Network security protection system and method

technical field

The invention relates to security technology in the field of computer or communication, in particular to a network security protection system and method.

Background technique

With the popularization and deepening of computer networks, especially the Internet (INTERNET) in the world, the vigorous promotion and application of enterprise networks in securities departments, banking systems, enterprises and institutions has made more and more people contact and use the Internet. Trade activities can be carried out through the network, and mail transmission can also be carried out, but at the same time, the number of viruses is also rapidly doubling along with the network, and many viruses that are almost extinct also occur from time to time. It's super fast. While vigorously developing the network, viruses have also been greatly developed. Some viruses in the network are benign, do not do any damage, and only affect the normal operation of the system, but more viruses are vicious and will break out. Corrupting databases and more. Therefore, when there is a virus, it must be treated as soon as possible, especially for the network. Its destructiveness to the network is far greater than that of a stand-alone user, not to mention the loss.

In addition, there are more and more network attacks on the network, which have a great impact on broadband access servers. Often, an attack by one user will cause other users in the same area to be unable to access the network normally, which will bring great harm to telecom operators. troubled.

The existing method of killing viruses is still to download patches and antivirus software. However, there are thousands of machines in a broadband metropolitan area network. As long as one machine is not antivirus and patched in time, it will affect the entire network, and even cause the entire network to fail. The network is repeatedly poisoned.

Therefore, generally speaking, the existing methods do not solve the problem of network virus isolation and repeated infection well, and users need to frequently update antivirus software and system patches, which increases the complexity of user operations.

Contents of the invention

The problem solved by the present invention is to provide a network security protection system and method to avoid repeated infection caused by network viruses.

In order to solve the above problems, the network security protection system of the present invention includes: an authentication server, used for network access authentication, and determining whether a user can access the network according to the authentication result containing security information; a security policy server, used for configuring security policies and downloading Send a security policy, and judge whether the user is a safe user or a non-safe user, and send the judgment result to the authentication server; the broadband access server is used for user network access, receives the security policy and according to the security The policy monitors the messages of the users accessing the network, and sends the monitoring information to the security policy server to judge the security of the users, and the broadband access server according to the judgment result from the authentication server or the authentication result The security information denies non-secure users access to the network.

The authentication server has a security attribute indicating whether the user is safe; and the broadband access server has a user security attribute indicating whether the user is safe. The security attribute value of the authentication server is set according to the security judgment result of the security policy server, and the current security attribute value is sent to the broadband access server; the user security attribute value of the broadband access server is based on the received The security attribute value sets the user security attribute value and rejects the non-secure user from accessing the network according to the user security attribute value.

The security policy includes: a check item, used to indicate the content to be checked by the broadband access server; a trigger condition, used to indicate the trigger condition; and an operation, used to indicate that the broadband access server performs a specific operation when the trigger condition is met. The operation refers to that the broadband access server monitors the user's message and copies the corresponding message as monitoring information to the security policy server when the trigger condition is met, and the security policy server judges the security of the user according to the message.

The system also includes a portal server for isolating non-secure users, and the broadband access server controls non-secure users to access the portal server.

Correspondingly, the network security protection method of the present invention includes the following steps: a security policy configuration step, the security policy server issues a security policy to the broadband access server; an authentication step, checking whether the user is safe during authentication, and returning the user's ID to the broadband access server The authentication result of the security information; the monitoring step, according to the authentication result, monitor the message of the user accessing the network according to the security policy, and feed back the monitoring information to the security policy server; the judging step, the security policy server judges the user according to the monitoring information Security, and pass the judgment result through the authentication server; processing step, the authentication server sends the judgment result to the broadband access server, and the broadband server rejects the non-secure user to access the network according to the judgment result.

The security policy includes: a check item, used to indicate the content to be checked by the broadband access server; a trigger condition, used to indicate the trigger condition; and an operation, used to indicate that the broadband access server performs a specific operation when the trigger condition is met. The monitoring information refers to the message of the user monitored by the broadband access server when the trigger condition is met, and the operation refers to copying the message to the security policy server.

The authentication server has a security attribute used to indicate whether the user is safe; and the broadband access server has a user security attribute used to indicate whether the user is safe. The authentication step further includes: the broadband access server sends an authentication request to the authentication server; the authentication server performs authentication and reads the security attribute value of the user; and feeds back the authentication result including the security attribute value to the broadband access server.

The access step further includes the following steps: the broadband access server judges whether to pass the authentication according to the authentication result; if the authentication is passed, then set the user security attribute according to the security attribute value in the authentication result; judge whether the user is safe according to the user security attribute value; If it is not safe, deny access to the network, if it is safe to access the network and perform monitoring steps at the same time.

The monitoring step further includes: the broadband access server monitors the user's message according to the security policy; when the trigger condition is met, copy the corresponding message as monitoring information to the security policy server.

The processing step further includes: the authentication server sets the security attribute value according to the security judgment result of the security policy server, and sends the current security attribute value to the broadband access server; the broadband access server sets the user security attribute value according to the received security attribute value. security attribute value and refuse non-secure users to access the network; non-secure users are forced to visit the portal server; The user who has killed the virus performs a security assessment, and if it is safe, the authentication server is notified to set the user's security attribute as safe; the authentication server modifies the user's security attribute as safe and sends it to the broadband access server; the broadband access server modifies the user's security attribute Be safe and go to the monitoring step.

Compared with the prior art, the present invention has the following advantages:

The security policy is issued through the security policy server, and then resource checks are carried out on the BAS to monitor. It is easy to determine whether the user is poisoned or has a network attack. Since it is convenient and flexible to update the security policy through the security policy server, it is safe for new viruses and new network attacks. The means can respond in a timely manner;

Divide users into secure users and non-secure users. Secure users have no restrictions on accessing the Internet, while non-secure users can only access the portal server, thereby preventing non-secure users from infecting secure users;

The security policy on the security policy server can be completed in cooperation with anti-virus vendors to prevent hackers, so it can ensure that the security policy is updated quickly and timely;

For users, there is no need to always pay attention to the latest patches and virus information, which reduces the requirements for users' virus knowledge and reduces the risk of users being infected by viruses;

For operators, this invention can effectively solve the waste of system resources caused by viruses and network attacks. For virus problems, it can quickly identify poisoned users and isolate them to prevent poisoned users from further infecting other normal users. Virus tools are charged to obtain new profit growth points; for hacker problems, hacker attacks can be discovered in time, so that the next step can be processed;

For anti-virus manufacturers to prevent and control hackers, they can charge for providing the latest virus information and anti-virus tools, so as to achieve a win-win effect.

Description of drawings

Fig. 1 is a block diagram of the network security protection system of the present invention.

Fig. 2 is a schematic diagram of an embodiment of setting security attributes of an authentication server.

Fig. 3 is a flowchart of security policy configuration steps in the network security protection method of the present invention.

Fig. 4 is a flowchart of authentication and monitoring steps in the network security protection method of the present invention.

Fig. 5 is a flow chart of judging steps in the network security protection method of the present invention.

Fig. 6 is a flowchart of processing steps in the network security protection method of the present invention.

Fig. 7 is a flow chart of non-secure user processing in the network security protection method of the present invention.

Detailed ways

The network security protection system and method of the present invention are implemented based on the existing network system, and the existing network system generally includes:

Broadband Access Server (BAS, Broadband Access Server): It mainly completes user access, usually with access methods such as xDSL//LAN/HFC (x digital subscriber line/local area network/optical fiber/coaxial hybrid network).

Authentication server: AAA is the abbreviation of Authentication, Authorization and Accounting (Authentication, Authorization and Accounting), which provides a consistent framework for configuring the three security functions of authentication, authorization and accounting. And AAA usually uses Remote Authentication Dial-In User Service Protocol (Radius, Remote Authentication Dial-In User Service) to complete. The authentication server is a PC or network device that implements the Radius protocol. It cooperates with the broadband access server to complete user authentication, authorization, and billing.

Portal server: Portal service is a new type of service provided by ISP to users, so that users can flexibly choose their own business by accessing the portal server, or provide related network resources (such as HTTP connection, FTP download, etc.) .

The relationship between the broadband access server and other servers is described in detail as follows.

Broadband access server and authentication server: When a user wants to obtain the right to access other networks (or obtain the right to use certain network resources) by establishing a connection with the broadband access server, the broadband access server plays a role in checking the user (or this connection). The broadband access server is responsible for transmitting the user's verification, authorization, and accounting information to the authentication server. After receiving the authentication request from the user, the authentication server completes the authentication, and returns the configuration information required for delivery to the user to the broadband access server. The broadband access server determines whether the user can access and what resources can be accessed according to the result returned by the authentication server.

Broadband access server and portal server: At present, the portal server mainly completes two functions. The first one is that after the user is authenticated, the portal server provides a webpage, and the user can access the webpage provided by the ISP (Internet Service Provider, Internet Service Provider) on the webpage. services, such as VOD (Video On Demand, video on demand), games, software downloads, etc.; the other is that the user visits the portal server page before the authentication is passed, and the page prompts the user to enter the user name and password for authentication, and then the portal server sends the user The username and password are sent to the broadband access server, and the broadband access server then interacts with the authentication server to determine the user's authority, and finally the broadband access server notifies the portal server of the authentication result.

Therefore, the existing broadband access server generally only manages the authentication and charging of the user, regardless of the activities performed by the user on the Internet. All network viruses are invisible to the broadband access server, and the broadband access server only treats it as user data. The configuration between the broadband access server and various servers can complete user authentication and billing functions, but cannot complete virus protection and hacker prevention functions.

Please refer to shown in Figure 1, the network security protection system of the present invention includes:

The authentication server 1 is used for network access authentication, and determines whether the user can access the network 3 according to the authentication result containing security information;

The security policy server 4 is used to configure the security policy (referring to the increase, deletion and modification of the security policy) and issue the security policy, and judge the security of the user, and send the judgment result to the authentication server 1;

The broadband access server 5 is used for user network access, receives security policies and monitors the packets of users accessing the network 3 according to the security policies, and sends the monitoring information to the security policy server 4 to judge user security, and broadband access The server 5 rejects the non-secure user from accessing the network 3 according to the judgment result from the authentication server 1 or the security information in the authentication result.

In this way, by utilizing the monitoring function of the broadband access server 5 to users, the problem of isolating and killing network worms can be well solved. On the one hand, the broadband access server 5 checks user packets in real time, and judges whether the user is poisoned or maliciously attacked via the security policy server 4 . On the other hand, isolate the network segments of the users found above, and guide users to perform anti-virus to prevent other users from being affected, thereby reducing cross-infection and network damage.

Please refer to Figure 2, the authentication server 1 has a security attribute indicating whether the user is safe or not, and an attribute is added to the existing authentication server: the security attribute, the value is "safe" or "unsafe", and the default value of all users is The safety attribute is "safety", for example, in shiva (a kind of Radius server software), add a custom attribute: safety attribute "Safety-State", its value is "Safe" or "Unsafe". The security attribute value of the authentication server 1 is set according to the security judgment result of the security policy server 4 , and sends the current security attribute value to the broadband access server 5 .

The broadband access server 5 has a user security attribute indicating whether the user is safe, and the value is "safe" or "unsafe". The user security attribute value of the broadband access server 5 sets the user security attribute value according to the received security attribute value and rejects the non-safe user access network according to the user security attribute value.

In terms of type, the security policy is divided into anti-virus policy and anti-attack policy; structurally, the security policy includes: check items, used to indicate the content of broadband access server 5 checks; trigger conditions, used to indicate trigger conditions; The operation is used to instruct the broadband access server 5 to perform a specific operation when the trigger condition is met. The operation refers to that the broadband access server 5 monitors the user's message and copies the corresponding message as monitoring information to the security policy server 4 when the trigger condition is met, and the security policy server 4 judges the security of the user according to the message. The configuration of security policy items can be implemented in a variety of ways, for example: ACL (Access Control List, access control list) can be extended to increase operation types. The following is an example of checking the blaster virus. The inspection item of the blaster virus security policy is defined as: "check the packets whose protocol is TCP and the destination port number is port 135 in the user packets"; the trigger condition is defined as: Triggered when the rate of packets exceeds 3 per second", the operation is defined as: "send the TCP header of the packet to the security policy server".

In addition, the network security protection system of the present invention also includes a portal server 6 for isolating non-secure users, and the broadband access server 5 controls non-secure users to access the portal server 6 . Prompt on this Portal home page that the user has been poisoned or is carrying out a network attack. For the situation of poisoning, the user is prompted to need antivirus or security patch, and patch or antivirus program is provided on the homepage for the user to download; when the user operates (installs patch, antivirus etc.) after finishing, portal server 6 carries out security assessment to user, when security assessment result is unsafe, prompt user to continue killing virus; . In the case of a network attack, the user is prompted to stop the network attack, and the next step can be processed according to certain rules, for example, the user is prohibited from accessing the Internet after three consecutive network attacks. Admittedly, the processing of non-secure users can also be isolated without accessing the portal server 6, for example, the non-secure users can be directly offline, which can also avoid network virus cross-infection and repeated infection.

Please refer to Figures 3 to 7, the network security protection method of the present invention includes the following steps:

Security policy configuration steps (see Figures 3 and 4), the security policy server sends the security policy to the broadband access server, and the security policy can be issued in a variety of ways, for example: the security policy server uses Telnet (a method used for remote connection service standard protocol) to connect to the broadband access server, and then execute the configuration command;

Authentication step (seeing Fig. 4), check whether user is safe during authentication, and return the authentication result of the security information of user to broadband access server;

Monitoring step (seeing Fig. 4), according to authentication result, according to security policy, the message of the user of access network is monitored, and monitoring information is fed back to security policy server;

Judging step (see Figure 5), the security policy server judges the user security according to the monitoring information, and passes the judgment result through the authentication server;

In the processing step, the authentication server sends the judgment result to the broadband access server, and the broadband server rejects the non-secure user to access the network according to the judgment result.

The security policy includes: a check item, used to indicate the content to be checked by the broadband access server; a trigger condition, used to indicate the trigger condition; and an operation, used to indicate that the broadband access server performs a specific operation when the trigger condition is met.

The monitoring information refers to the user's message monitored by the broadband access server when the trigger condition is met, and the operation refers to copying the message to the security policy server.

The authentication server has a security attribute used to indicate whether the user is safe; and the broadband access server has a user security attribute used to indicate whether the user is safe.

Please continue to refer to Figure 4, the authentication steps further include:

Step 40, the broadband access server sends an authentication request to the authentication server;

Step 41, the authentication server performs authentication and reads the security attribute value of the user;

Step 42, feeding back the authentication result including the security attribute value to the broadband access server.

The monitoring steps further include:

Step 43, the broadband access server judges whether to pass the authentication according to the authentication result;

Step 44, if the authentication is passed, the user security attribute is set according to the security attribute value in the authentication result; if the authentication is not passed, the user is denied access to the network;

Step 45, judging whether the user is safe according to the user security attribute value;

Step 46, if it is not safe, deny access to the network, if it is safe to access the network and perform the monitoring step at the same time.

Step 47, the broadband access server monitors the user's message according to the security policy, for example: according to the requirements of the "shock wave virus security policy item", when the user establishes a new TCP connection, the BAS checks the first packet of the user's TCP message , to count packets whose protocol type is TCP and whose destination port number is port 135;

Step 48, judging whether the trigger condition is met

Step 49, when the trigger condition is met, the corresponding message is copied to the security policy server as monitoring information, for example, when the number of messages per second is one for 3 seconds, the BAS sends the TCP header of the message to the security policy server, If it is not satisfied, it is judged whether the user is offline, if not, then return to step 45 to continue monitoring.

Please refer to FIG. 5, the judgment step further includes:

Step 51, receiving monitoring information;

Step 52, judging whether the user is safe, for example, after the security policy server receives "the message with the destination port number being 135 ports" sent by the BAS, and finds that the message rate is greater than 10pps, it thinks that the user has the shock wave virus;

Step 53, if it is safe, no operation is performed, and if it is not safe, the authentication server is notified to set the user's security attribute as "unsafe".

Please refer to Figures 6 and 7, the processing steps further include:

Step 60, receiving a setting request from the security policy server;

Step 62, the authentication server sets the security attribute value according to the security judgment result of the security policy server,

Step 63, the current security attribute value is sent to the broadband access server;

Step 64, the broadband access server sets the user security attribute value according to the received security attribute value and refuses the non-secure user to access the network, and the non-secure user is forced (and only allowed) to access the portal server;

Step 65, the portal server provides anti-virus tools for poisoned non-secure users to remove viruses, and warns non-secure users who carry out network attacks to prohibit network attacks;

Step 66, performing a security assessment on the user who has been killed by the virus,

Step 67, if it is safe, then notify the authentication server to set the user's security attribute as safe;

Turn to step 61, the authentication server receives the setting request from the portal server, modifies the user's security attribute to be safe and sends it to the broadband access server; the broadband access server modifies the user's security attribute to be safe and goes to the monitoring step.

To sum up, it is easy to determine whether a user is poisoned or conducts a network attack by issuing a security policy through the security policy server, and then performing a resource check on the BAS for monitoring, so it can respond quickly;

Divide users into secure users and non-secure users. Secure users have no restrictions on accessing the Internet, while non-secure users can only access the portal server, thereby preventing non-secure users from infecting secure users;

The security policy on the security policy server can be completed in cooperation with anti-virus vendors and anti-hacker vendors, so it can be guaranteed to be rapid and timely;

For users, there is no need to always pay attention to the latest patches and virus information, which reduces the requirements for user virus knowledge;

For operators, it can quickly solve the problem of insufficient bandwidth caused by viruses and network attacks. For virus problems, they can obtain new profit growth points by charging for downloading and killing viruses; for hackers, they can get relevant information about hackers, so that they can Carry out the next step of processing;

For anti-virus manufacturers to prevent and control hackers, they can charge by providing the latest information, so as to achieve a win-win effect.

Claims (14)

1. A network security protection system, characterized in that the protection system comprises: The authentication server is used for network access authentication, and determines whether the user can access the network according to the authentication result containing security information; A security policy server, configured to configure a security policy and issue a security policy, and judge whether the user is a secure user or a non-secure user, and send the judgment result to the authentication server; The broadband access server is used for user network access, receives the security policy and monitors the packets of users accessing the network according to the security policy, and sends the monitoring information to the security policy server to judge user security , and the broadband access server rejects the non-secure user from accessing the network according to the judgment result from the authentication server or the security information in the authentication result. 2. The network security protection system according to claim 1, wherein the authentication server has a security attribute indicating whether the user is safe; and the broadband access server has a user security attribute indicating whether the user is safe. 3. The network security protection system according to claim 2, wherein the security attribute value of the authentication server is set according to the security judgment result of the security policy server, and the current security attribute value is sent to The broadband access server; the user security attribute value of the broadband access server sets the user security attribute value according to the received security attribute value and rejects the non-safe user access network according to the user security attribute value. 4. The network security protection system according to claim 1, wherein the security policy includes: a check item, used to indicate the content of the broadband access server check; a trigger condition, used to indicate the trigger condition; an operation, used The purpose is to instruct the broadband access server to perform a specific operation when the trigger condition is met. 5. network security protection system as claimed in claim 2, is characterized in that, described operation refers to that broadband access server monitors the message of user and when triggering condition is met, corresponding message is copied to security policy server as monitoring information, Then the security policy server judges the security of the user according to the message. 6. The network security protection system according to any one of claims 1 to 5, characterized in that the system also includes a portal server for isolating non-secure users, and the broadband access server controls non-secure users to access the portal server . 7. A network security protection method, characterized in that the method comprises the following steps: In the security policy configuration step, the security policy server sends the security policy to the broadband access server; An authentication step, checking whether the user is safe during authentication, and returning the authentication result of the user's security information to the broadband access server; The monitoring step is to monitor the messages of the users accessing the network according to the security policy according to the authentication result, and feed back the monitoring information to the security policy server; Judging step, the security policy server judges the security of the user according to the monitoring information, and passes the judgment result to the authentication server; In the processing step, the authentication server sends the judgment result to the broadband access server, and the broadband server rejects the non-secure user to access the network according to the judgment result. 8. The network security protection method according to claim 7, wherein the security policy includes: a check item, used to indicate the content of the broadband access server check; a trigger condition, used to indicate the trigger condition; an operation, used The purpose is to instruct the broadband access server to perform a specific operation when the trigger condition is met. 9. The network security protection method according to claim 8, wherein the monitoring information refers to the user's message monitored by the broadband access server when the trigger condition is met, and the operation refers to copying the message to the security policy server. 10. The network security protection method according to any one of claim 9, wherein the authentication server has a security attribute for indicating whether the user is safe; and the broadband access server has a user security attribute for indicating whether the user is safe . 11. The network security protection method according to claim 10, wherein the authentication step further comprises: the broadband access server sends an authentication request to the authentication server; The authentication server performs authentication and reads the security attribute value of the user; Feedback the authentication result including the security attribute value to the broadband access server. 12. The network security protection method according to claim 11, wherein said accessing step further comprises the following steps: The broadband access server judges whether to pass the authentication according to the authentication result; If the authentication is passed, set the user security attribute according to the security attribute value in the authentication result and judge whether the user is safe according to the user security attribute value; If it is not safe, deny access to the network, if it is safe to access the network and perform monitoring steps at the same time. 13. The network security protection method according to claim 12, wherein the monitoring step further comprises: The broadband access server monitors the user's message according to the security policy; When the trigger condition is met, the corresponding message is copied to the security policy server as monitoring information. 14. The network security protection method according to claim 13, wherein the processing step further comprises: The authentication server sets the security attribute value according to the security judgment result of the security policy server, and sends the current security attribute value to the broadband access server; The broadband access server sets user security attribute values according to the received security attribute values and rejects non-secure users from accessing the network; Non-secure users are forced to access the portal server; The portal server provides anti-virus tools for poisoned non-secure users, and warns non-secure users who conduct network attacks to prohibit network attacks; Perform a security assessment on the user who has been killed, and if it is safe, notify the authentication server to set the user's security attribute as safe; The authentication server modifies the security attribute of the user to be safe and sends it to the broadband access server; The broadband access server modifies the user's security attribute as security and proceeds to the monitoring step.

Images