KR101429107B1 - Security system collecting sub-domain name and operating method thereof - Google Patents

Abstract

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to electronic communication, and more particularly to a security device and a method of operation thereof. A method of operating a security device according to an embodiment of the present invention determines whether a packet communicated between a plurality of host computers and an Internet network is a DNS response packet transmitted from a DNS (Domain Named Server) server, It is determined whether the subdomain name included in the DNS response packet corresponds to the internally stored upper domain name, and the corresponding subdomain name is updated in the domain name table. When the corresponding packet is not a DNS response packet, Determining whether the subdomain name matches any of the subdomain names in the domain name table, and blocking the corresponding packet.

Description

TECHNICAL FIELD [0001] The present invention relates to a security device for collecting a subdomain name and a method of operating the security device.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to electronic communication, and more particularly to a security device and a method of operation thereof.

A Domain Name System (DNS) is used as a system for managing a domain name on the Internet. In this case, the domain name and the IP address of the server computer are mapped and registered in the DNS server. In this state, the user of the host computer (for example, client computer) It is possible to input a domain name without first inputting the IP address corresponding to the domain name to the DNS server first and to receive the corresponding IP address from the DNS server and to access the server computer indicated by the IP address. By using the domain name system, you can connect to the server computer by entering the domain name instead of the hard-to-remember IP address.

As the kind of the domain name, there exists an upper domain name (or a wildcard domain name) and a subdomain name. A plurality of subdomain names (e.g., secui.com, cafe.secui.com, mobile.cafe.secui.com, etc.) correspond to one parent domain name (for example, * .secui.com) . The parent domain name means a conceptual domain name corresponding to a plurality of sub domain names and may not have a corresponding web page. Each of the subdomain names means a domain name actually used and has a corresponding web page. When collecting domain names, it is required to collect as many subdomains as possible corresponding to each higher domain name.

On the other hand, a plurality of IP addresses can correspond to one subdomain name. For example, a plurality of server computers each providing a website corresponding to one subdomain name can be operated. When collecting IP addresses, it is required to collect as many IP addresses as possible corresponding to one subdomain name.

An object of the present invention is to provide a security apparatus and an operation method thereof that efficiently collects subdomain names corresponding to a parent domain name, and efficiently manages packets communicated on the Internet using collected subdomain names.

A method of operating a security device according to an exemplary embodiment of the present invention is a method in which a packet communicated between a plurality of host computers and an Internet network is a DNS response packet transmitted from a Domain Name Server (DNS) server through the Internet network ; Extracting a subdomain name included in the DNS response packet when the packet is a DNS response packet and updating the subdomain name in a domain name table if the extracted subdomain name corresponds to an internally stored upper domain name ; And blocking the packet according to whether the subdomain name included in the packet matches any one of the subdomain names in the domain name table when the packet is not a DNS response packet.

Another aspect of the present invention relates to a security device. A security device according to an embodiment of the present invention includes a security unit for managing a plurality of host computers connected to the Internet network; A sniffing unit configured to determine whether a packet communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted from the DNS server through the Internet network; And a storage unit for storing a domain name table including a parent domain name. The sniffing unit updates the subdomain name to the domain name table when the subdomain name included in the packet corresponds to the upper domain name when the packet is a DNS response packet, And to block the packet according to whether the subdomain name matches any of the subdomain names in the domain name table.

According to an embodiment of the present invention, there is provided a security apparatus and an operation method thereof, which effectively collects subdomain names corresponding to a parent domain name, efficiently manages packets communicated on the Internet using collected subdomain names do.

1 is a block diagram illustrating a network including a security device according to an embodiment of the present invention.
2 is a flowchart illustrating an operation method of a security device according to an embodiment of the present invention.
3 is an exemplary diagram showing a data format of a header of a DNS response packet.
4 is a flowchart illustrating an operation method of a security device according to another embodiment of the present invention.
5 is a view showing a domain name table stored in the storage unit.
6 is a flowchart illustrating an operation method of a security apparatus according to another embodiment of the present invention.
Figure 7 is a flow chart illustrating a method for obtaining a DNS query packet.
8 is a flowchart illustrating an operation method of a security device according to another embodiment of the present invention.
FIG. 9 is a diagram conceptually showing a data format of a normal packet.
10 is a flowchart illustrating an operation method of a security device according to another embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

1 is a block diagram illustrating a network 100 including a security device 110 in accordance with an embodiment of the present invention.

1, a network 100 includes a plurality of host computers PC1 to PCk, a security device 110, an Internet network 120, a DNS (Domain Name System) server 130, (141 to 14n).

The plurality of host computers PC1 to PCk are connected to the Internet network 120 through the security device 110. [ The plurality of host computers PC1 to PCk receives a subdomain name from a user, requests an IP address corresponding to the subdomain name from the DNS server 130, receives the corresponding IP address from the DNS server 130 , It is possible to connect to the server computer corresponding to the provided IP address of the plurality of server computers 141 to 14n.

First, any one of the plurality of host computers PC1 to PCk, for example, the first host computer PC1, transmits a DNS query packet requesting an IP address corresponding to the subdomain name to the DNS server 130). The first host computer PC1 receives the DNS response packet provided from the DNS server 130 and extracts the IP address included in the DNS response packet. The extracted IP address indicates any one of the plurality of server computers 141 to 14n. The first host computer PC1 transmits a normal packet including a destination IP address defined as an IP address obtained from the DNS response packet and a source IP address defined as an IP address corresponding to the first host computer PC1, Receives the normal packet including the destination IP address defined as the IP address corresponding to the IP address corresponding to the first host computer PC1 and the IP address obtained from the DNS response packet, I will connect to the server computer.

The security device 110 is configured to manage a plurality of host computers PC1 to PCk. The security device 110 includes a security unit 111, a sniffing unit 112, and a storage unit 113.

The security unit 111 may be configured to manage packets transmitted to and received from a plurality of host computers PC1 to PCk according to predetermined security policies. The security unit 111 monitors packets transmitted to the plurality of host computers PC1 through PCk through the Internet network 120 and blocks all or a part of the packets according to predetermined security policies . The security unit 111 is also configured to monitor packets transmitted from the plurality of host computers PC1 to PCk to the Internet network 120 and to block all or a part of the packets according to predetermined security policies .

The security unit 111 stores packets communicated between the plurality of host computers PC1 to PCk and the Internet network 120 based on the domain name information of the table stored in the storage unit 113 Management. For example, when the subdomain name of a packet communicated between a plurality of host computers PC1 to PCk and the Internet network 120 matches the subdomain name in the table, the security unit 111 blocks the packet . When they do not match, the packet will be allowed.

The sniffing unit 112 is configured to collect subdomain names corresponding to the parent domain names based on packets communicated between the host computers PC1 to PCk and the DNS server 130. [ That is, the sniffing unit 112 determines whether the packet is a DNS response packet transmitted from the DNS server 130 to the plurality of host computers PC1 to PCk through the Internet network 120, And extract the subdomain name.

The sniffing unit 112 determines whether the corresponding subdomain name corresponds to the parent domain name. The upper domain name is stored in the storage unit 113 in advance. As an example, the sniffing unit 112 performs a string comparison of the corresponding subdomain name and each higher-level domain name stored in the storage unit 113 to determine whether there is a higher-level domain name corresponding to the subdomain name. In accordance with the determination result, the sniffing unit 112 stores the extracted subdomain name in the storage unit 113. [

The storage unit 113 stores upper domain names and subdomain names corresponding to each upper domain name. The storage unit 113 may store a table in which subdomain names corresponding to each parent domain name are listed. This table is updated by the sniffing unit 112 as described above.

According to the embodiment of the present invention, by sniffing packets communicated between the host computers PC1 to PCk and the DNS server 130, at least one upper domain name, which is used by the host computers PC1 to PCk Lt; / RTI > may be collected. The collected subdomain names are stored in the storage unit 113 in association with the corresponding upper domain name, and are used by the security device 110.

In FIG. 1, it will be appreciated that the security unit 111 and the sniffing unit 112 may be implemented by a plurality of physical devices and by one physical device. For example, each of the security unit 111 and the sniffing unit 112 may be implemented using various methods, such as using software or using firmware.

The DNS server 130 is connected to the security device 110 and a plurality of host computers PC1 to PCk via the Internet network 120. [ The DNS server 130 is configured to provide a DNS response packet to the host computer in response to the DNS query packet received from each host computer. The DNS server 130 stores information on IP addresses corresponding to each subdomain name. Based on the stored information, the DNS server 130 searches for a sub-domain name in the DNS query packet corresponding to an IP address, and transmits a DNS response packet including the requested sub-domain name and the retrieved IP address to the Internet 120. [ To the host computer.

The first to nth server computers 141 to 14n provide web sites through the Internet 120, respectively. The first to nth server computers 141 to 14n have different IP addresses.

2 is a flowchart illustrating an operation method of the security device 110 according to an embodiment of the present invention.

Referring to FIGS. 1 and 2, in step S110, the sniffing unit 112 monitors packets communicated between the plurality of host computers PC1 through PCk and the Internet network 120. FIG. A packet transmitted and received between a plurality of host computers (PC1 to PCk) and a DNS server 130 is defined as a DNS packet. At this time, a packet transmitted from each host computer to the DNS server 130 is defined as a DNS query packet, and a packet transmitted from the DNS server 130 to each host computer is defined as a DNS response packet. The plurality of host computers PC1 to PCk can communicate with the server computers 141 to 14n via the Internet network 120. [ Packets transmitted and received between a plurality of host computers (PC1 to PCk) and server computers (141 to 14n) are defined as normal packets.

Hereinafter, for convenience of description, a case where the first host computer PC1 transmits / receives DNS packets to / from the DNS server 130 will be described as an example.

In step S120, the sniffing unit 112 determines whether the packet is a DNS response packet. That is, the sniffing unit 112 determines whether the packet is a DNS response packet transmitted from the DNS server 130. [

As an embodiment, whether the packet is a DNS response packet can be determined based on the header of the packet. This is described in more detail with reference to FIG.

If the packet is a DNS response packet, step S130 is performed.

In step S130, the sniffing unit 112 extracts a subdomain name from the DNS response packet. The DNS response packet may include the subdomain name information and the corresponding IP address information. More specifically, the DNS response packet is provided in response to a DNS query packet requesting an IP address corresponding to a subdomain name, so that the DNS response packet includes the requested subdomain name and its corresponding IP address can do.

In step S140, the sniffing unit 112 determines whether the extracted subdomain name corresponds to the parent domain name. The sniffing unit 112 determines whether there is a parent domain name corresponding to the extracted subdomain name among the parent domain names stored in the storage unit 113. [ As an embodiment, the sniffing unit 112 performs a string comparison of the subdomain name and each higher-level domain name to determine whether the subdomain name corresponds to the upper-level domain name.

In step S 150, the sniffing unit 112 stores the extracted subdomain name in the storage unit 113. The subdomain name will be stored in association with the corresponding parent domain name. As an example, the storage unit 113 stores a table, and subdomain names can be listed in the table by the upper domain name.

According to the embodiment of the present invention, the sub domain names can be efficiently collected for each upper domain name.

3 is an exemplary diagram showing the data format of the header (DNS_HD) of the DNS response packet.

Referring to FIG. 3, the header (DNS_HD) of the DNS response packet includes first to third flag information 11 to 13, a destination IP address DP, and a subdomain name (SDN). The first flag information 11 indicates whether the packet is a DNS packet or a normal packet.

As an example, the first flag information 11 may be the IP address of the source port of the packet. Whether the first flag information 11 indicates the DNS server 130 or not can be determined if the packet is a DNS packet.

The destination IP address DP is an IP address of a destination port to which the DNS response packet is to be transmitted, in this embodiment, the host computers PC1 to PCk.

The subdomain name (SDN) means information about the subdomain name requested by the DNS query packet.

As an embodiment, the first flag information 11, the destination IP address DP, and the subdomain name SDN may be included in a TCP (Transmission Control Protocol) header among DNS_HDs of DNS response packets.

The second flag information 12 indicates whether the packet is a DNS query packet or a DNS response packet. For example, if the second flag information 12 is composed of one data bit, and the second flag information 12 is a logical state "1 ", the packet is a DNS response packet and the second flag information 12 is a logical state "0" means that the packet is a DNS query packet.

The third flag information 13 indicates whether the corresponding IP address is present and the number of corresponding IP addresses when the packet is a DNS response packet. An IP address (IP) is provided corresponding to the DNS query packet.

As an embodiment, the second and third flag information 12 and 13 and the IP address IP may be included in the DNS header of the DNS response header (DNS_HD) of the DNS response packet.

Whether the packets communicated between the host computers PC1 to PCk and the Internet network 120 are DNS response packets can be discriminated based on the first to third flag information 11 to 13. [

4 is a flowchart illustrating an operation method of the security device 110 according to another embodiment of the present invention.

Referring to FIG. 4, steps S210 to S240 operate in the same manner as steps S110 to S140 in FIG. Hereinafter, a duplicate description will be omitted.

In step S250, when the subdomain name is stored, the IP address included in the DNS response packet is also stored. The DNS response packet includes the subdomain name and the corresponding IP address, and the sniffing unit 112 can store the IP address together with the subdomain name in the storage unit 113. [ The IP address will be stored in association with the corresponding subdomain name.

FIG. 5 is a diagram showing a domain name table T stored in the storage unit 113. FIG.

Referring to FIG. 5, the domain name table T includes subdomain names corresponding to a parent domain name. In FIG. 5, only the sub domain names corresponding to one upper domain name are disclosed. However, for convenience of explanation, a plurality of upper domain names are included in the domain name table T, and sub domain names are listed Will be.

In addition, the domain name table T may further include IP addresses corresponding to respective subdomain names. As described with reference to FIG. 4, whenever a subdomain name corresponding to a parent domain name is collected, the corresponding IP address may also be collected and updated in the domain name table T. As further stored in the IP addresses, the security unit 111 can efficiently manage the packets communicated between the plurality of host computers PC1 to PCk and the Internet network 120. [ For example, when the source IP address or the destination IP address of the packet communicated between the plurality of host computers PC1 to PCk and the Internet network 120 matches the IP address in the domain name table It can block the packet and allow the packet when it does not match.

6 is a flowchart illustrating an operation method of the security device 110 according to another embodiment of the present invention.

Referring to FIGS. 2 and 6, in step S310, the sniffing unit 112 monitors packets communicated between the plurality of host computers PC1 to PCk and the Internet network 120. FIG. In step S320, the sniffing unit 112 determines whether the packet is a DNS response packet.

Hereinafter, for convenience of description, a case where the first host computer PC1 transmits / receives a packet to / from the DNS server 130 will be described as an example in the description with reference to FIG. 6 and FIG.

In step S330, the sniffing unit 112 determines whether a DNS query packet corresponding to the DNS response packet has been transmitted. To this end, the sniffing unit 112 collects information about the DNS query packet transmitted from the first host computer PC1 to the DNS server 130. [ This will be described in more detail with reference to FIG.

DNS response packets are transmitted to at least one of the host computers PC1 to PCk, for example, the first host computer PC1 via the Internet network 120, for various purposes, Lt; / RTI > This DNS response packet will not be generated by the DNS server 13 but will be generated by any other server.

In this case, the reliability of the header (DNS_HD) of the DNS response packet is very low. The header (DNS_HD) of the DNS response packet may include the same first to third flag information 11-13 as described with reference to FIG. When the sniffing unit 112 determines whether the packet is a DNS response packet based on only the header (DNS_HD) of the DNS response packet, low-reliability subdomain information can be collected.

According to this embodiment, the sniffing unit 112 determines whether the packet is a DNS response packet based on the header (HD) of the DNS response packet and whether the first host computer PC1 has generated a DNS query packet . If there is a DNS query packet, step S340 is performed. In the absence of a DNS query packet, the subdomain name is not stored.

In step S340, the sniffing unit 112 extracts the subdomain name from the DNS response packet. In step S350, the sniffing unit 112 determines whether the subdomain name corresponds to the upper domain name stored in the storage unit 113. [ In step S360, the extracted subdomain name is stored in association with the corresponding upper domain name according to the discrimination result.

According to this embodiment, the reliability of the subdomain name collected by the sniffing unit 112 can be further improved.

Figure 7 is a flow chart illustrating a method for obtaining a DNS query packet.

1 and 7, the sniffing unit 112 monitors packets communicated between a plurality of host computers PC1 through PCk and the Internet network 120 (S410), and determines whether the packet is a DNS query packet (S420). The DNS query packet is a packet for asking the IP address corresponding to the subdomain name, and is transmitted from the first host computer PC1 to the DNS server 130. [ As an embodiment, whether the packet is a DNS query packet can be determined based on the header of the packet, as described with reference to FIG. For example, whether the packet is a DNS query packet can be determined by the destination IP address of the header of the packet. If the packet is a DNS query packet, the sniffing unit 112 stores information on the DNS query packet in the storage unit 113 (S430). The information on the DNS query packet will be used in step S330 of FIG.

FIG. 8 is a flowchart illustrating an operation method of the security device 110 according to another embodiment of the present invention. Fig. 9 is a diagram conceptually showing the data format of the normal packet NP.

Referring to FIGS. 1 and 8, steps S510 through S550 operate in the same manner as steps S110 through S150 described with reference to FIG. 2, respectively. Hereinafter, a duplicate description will be omitted.

In step S560, when the packet is a normal packet, the security unit 111 determines whether the subdomain name in the packet matches the subdomain name of the domain name table (see T in FIG. 5).

Referring to FIG. 9, the normal packet NP includes a header HD and user data UD. The header HD is data for managing the user data UD. The header HD may include information about a source IP address SP, a destination IP address DP, and a subdomain name SDN.

According to the embodiment of the present invention, the security unit 111 extracts the subdomain name (SDN) information from the header HD of the packet and extracts the extracted subdomain name SDN from the domain name table ) Of the sub-domain names. If not, step S570 is performed. If so, step S580 is performed.

In step S570, the packet is allowed. In step S580, the packet is blocked.

According to the embodiment of the present invention, the subdomain names are efficiently collected for each upper domain name, and the packets between the host computers and the Internet network can be managed based on the collected subdomain names.

10 is a flowchart illustrating an operation method of the security device 110 according to another embodiment of the present invention.

Referring to FIGS. 1 and 10, steps S610 to S650 operate in the same manner as steps S110 to S150 described with reference to FIG. 2, respectively. Hereinafter, a duplicate description will be omitted.

In step S660, when the packet is a normal packet, the security unit 111 determines whether the subdomain name in the packet matches the IP address of the domain name table (see T in FIG. 5). If not, step S670 is performed. If so, step S690 is performed.

In step S670, the security unit 111 determines whether the source or destination IP address of the packet matches the IP address in the domain name table. The header (HD, see Fig. 9) of the packet includes the source IP address SP and the destination IP address DP (see Fig. 9). The security unit 111 extracts the source and destination IP addresses SP and DP among the header HD of the packet and stores the extracted source or destination IP addresses SP and DP in the domain name table Lt; RTI ID = 0.0 > IP < / RTI > If not, step S680 is performed. If so, step S690 is performed.

In step S680, the packet is allowed. In step S690, the packet is blocked.

According to this embodiment, server access using an IP address other than a subdomain name can also be efficiently managed.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the claims equivalent to the claims of the present invention as well as the claims of the following.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the claims equivalent to the claims of the present invention as well as the claims of the following.

PC1 to PCk: first to kth host computers
110: Security device
120: Internet network
130: DNS server
141 to 14n: first to nth server computers

Claims (14)

A method of operating a security device managing a plurality of host computers connected to an Internet network, the method comprising:
Determining whether a packet communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted through the Internet network from a DNS (Domain Named Server) server;
Extracting a subdomain name included in the DNS response packet when the packet is a DNS response packet and updating the subdomain name in a domain name table if the extracted subdomain name corresponds to an internally stored upper domain name ; And
Blocking the packet according to whether the subdomain name contained in the packet matches any one of the subdomain names in the domain name table when the packet is not a DNS response packet,
Wherein the DNS response packet is provided to one of the plurality of host computers from the DNS server according to a DNS query packet generated in any one of the plurality of host computers,
Wherein the DNS query packet is generated when requesting an IP address corresponding to the subdomain name. delete The method according to claim 1,
Wherein the DNS response packet includes the sub-domain name and the IP address information,
And updating the IP address together when the subdomain name is updated in the domain name table. The method of claim 3,
Wherein the IP address is matched with the subdomain name and listed in the domain name table. The method of claim 3,
Wherein blocking the packet comprises blocking the packet when the IP address included in the packet matches any one of the IP addresses in the domain name table. The method according to claim 1,
Wherein the subdomain name is matched with the parent domain name and listed in the domain name table. The method according to claim 1,
Detecting a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network and storing information on the plurality of DNS query packets,
Wherein the updating is performed according to whether a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets. A security unit for managing a plurality of host computers connected to the Internet network;
A sniffing unit configured to determine whether a packet communicated between the plurality of host computers and the Internet network is a DNS response packet transmitted from the DNS server through the Internet network; And
And a storage unit for storing a domain name table including a parent domain name,
The sniffing unit updates the subdomain name in the domain name table when the subdomain name included in the packet corresponds to the upper domain name when the packet is a DNS response packet,
And to block the packet according to whether the subdomain name matches any of the subdomain names in the domain name table when the packet is not a DNS response packet,
Wherein the DNS response packet is provided to one of the plurality of host computers from the DNS server according to a DNS query packet generated in any one of the plurality of host computers,
Wherein the DNS query packet is generated when requesting an IP address corresponding to the subdomain name. delete 9. The method of claim 8,
Wherein the DNS response packet includes the sub-domain name and the IP address information,
And the sniffing unit updates the IP address together when the subdomain name is updated in the domain name table. 11. The method of claim 10,
Wherein the IP address matches the subdomain name and is listed in the domain name table. 11. The method of claim 10,
Wherein the sniffing unit blocks the packet when the IP address included in the packet matches any one of the IP addresses in the domain name table. 9. The method of claim 8,
Wherein the subdomain name is matched with the parent domain name and listed in the domain name table. 9. The method of claim 8,
Wherein the sniffing unit is configured to detect a plurality of DNS query packets transmitted from the plurality of host computers to the DNS server through the Internet network and to store information on the plurality of DNS query packets in the storage unit ,
Wherein when a DNS query packet corresponding to the DNS response packet exists among the plurality of DNS query packets, the subdomain name included in the packet is updated in the domain name table.

Images