KR20000012194A - System for integrating System Management System and Firewall system - Google Patents

Abstract

The present invention relates to a system for integrating an integrated management system and a security system. The system monitors the status of resources related to network security of the security system, collects and stores information, generates a trap event when an error occurs in the security system, and, upon request of the integrated management system, secures the network. A security agent unit for controlling a process or provision of information on related resources; A security register unit for storing information related to network security in a common database of the integrated management system and the security system, and performing deletion, modification and inquiry of the stored information; Log information (Log Information) indicating a record of the access attempt from the security system is obtained and analyzed, and if there is a problem, an emergency message or a single network management protocol (SNMP) trap message is event console of the integrated management system. Log router for providing with; And monitor the security system using the SNMP, take the security related information, monitor the status of the security system, request the security related information and processor control to the security agent unit, the log router unit and the And a management console unit for managing the security register unit. According to the present invention, it is possible to provide a user with efficient management of resources and a reliable use environment.

Description

System for integrating system management system and firewall system

The present invention relates to a system for integrating a system management system (System management system) and a security system (Firewall System), and more specifically, four modules that can operate independently of each other is located in the integrated management system or security system The present invention relates to a system for integrating an integrated management system and a security system that can be installed at a location and allow the modules to interact with each other to integrate and manage the two systems.

In recent years, as client / server construction has spread in the enterprise computing world, the problem of managing distributed systems is becoming more and more important, and communication, remote access, mergers and acquisitions are encouraging this movement.

System Management System (System Management System) refers to a system (software) that allows the integrated management of systems, networks, applications, etc. distributed throughout the enterprise. The firewall system is a system that is located at the boundary between the external network and the internal network to block external packets from entering the internal network.

On the other hand, the current integrated management system is a simple process management level support method that checks the operation of the system using a protocol for remotely managing the system in order to manage network resources. Therefore, there is a problem in that it cannot fully accommodate various functions provided by unique tools. In addition, recently, security has emerged as an important issue, and detailed information and control of related resources are required, and the demand for supplementing them is increasing. However, there has been a need to compensate for this by providing an unproven interface for resource management in the existing integrated management area, causing another problem for security.

In order to solve the above problems, an object of the present invention is to install four modules that can operate independently of each other in an integrated management system or a security system where the modules interact so that the two systems can be integrated and managed. To provide a system for integrating the integrated management system and security system.

1 is a block diagram of a system for integrating an integrated management system and a security system according to a preferred embodiment of the present invention.

2 is a flowchart illustrating the operation of the security agent unit.

3 is a flowchart for explaining the operation of the log router unit.

4 is a flowchart illustrating the operation of the management console unit.

In order to achieve the above object,

In the system for integrating the System Management System and the Security System (Firewall System),

Monitoring the status of resources related to network security of the security system, collecting and storing information, generating a trap event when an error occurs in the security system, and the network security related resources at the request of the integrated management system. Security agent unit for controlling the process or the provision of information about; A security register unit for storing information related to network security in a common database of the integrated management system and the security system, and performing deletion, modification and inquiry of the stored information; Log information (Log Information) indicating a record of the access attempt from the security system is obtained and analyzed, and if there is a problem, an emergency message or a single network management protocol (SNMP) trap message is event console of the integrated management system. Log router for providing with; And monitor the security system using the SNMP, take the security related information, monitor the status of the security system, request the security related information and processor control to the security agent unit, the log router unit and the A management console unit for managing a security register unit, wherein the security agent unit, the security register unit, the log router unit, and the management console unit are interfaces of a code or network security system for a management interface related to an interface program provided by an integrated management system. A system for integrating an integrated management system and a security system is provided that includes a code for the system.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a system for integrating an integrated management system and a security system according to a preferred embodiment of the present invention.

In the system shown in FIG. 1, reference numeral 100 denotes a single network management protocol (SNMP) manager, 120 denotes a location where a security system is installed, and reference numerals 132-138 denote blocks installed on the integrated management system.

The SNMP manager 100 is an application for managing SNMP. Here, SNMP (Single Network Management Protocol) is the most common network management protocol for managing a network. Normally, SNMP responds to an administrator's question by default, and the agent notifies the administrator when a special situation occurs and sends the necessary information together.

The common service unit 122 includes an SNMP gateway, an SNMP manager, and a common object repository, and communicates with the security agent unit 126 through a distributed service bus 124. do. The common object storage unit is a database for storing common data of the integrated management system and security system.

Integrated management system DB (138) is a database required for integrated management system management.

Security server 128 is a server for installing the security system to manage and control the overall security of the enterprise / organization.

The event console 132 is a module that collects information on the progress of various types of information in the integrated management system, and messages about warnings and errors. This allows administrators to provide a more convenient environment by centralizing various events or messages.

The firewall agent 126 monitors the status of resources related to network security of the security system, collects and stores information, generates a trap event when an abnormality occurs in the security system, and integrates it. At the request of the management system, control of the process or provision of information on the network security related resources.

The security agent unit 126 is a program module arranged and operated at a location where various resources related to network security distributed on a network are installed.

2 is a flowchart illustrating the operation of the security agent unit 126.

Start the program by the system service / daemon type or by the user's direct command (step 202).

It checks what kind of service to perform (step 204). That is, when a module is first started, each service branches to proceed to a separate processor to perform a corresponding service.

If the service is an information collection and storage service, the monitoring and information of the state related to network security is periodically collected (step 206).

The collected information is stored in the common object storage unit (step 208). This is to store the collected information in a separate place for later use.

In the case of a trap event generation service, it is determined whether a change has occurred in a state related to network security (step 210). If a change occurs, a trap event is generated (step 212). This is to generate an event so that the administrator can take appropriate action.

In the case of a service to be provided to the management console 130, the service request from the management console 130 is waited for (step 214).

When a service request is received from the management console unit, a separate process for providing a service for the request is created (step 216). Of course, another request is also waited.

It is determined whether the requested service is an information request service (step 218). That is, if the service request is a service requesting information related to network security, the corresponding information is provided to the management console 130 (step 220).

If the service request is processor control, the process is controlled (step 222).

The security agent unit 126 includes some interface programs provided by the integrated management system to provide the above services, and code portions for management.

Typically, the security agent unit 126 is installed where the security system is installed, but if the security register unit 134 is located may be installed on the integrated management system side.

The security register unit 134 is performed by an input of the management console 130 or a user, and in order to provide efficient management of network security related resources in the integrated management system, security information related to network security may be secured with the integrated management system. Store in a common database of the system, and delete, modify, and query the stored information.

The information stored above is used as information for accessing and servicing each network security resource through a graphic interface of the integrated management system.

The security register unit 134 includes a code portion for a management interface associated with some interface programs provided by the integrated management system to perform the above functions.

The log router unit 136 obtains and analyzes log information indicating a record of a connection attempt from the security server 128 of the security system, and analyzes an emergency message or SNMP if there is a problem. Management Protocol) Provides trap messages to the event console of the integrated management system.

The log router 136 operates in a manner of communicating with the management console 130 among network security resources distributed in various nodes through a graphic interface provided by the integrated management system. In general, the operation is initiated by a request of the management console 130 or a user input, and the log information is analyzed by taking log information so as to know various intrusion attempts from the security server 128, and the event console unit of the integrated management system ( 132).

3 is a flowchart illustrating the operation of the log router unit.

Access the security server 128 to get log information (steps 302 and 304).

Analyze the log information and determine if there is a problem (steps 306 and 308).

If there is a problem, an "alert" message or an SNMP trap message is sent to the event console 132 (step 310).

If there is no problem, the log information is stored in the database 138 of the integrated management system (step 312). If there is no problem, step 314 may be immediately performed.

It is determined whether there is the next data to be analyzed, and if it is, repeating step 304 or less (step 314).

The log router unit 136 includes some interface programs of the integrated management system and code portions for the interface of the network security system to perform the above functions.

The management console unit 130 monitors the security system using SNMP, monitors the state of the security system by obtaining security related information, requests the security related information and processor control to the security agent unit, and the log router unit. 136 and the security register section 134 are managed.

The management console 130 is installed together on a system in which the integrated management system is installed as a tool for managing and assisting the modules described above.

4 is a flowchart illustrating the operation of the management console unit.

Check the service type (step 402).

In the case of an SNMP service, SNMP is monitored for network security resources for each distributed node (step 404). That is, information about network security resources distributed on the network node is collected from the common object storage unit. And, by integrating the separate information registered by the user so that you can know the status of network security resources at a glance. In addition, SNMP is used periodically to query the status of each network security resource and display the status.

In the case of the security information service, the security information is taken from the security agent unit 126 to monitor the state of the security server 128. In addition, process control and some information is requested to the security agent unit 126 (step 406). Specifically, the state of the network security resources is displayed through communication with the security agent unit 126. In addition, the security agent unit 126 requests information about the network security resource, and requests process control for the resource. In addition, it independently monitors the status of the network security server 128 and requests for some information. This is especially useful when the security agent portion 126 is not normal.

In the case of the log routing service, the log router is managed (step 408). For example, the start and end of the log router module are indicated. In addition, by providing a graphical user environment that replaces the execution of the command line of the log routing service, the user can control the log router module using only a mouse.

In step 404, 406, 408, if there is a problem, the event console unit 132 transmits the situation. For example, it receives a trap message from the security agent unit 126 and updates the information according to the contents thereof, and transfers the contents to the event console unit 132 of the integrated management system.

In the case of a secure register service, the secure register is managed. Step 410, for example, indicates the start and end of the security register module. Similarly, by providing a graphical usage environment that replaces the command line execution of a secure register module, the user can control the secure register module using only a mouse.

In step 416, the network security resource information is stored, deleted, modified, and retrieved in the common object storage unit.

Provide other services (step 412). Other services mean additional services for the system.

In addition, the management console unit 130 can execute a client program of a graphical user interface (GUI) to network security resources to provide a more familiar and familiar environment for network security administrators. . The client of the GUI environment may also be executed on the graphical interface of the integrated management system by using the information registered in the common object storage unit by the secure register unit 134 module.

The present invention is not limited to the above-described embodiments, and of course, modifications can be made by those skilled in the art without departing from the spirit of the present invention. Therefore, the scope of the claims in the present invention will not be defined within the scope of the detailed description, but will be limited to the claims below.

According to the present invention, four modules that can operate independently of each other are installed in an integrated management system or a security system where the modules interact so that the two systems can be integrated and managed to have the following effects. .

By integrating the integrated management system and security system, it is possible to provide efficient management of resources and reliable use environment for users who currently operate the network security system and integrated management system independently or separately.

Therefore, network security users can manage various resources of integrated management system powerfully and efficiently, and users of integrated management system provide powerful and secure security management function of network security in using widely deployed resources. I can receive it. In addition, by operating the four modules independently of each other, you can take full advantage of the functions provided by each tool. In addition, it solves the security problem of the existing integrated management system by providing a proven interface for security and resource management.

Claims (4)

In the system for integrating the System Management System and the Security System (Firewall System), Monitoring the status of resources related to network security of the security system, collecting and storing information, generating a trap event when an error occurs in the security system, and the network security related resources at the request of the integrated management system. Security agent unit for controlling the process or the provision of information about; A security register unit for storing information related to network security in a common database of the integrated management system and the security system, and performing deletion, modification and inquiry of the stored information; Log information (Log Information) indicating a record of the access attempt from the security system is obtained and analyzed, and if there is a problem, an emergency message or a single network management protocol (SNMP) trap message is event console of the integrated management system. Log router for providing with; And Monitor the security system using the SNMP, take the security related information, monitor the state of the security system, request the security related information and processor control to the security agent unit, the log router unit and the security It includes a management console unit for managing the register unit, The security agent unit, the security register unit, the log router unit and the management console unit integrated management characterized in that it comprises a code for the management interface associated with the interface program provided by the integrated management system or code for the interface of the network security system System for integrating system with security system. The method of claim 1, wherein the management console unit A system for integrating a security system and an integrated management system, characterized in that to independently monitor the state of the network security system and to request the security agent information related to the security. The method of claim 1, The security agent unit is installed where the security system is located, The security register unit, the log router unit and the management console unit is a system for integrating the integrated management system and security system, characterized in that installed in the location where the integrated management system is located. The method of claim 1, And the security agent unit and the security register unit are installed at the same location.