KR20080002214A - Security search engine control method and device using internet terminal device - Google Patents

Abstract

The present invention discloses a technology for securing the security of the network by securing the security of the subscriber terminal by inducing the installation and operation of the security search engine in the subscriber terminal using the Internet terminal device.

The method and apparatus for controlling a security search engine using an internet termination apparatus according to the present invention include: a first step of a security management manager of the internet termination apparatus confirming an attempt to access an internet connection of a subscriber terminal; A second step of transmitting a status query message to the subscriber station attempting to access the Internet; A third step of installing a security search engine in the subscriber station and bypassing the second step if the status response message for the status query message is not received from the subscriber station; And a fourth step of allowing the subscriber terminal to access the Internet when the status response message for the status query message is received from the subscriber terminal.

Description

Security search engine control method and device using internet terminal device {A CONTROL METHOD AND THE DEVICE TERMINATING THE INTERNET FOR SECURITY CHECK ENGINE}

1 is a view showing a connection relationship of the Internet according to the present invention.

2 is a view showing the internal configuration of the Internet termination device according to the present invention.

3a to 3b is a view showing a message flow between the subscriber station and the Internet termination apparatus according to the present invention.

Figure 4 is a flow chart showing the operation of the security search engine control method using the Internet terminal.

5 is a diagram showing the format of a status query message and a status response message according to the present invention;

*** Explanation of symbols for the main parts of the drawing ***

10; Internet 20; Secure Search Server

30a, 30b,... ; Subscriber station 31; Secure Search Engine

100; Internet termination device 110; Security Manager

111; WAN port 112; Terminal port

The present invention relates to a method and apparatus for controlling a security search engine using an internet terminal device. More specifically, the present invention relates to the presence or operation of a security search engine when a subscriber terminal accommodated in the internet terminal device attempts to access a network such as the Internet. The present invention relates to a technology for checking network status and allowing network access.

The Internet is a global network of networks. There is a wealth of information available on the Internet, and in some cases this information may contain both harmful and beneficial information.

For example, harmful information may be present by a user such as a hacker or a cracker. Hackers or crackers cause intrusion and paralysis of network systems using subscriber's personal information leakage, viruses and malware.

There are various kinds of harmful information on the Internet, and the targets of the attack are not only network equipment but also various ranges such as individual users and Internet service providers or specific service providers.

As such, harmful information existing on the Internet causes a lot of damage to subscribers and network equipment, and in the worst case, may make the network unavailable. Various security search engines exist to prevent the damage of harmful information on the Internet.

In general, the security search engine is installed on the subscriber's terminal to search for various viruses, hacking programs, spyware, and various malicious codes existing on the Internet, and removes them to remove the security status of the Internet and subscriber terminals. Keep it.

If there is a security search engine in the subscriber terminal to secure the security of the subscriber terminal, the security of the Internet can be secured. In other words, if the security of all subscriber terminals connecting to the Internet is provided, the Internet cannot be infected by a virus or the like unless a virus or the like occurs within the Internet itself. Typically, a virus infects another subscriber terminal via a network by the first terminal infected with the virus. Therefore, if an infected subscriber terminal does not access the Internet, the probability of virus infection of another subscriber terminal is lowered.

Therefore, when all subscriber terminals are provided with a security search engine and access to the Internet, other subscriber terminals can be prevented from infection, and the security of the Internet can be enhanced.

However, there is a problem that the security search engine is not installed for all subscriber terminals. Current security search engines are provided in the form of subscribers purchasing and installing a separate security search engine as needed. In addition, the security search engine provided by an Internet service provider or other service providers has a problem that the subscriber terminal operates after accessing the Internet and the web server.

In addition, when using an Internet gateway or an external security search system, its performance is low, which may result in a slow speed. Compared to a security search engine installed in a subscriber terminal, the size of the searched file is restricted, and in the case of a compressed file, the search is It is difficult and there are problems such as only supporting some protocols used on the Internet.

In addition, even if a security search engine is installed in the subscriber terminal, when the operation of the subscriber terminal occurs and reinstalls an OS (Operating System) program such as an operating system, the security search engine is temporarily not installed. There are disadvantages. Commonly marketed security search engines require access to the Internet for license registration after purchase. In this case, the subscriber station is connected to the Internet in a state in which a security service is not provided because the genuine registration is not performed even if a security search engine is installed.

An object of the present invention for solving such a problem, when the subscriber terminal is connected to the Internet to check the presence of the security search engine installation of the subscriber terminal, if not installed can be connected to the Internet after inducing the installation of the security search engine It is to strengthen the security of the subscriber terminal and the Internet.

Security search engine control method using the Internet terminal device for achieving the above object, the first step of the security management manager of the Internet terminal device to confirm the Internet access attempt of the subscriber terminal; A second step of transmitting a status query message to the subscriber station attempting to access the Internet; A third step of installing a security search engine in the subscriber station and bypassing the second step if the status response message for the status query message is not received from the subscriber station; And a fourth step of allowing the subscriber terminal to access the Internet when the status response message for the status query message is received from the subscriber terminal.

The security search engine control apparatus using the Internet termination device for achieving the above object is provided in the Internet termination device, when the subscriber terminal attempts to access the Internet, a security search engine is installed on the subscriber terminal using a status query message. It is characterized in that it comprises a security management manager that allows Internet access only in normal operation.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a connection relationship of the Internet 10 according to the present invention.

Subscriber terminals (30a, 30b, ...) is connected to the Internet terminal 100 is connected to the Internet 10, the Internet 10 is connected to the security search server 20.

Subscriber terminals 30a, 30b, ... are terminals used by the subscriber to use the Internet 10 service. Subscriber terminals 30a, 30b, ... include all terminals capable of connecting to the Internet 10, such as a personal computer and a personal digital assistant (PDA).

The Internet terminating device 100 is a kind of network equipment provided in the Internet 10 and is provided at the far end of the Internet 10 to connect a subscriber to the Internet 10. Typically, the internet termination device 100 includes a residential gateway, a router or an L2 / L3 switch.

 Internet termination apparatus 100 according to the present invention checks the installation and operation of the security search engine of the subscriber terminal (30a, 30b, ...) when the security search engine is not installed or does not operate, security search engine By installing or reinstalling the subscriber terminal (30a, 30b, ...) to ensure the security.

The Internet 10 is a network of a global scale composed of various networks connected to each other. Numerous subscriber terminals 30a, 30b, ... access the Internet 10 to access various information present on the Internet 10, or exchange e-mail or peer-to-peer communication between subscriber terminals 30a, 30b, ... Exchange information through The Internet 10 supports such communication between subscriber stations 30a, 30b, ..., and information providing apparatuses such as subscriber terminals 30a, 30b, ..., and a web server.

Security search server 20 is connected to the Internet (10) connected to the Internet 10 connected to the subscriber terminal (30a, 30b, ...) to update the function of the security search engine installed, and to support the additional features such as function enhancement and status check And, if the Internet terminal device 100 installs a security search engine in the subscriber terminal (30a, 30b, ...) supports this.

The present invention checks whether the security search engine is installed when the subscriber terminal (30a, 30b, ...) attempts to access the Internet 10, and checks whether the security search engine is operating normally to connect to the Internet 10 will be. Here, if the security search engine is not installed or does not operate normally in the subscriber terminal (30a, 30b, ...) is to install a security search engine.

Here, the installation of the security search engine stores the security search engine in the Internet terminal device 100, and stores it in the implementation and the security search server 20 to be installed in the subscriber terminal (30a, 30b, ...) if necessary. If necessary, various implementations such as an implementation of the form installed in the subscriber terminal (30a, 30b, ...) is possible.

2 is a view showing the internal configuration of the Internet termination apparatus 100 according to the present invention.

Internet termination apparatus 100 according to the present invention includes a security management manager 110, WAN port 111 and the terminal port 112.

The security management manager 110 is a control device of the security search engine 31 provided in the Internet terminal 100. When the subscriber station (30a, 30b, ...) attempts to access the Internet (10), the security management manager 110 checks whether the security search engine 31 is installed and checks the operation state, and performs a state query. If you receive the appropriate response, you are allowing the connection.

However, if a proper response to the state query is not received or there is no response, the security management manager 110 uses the security search engine 31 stored in the security search server 20 to the subscriber terminals 30a, 30b,... Install on. Here, the security search engine 31 is stored in the Internet termination apparatus 100 instead of being stored in the security search server 20 according to the implementation intention of those skilled in the art, and is then stored in the subscriber terminal 30a or 30b by the security management manager 110. It can also be implemented in the form that is installed in, ...).

The WAN port 111 is a port to which the Internet terminal 100 is connected to the Internet 10. Internet terminator 100 is basically a device for receiving subscriber terminals (30a, 30b, ...) to connect to the Internet (10). WAN port 111 is a port for connection from the Internet terminal 100 to the Internet 10.

The terminal port 112 is a port for accommodating subscriber stations 30a, 30b, ... in the Internet termination apparatus 100. There are a plurality of terminal ports 112 in the Internet termination apparatus 100, the Internet termination apparatus 100 distinguishes the subscriber terminal (30a, 30b, ...) through the port classification.

The subscriber station (30a, 30b, ...) is provided with a security search engine (31). The security search engine 31 is installed in the subscriber terminal (30a, 30b, ...) by the security management manager 110. The security search engine 31 checks the subscriber terminal (30a, 30b, ...) to check whether the virus infection, malicious code and the installation of spyware, and serves to continuously prevent infection.

In addition, when the security search engine 31 receives a status query from the security management manager 110, it responds through a status response. The status response is transmitted only when the security search engine 31 is normally installed and operated. Therefore, even if the security search engine 31 is installed, if it does not operate normally, the security search engine 31 is reinstalled by the security management manager (110). This is because, if the subscriber terminal (30a, 30b, ...) is infected with a virus or malicious code, even if the security search engine 31 is installed, it can be prevented from normal operation. Therefore, if this does not work properly in case of this, it is to be able to operate normally by reinstalling.

3A to 3B are diagrams illustrating message flows between subscriber stations 30a, 30b, ..., and the Internet termination apparatus 100 according to the present invention.

3A shows the message flow when the security search engine 31 is installed in the subscriber stations 30a, 30b, ..., and operates normally.

When the subscriber station 30a, 30b, ... attempts to access the Internet 10, the Internet termination apparatus 100 recognizes this. Recognition of attempts to access the Internet 10 by the subscriber station 30a, 30b, ... in the Internet termination apparatus 100 may vary depending on the implementation form of the Internet 10.

Typically, the Internet 10 may be classified into a case of using a floating IP (Internet Protocol) address method and a fixed IP address method.

When using a dynamic IP address, the Internet service provider typically uses Dynamic Host Configuration Protocol (DHCP). DHCP is a protocol for efficient use of IP address resources by dynamically allocating IP addresses to subscriber stations 30a, 30b,... That are connected to the Internet 10. The operation of DHCP is as follows.

When the terminal wishing to access the Internet 10 requests an IP address assignment, the DHCP server managing the IP address notifies the available IP address, and the terminal selects and notifies the IP address to be used. The DHCP server then assigns an IP address.

In the operation of DHCP, the subscriber station 30a, 30b, ... may transmit a message requesting an IP address, etc., as the attempt to access the Internet 10 of the subscriber station 30a, 30b, .... .

If you are using a static IP address, you can use another method to verify the connection attempt.

In the Internet 10, an Address Resolution Protocol (ARP) is used. In order to transmit information in a network such as the Internet 10, the physical layer address (MAC address, Media Access Control address) and IP address of the destination must be known. Therefore, a network provides a protocol for acquiring a MAC address corresponding to an IP address, and ARP is a representative example.

ARP supports the acquisition of a MAC address corresponding to the IP address or the acquisition of an IP address corresponding to the MAC address. When subscriber stations 30a, 30b, ... are connected to the Internet 10, subscriber stations 30a, 30b, ... need a gateway address for Internet access. Since the gateway address is a MAC address, the subscriber station 30a, 30b, ... obtains the gateway address through an ARP request.

That is, the subscriber station (30a, 30b, ...) is to determine the connection attempt in this case when the ARP request for obtaining the MAC address of the gateway.

In the present invention, the access attempt determination of the subscriber station (30a, 30b, ...) can be implemented in various forms according to the implementation intention of those skilled in the art in addition to such a method.

When the internet terminal 100 checks the access attempt of the subscriber terminal (30a, 30b, ...), and transmits a status query message confirming the installation and operation status of the security search engine (31). The subscriber station (30a, 30b, ...) is provided with a security search engine 31, and in the normal operation, the status response message of the security search engine 31 is transmitted. When the Internet termination apparatus 100 transmits a status response message, the Internet termination apparatus 100 allows the subscriber station 30a, 30b, ... to access the Internet 10.

3B shows the message flow when the security search engine 31 is not installed in the subscriber stations 30a, 30b, ..., or does not operate normally.

When the subscriber station 30a, 30b, ... attempts to access the Internet 10, the Internet termination apparatus 100 transmits a status query message to the security search engine 31 of the subscriber station 30a, 30b, .... At this time, since the security search engine 31 is not installed or the security search engine 31 does not operate normally in the subscriber terminals 30a, 30b, ..., the status response message is not transmitted.

The Internet terminal device 100 waits for a predetermined time and waits for a status response message to be transmitted. Then, after a predetermined time has elapsed, the Internet termination apparatus 100 transmits a message requesting the security search server 20 to the subscriber terminal 30a, 30b, ... to install the security search engine 31. The security search server 20 transmits the security search engine 31 to the subscriber terminal (30a, 30b, ...).

If the security search engine 31 is installed in the subscriber terminal (30a, 30b, ...), the Internet terminal 100 transmits a status query message to the subscriber terminal (30a, 30b, ...). Since the security search engine 31 is installed, the subscriber stations 30a, 30b,... May transmit a status response message to the Internet termination apparatus 100.

The Internet terminal 100 receiving the status response message allows the subscriber terminal 30a, 30b, ... to access the Internet 10.

4 is a flowchart illustrating the operation of the method for controlling the security search engine 31 using the Internet termination apparatus 100.

The security management manager 110 of the Internet terminal 100 is operated to operate the security search engine 31 control function (S2). It is confirmed that the access of the subscriber terminal 30a, 30b, ... is attempted while the security management manager 110 of the Internet terminal 100 is driven (S4). At this time, the operation of the Internet terminal 100 may be defined in more detail.

In other words, the Internet termination apparatus 100 is equipment for connecting subscriber terminals 30a, 30b, ... to the Internet 10. The Internet termination apparatus 100 has the same path through which subscriber stations 30a, 30b, ... attempt to connect to the Internet 10 and communicate after attempting to connect. That is, one subscriber terminal 30a connected to one port of the Internet termination apparatus 100 attempts to connect to the Internet 10 using one path and continuously communicates.

Therefore, a large number of packets are transmitted from the subscriber terminal 30a to the Internet termination apparatus 100, and the Internet termination apparatus 100 checks these packets and generates a packet related to DHCP or ARP. Judging by the connection attempt.

Therefore, when the subscriber stations 30a, 30b, ... transmit packets other than DHCP or ARP related packets to the Internet 10, since the subscriber stations 30a, 30b, ... have already attempted connection, the security search is performed. It is not checked whether the engine 31 is installed or not. Such an implementation may act as a security loophole of the Internet 10 when illegal subscriber terminals 30a, 30b,... That have not undergone connection attempts occur.

Therefore, the status information list can be added to the Internet termination apparatus 100 by applying the present invention. The status information list checks whether the security search engine 31 is installed and operated when the subscriber terminal 30a, 30b, ... attempts to connect, and stores whether it operates normally. In the status information list, the subscriber station 30a, 30b, ... has received the status query of the security search engine 31, and if the status response is performed normally, these items are recorded in the status information list. Subsequently, when a packet other than the connection attempt is generated in the subscriber stations 30a, 30b, ..., the Internet termination apparatus 100 does not attempt the connection, but the state of the subscriber terminals 30a, 30b, ... for the purpose of expanding security. Check by using the status information list.

By checking the status information list, communication is allowed only for the subscriber stations 30a, 30b,... That have performed the access attempt, status query, and status response procedure.

Such deformable parts in the operation of the present invention may be different according to the implementation intention of those skilled in the art, and parts that are not shown in the above example may be modified.

If the packet is transmitted from the subscriber terminal (30a, 30b, ...) to the Internet termination device 100 and the packet is confirmed to attempt to connect to the Internet (S4) (S4), the Internet termination device 100 is connected to the subscriber terminal (30a, 30b, Transmit a status query message (S6).

After transmitting the status query, the Internet termination apparatus 100 waits for a predetermined time and waits for reception of a status response message from subscriber stations 30a, 30b, ... (operation up to step S6). However, if the status response message is not transmitted even after a predetermined time period is exceeded (No at step S8), the Internet termination apparatus 100 requests the security search server 20 to install the security search engine 31. The security search engine 31 is installed in the terminals 30a, 30b, ... (S10).

The security search server 20 receiving the security search engine 31 installation request message of the Internet terminal device 100 transmits the security search engine 31 to the corresponding subscriber terminals 30a, 30b,... 30a, 30b, ...). In this case, the security search server 20 may use a program such as an ActiveX control. The ActiveX control is a program that connects a specific program to a browser and downloads a file or software. The security search server 20 uses the similar function program to connect the security search engine 31 to subscriber terminals 30a, 30b, and the like. …)

After the security search server 20 installs the security search engine 31 (after step S10), the Internet termination apparatus 100 bypasses the step S6 and transmits a status query message again.

When the status response message is received from the subscriber stations 30a, 30b, ... (YES in step S8), the Internet terminal device 100 allows the subscriber station 30a, 30b, ... access to the Internet 10. (S12).

5 is a view showing the format of a status query message and a status response message according to the present invention.

Status queries and response messages include a Version field, a Length field, a Message ID field, a Type field, and an Option field. The Version field records the protocol and version information used for the transmission of the status query message and the status response message. The Length field indicates the total length of the message. The Message ID field and the Type field are used to distinguish between the status query message and the status response message, and to record the contents of the message. The Option field is a field allocated for expansion as needed later.

As described above, the method and apparatus for controlling a security search engine using the Internet termination apparatus according to the present invention allow access according to whether or not the security search engine is installed and operated when the subscriber terminal accesses a network such as the Internet. It is effective to secure network security by ensuring that only subscriber terminals that have security are connected to the network, so that only subscriber terminals that have a security search engine installed and operated can access the network. Through this, it is effective to reduce network operator maintenance costs.

In addition, the security of the subscriber terminal has the effect that the subscriber can use the subscriber's terminal without fear of infection, such as viruses.

In addition, a preferred embodiment of the present invention is for the purpose of illustration, those skilled in the art will be able to various modifications, changes, substitutions and additions through the spirit and scope of the appended claims, such modifications and changes are the following claims It should be seen as belonging to a range.

Claims (12)

A first step of the security management manager of the internet terminal apparatus confirming an attempt to access the Internet by the subscriber terminal; Transmitting a status query message to the subscriber station attempting to access the Internet; A third step of installing a security search engine in the subscriber station and bypassing the second step if the status response message for the status query message is not received from the subscriber station; And And a fourth step of allowing the subscriber terminal to access the internet when receiving a status response message for the status query message from the subscriber terminal. The method of claim 1, wherein the attempt to connect to the Internet comprises: If the subscriber station uses a floating IP (Internet Protocol) address, the security search engine control method using the Internet terminal device characterized in that it determines the IP address request of the subscriber station as an access attempt. The method of claim 1, wherein the attempt to connect to the Internet comprises: When the subscriber station uses a fixed IP (internet protocol) address, the security search engine using an internet terminal device determines that a request for a MAC (Media Access Control) address of a gateway of the subscriber station is determined as an access attempt. Control method. The method of claim 1, wherein the security search engine, A method for controlling a security search engine provided in the subscriber terminal and preventing an infection of a malicious program including a virus, a hacking program, and a spy ware. The method of claim 4, wherein the status query message, A security search engine control method using an internet terminal device, characterized in that the subscriber terminal inquires whether the security search engine is installed or not. The method of claim 4, wherein the status response message is: The security search engine control using the Internet terminal device, characterized in that the security search engine is installed in the subscriber terminal and if the normal operation, the notification to the security management manager that the security search engine is operating. Way. If the subscriber station is provided in the Internet terminal device when attempting to access the Internet, the security management engine is installed on the subscriber station by using a status query message, the security management manager to allow the Internet access only when the normal operation Security search engine control device using an internet terminal device. The method of claim 7, wherein the security management manager, When the subscriber station uses a floating IP (Internet Protocol) address, the security search engine control apparatus using the Internet terminal device characterized in that it determines the IP address request of the subscriber station as an access attempt. The method of claim 7, wherein the security management manager, When the subscriber station uses a fixed IP (internet protocol) address, the security search engine using an internet terminal device determines that a request for a MAC (Media Access Control) address of a gateway of the subscriber station is determined as an access attempt. Control unit. The method of claim 7, wherein the state query message, And a security search engine installed in the subscriber terminal and querying whether the security search engine is operating normally. The method of claim 7, wherein the security search engine, Installed in the subscriber terminal, and prevents the infection of malicious programs including viruses, hacking programs (spyware) and spyware (warehousing) and the status response in the case of normal operation when receiving the message of the status query Security search engine control apparatus using the Internet terminal device, characterized in that for transmitting a message to the security management manager. The method of claim 7, wherein the security management manager, And a status information list for storing whether the security search engine is installed and whether or not the security search engine is installed for each subscriber station accommodated in the internet termination device.

Images