KR20080100620A - Firewall gateway and security policy management method and computer program recording media - Google Patents

Abstract

The present invention relates to a firewall gateway, a security policy management method at the firewall gateway, and a computer program recording medium for realizing the method. A plurality of firewall means which are formed independently for each service request of the service block to block or grant the service request according to a security policy; Shared memory shared by the plurality of firewall means; Policy processing means for reading a security policy stored in a security policy DB and storing it in the shared memory; And access path storage means for storing an access path for accessing a security policy recorded in the shared memory, wherein the plurality of firewall means inquires a path stored in the access path storage means to the shared memory. Access and refer to the security policy. According to the present invention, it is possible to reduce the load on the policy DB and to efficiently distribute and use resources.

Description

FIREWALL GATEWAY, SECURITY POLICY MANAGEMENT METHOD AND COMPUTER PROGRAM RECORDING MEDIUM}

1 is a block diagram of a gateway according to an embodiment of the present invention.

2 is a flowchart illustrating a method of managing a security policy in a gateway according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: policy management module 120: policy DB

130: policy processing module 140: shared memory

150: policy access path storage unit 160: firewall module

The present invention relates to a gateway, and more particularly, to a firewall gateway, a method for managing security policies at the firewall gateway, and a recording medium recording a computer-readable program for realizing the method.

Firewall in the Internet environment refers to a program, device, etc. to protect a specific network from attacks from external networks. The firewall prevents illegal traffic from outside and allows only authorized traffic. It can be called an active defense measure.

That is, the firewall gateway is installed at the end of a specific network to determine whether to connect the client to the specific network by using an access permission rule. If the client connection does not satisfy the access permission rule, the client refuses the connection and disconnects. If the client access rule is satisfied, the client is allowed to connect to the real server.

Meanwhile, such a firewall gateway refers to the policy DB to block packets entering a specific network according to a predetermined policy. That is, it collects the information of the input packet and compares it with the security policies stored in the policy DB and blocks the packet if it is not an authorized packet. However, in the firewall gateway, each process is driven for each client connection to independently perform packet verification. In other words, the client connection service is handled using a multiprocessing method. As a result, each process of the firewall gateway frequently accesses a single policy DB, and the policy DB is heavily loaded, causing delays in service processing of the firewall gateway.

The present invention has been proposed in order to solve the above problems, the gateway to allow the service process to be shared with each other by storing the security policy stored in the policy DB in the shared memory to reduce the service processing load and to efficiently distribute and use resources; It is an object of the present invention to provide a method of managing a security policy at the gateway, and a recording medium recording a computer-readable program for realizing the method.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

According to a first aspect of the present invention for achieving the above object, a gateway for protecting an internal network from an external network is formed independently for each service request from the external network to block or permit the service request according to a security policy. Multiple firewall means; Shared memory shared by the plurality of firewall means; Policy processing means for reading a security policy stored in a security policy DB and storing it in the shared memory; And access path storage means for storing an access path for accessing a security policy recorded in the shared memory, wherein the plurality of firewall means inquires a path stored in the access path storage means to the shared memory. Access and refer to the security policy.

Preferably, the gateway further comprises: update management means for managing the update of the security policy stored in the security policy DB, wherein the policy processing means, when receiving a security policy update notification from the update management means, the security The update security policy stored in the policy DB may be read, stored in the shared memory, and the access path may be updated.

In addition, according to a second aspect of the present invention for achieving the above object, a security policy management method in a gateway that protects an internal network from an external network, the step of reading the security policy stored in the security policy DB stored in the shared memory ; Storing an access path for accessing a security policy recorded in the shared memory; And blocking or granting a service request from the external network with reference to the security policy stored in the shared memory with reference to the access path.

Preferably, updating the security policy stored in the security policy DB; Reading an updated security policy from the security policy DB and storing the updated security policy in the shared memory; And updating an access path for accessing the security policy.

In addition, according to a third aspect of the present invention for achieving the above object, a recording medium having a computer-readable program for realizing the method, reads the security policy stored in the security policy DB and stored in a shared memory First function; A second function of storing an access path for accessing a security policy recorded in the shared memory; And a third function of blocking or allowing a service request from the external network by referring to a security policy stored in the shared memory with reference to the access path.

Preferably, the recording medium comprises: a fourth function of updating a security policy stored in the security policy DB; A fifth function of reading an updated security policy from the security policy DB and storing it in the shared memory; And a sixth function of updating an access path for accessing the security policy.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a gateway according to an embodiment of the present invention.

As shown in FIG. 1, the gateway according to the present invention includes a policy management module 110, a policy DB 120, a policy processing module 130, a shared memory 140, a policy access path storage unit 150, and It includes a number of firewall modules 160.

The policy management module 110 stores and manages the policy in the policy DB 120 according to an administrator's input. In addition, the policy management module 110 updates the policy stored in the policy DB 120 according to an administrator's input. When the policy stored in the policy DB 120 is updated, the policy management module 110 transmits the update signaling to the policy processing module 130.

The policy processing module 130 reads the policy stored in the policy DB 120 in association with the policy management module 110 and stores the policy in the shared memory 140. In particular, when a policy stored in the policy DB 120 is updated, the policy processing module 130 receives the update signaling from the policy management module 110 and updates the policy updated in the policy DB 120 according to the update signaling. Read it and store it in shared memory 140. At this time, the policy processing module 130 stores the updated policy in a memory area that does not overlap with the pre-update policy stored in the shared memory 140, and deletes the existing policy from the shared memory 140. Deletion of the existing policy may be performed simultaneously with storing the updated policy in the shared memory 140, or at a time interval. Preferably, if the firewall module 160 refers to an existing policy of the shared memory 140, the existing policy is deleted from the shared memory 140 after the policy reference is completed.

The policy access path storage unit 150 stores the storage area address of the shared memory 140 that the firewall module 160 needs to access to refer to the policy in cooperation with the policy processing module 130. When an update of the policy stored in the policy DB 120 occurs, the policy processing module 130 reads the updated policy stored in the policy DB 120 and stores the updated policy in an area of the shared memory 140 that does not overlap with the existing policy. At the same time, the policy processing module 130 transmits the area address of the shared memory 140 in which the updated policy is stored to the policy access path storage unit 150, and the policy access path storage unit 150 is the policy processing module 130. Stores the area address of the shared memory 140 stored in the update policy delivered from. The policy access address stored in the policy access path storage unit 150 is referenced by the firewall module 160.

The firewall module 160 blocks or permits the packet generated and transmitted from the client for each client access. That is, firewall modules 160 are generated as many as the number of connected clients, and each firewall module 160 blocks or permits the packets transmitted from the clients in comparison with the security policy. At this time, each firewall module 160 reads a policy by accessing the shared memory 140 with reference to the policy access address stored in the policy access path storage unit 150. When the policy is updated and the updated policy is stored in an area of the shared memory 140 that is not duplicated with the area where the existing policy is stored, the access address of the storage area where the updated policy is stored is the policy access path storage unit. Stored at 150, each firewall module 160 references a new policy rather than an existing policy according to its new policy access address.

2 is a flowchart illustrating a method of managing a security policy in a gateway according to an embodiment of the present invention, and illustrating a method of storing and updating a policy in a shared memory. It demonstrates with reference to FIG.

As shown in FIG. 2, when the security policy is stored in the policy DB 120 by the policy management module 110, the policy management module 110 transmits a security policy setting signal to the policy processing module 130 ( S201).

Accordingly, the policy processing module 130 reads the security policy stored in the policy DB 120 and allocates any area of the shared memory 140 to store the read security policy (S203).

Then, the policy processing module 130 transmits and stores the area address of the shared memory 140 storing the security policy to the policy access path storage unit 150 (S205). That is, the policy access path storage unit 150 stores the security policy access address for accessing the security policy.

Next, when the security policy stored in the policy DB 120 is updated by the policy management module 110, the policy management module 110 transmits the security policy update signaling to the policy processing module 130 (S207).

The policy processing module 130 that receives the security policy update signaling from the policy management module 110 reads the updated security policy from the policy DB 120 and stores the existing security policy in the shared memory 140. A predetermined area is allocated among the remaining areas except for storing the updated security policy (S209).

Subsequently, the policy processing module 130 transfers and updates the region address of the shared memory 140 storing the updated security policy to the policy access path storage unit 150 (S211). The policy access path storage unit 150 updates the previously stored security policy access address to the address of the shared memory 140 in which the updated security policy is stored.

On the other hand, the policy processing module 130 deletes the existing security policy stored in the shared memory 140 before the update (S213).

Accordingly, when a plurality of firewall modules 160 receive a packet from an external network, the shared memory 140 may update the updated security policy instead of the existing security policy by referring to the policy access address information set in the policy access path storage unit 150. Block or permit the received packet with reference to.

As described above, according to the present invention, when receiving a packet from an external network, the packet is blocked or permitted by referring to the shared memory 140 without referring to the policy DB 120. Accordingly, the gateway can reduce the load and provide fast service as compared with the conventional art. According to the present invention, the updated security policy is stored in the shared memory 140 area that does not conflict with the existing security policy and the existing security policy is deleted when the security policy is updated, thereby maintaining the security policy of the shared memory 140 and maintaining the memory. It can be distributed and used efficiently without waste.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

The present invention as described above, by sharing the policy data through the shared memory for firewall processing, there is an effect that can be used to reduce the load and efficiently distribute resources. In particular, when the update of the policy data occurs, by converting the policy data stored in the shared memory into the updated policy data, it is possible to efficiently use the limited shared memory.

Claims (8)

A gateway that protects your internal network from external networks. A plurality of firewall means independently formed for each service request from the external network to block or grant the service request according to a security policy; Shared memory shared by the plurality of firewall means; Policy processing means for reading a security policy stored in a security policy DB and storing it in the shared memory; And And access path storage means for storing an access path for accessing the security policy recorded in the shared memory. And the plurality of firewall means inquires a path stored in the access path storage means to access the shared memory to refer to a security policy. The method of claim 1, Update management means for managing the update of the security policy stored in the security policy DB; The policy processing means, Upon receiving a security policy update notification from the update management means, reads an update security policy stored in the security policy DB, stores it in the shared memory, and updates the access path. The method of claim 2, The policy management means, And deleting an existing security policy stored in the shared memory after a security policy update. A security policy management method in a gateway that protects an internal network from an external network. Reading the security policy stored in the security policy DB and storing it in the shared memory; Storing an access path for accessing a security policy recorded in the shared memory; And Blocking or granting a service request from the external network with reference to the security policy stored in the shared memory with reference to the access path. The method of claim 4, wherein Updating a security policy stored in the security policy DB; Reading an updated security policy from the security policy DB and storing the updated security policy in the shared memory; And And updating an access path for accessing the security policy. The method of claim 5, wherein Deleting an existing security policy stored in the shared memory; Security policy management method further comprising a. At the gateway, which manages security policies and protects the internal network from external networks, A first function of reading a security policy stored in the security policy DB and storing the same in a shared memory; A second function of storing an access path for accessing a security policy recorded in the shared memory; And And a third function of blocking or granting a service request from the external network by referring to a security policy stored in the shared memory with reference to the access path. The method of claim 7, wherein A fourth function of updating a security policy stored in the security policy DB; A fifth function of reading an updated security policy from the security policy DB and storing it in the shared memory; And And a sixth function of updating an access path for accessing the security policy.

Images