KR20190014958A - Apparatus and method for access control - Google Patents

Abstract

The present invention includes a control unit for determining whether or not to allow access to the web service based on information related to the web service determined in correspondence with the packet, and a control unit for allowing or blocking the transmission of the packet, Wherein if the packet is a first protocol-based packet, the control unit extracts information on the web service from the packet, and if the packet is a second protocol-based packet, based on a certificate extracted from the packet, To a connection control apparatus and method for a web service.

Description

[0001] APPARATUS AND METHOD FOR ACCESS CONTROL [0002]

The present invention relates to a connection control apparatus and method, and more particularly, in controlling an HTTPS-based connection, a connection to a requested web service is established based on a common name (CN) of a certificate included in a connection response And a connection control apparatus and method for controlling the connection or disconnection.

The network security device prevents or prevents a user terminal from being attacked by a malicious web service by allowing or blocking a connection request of the user terminal to various web services provided through the Internet.

For the most part, web services are provided at the request of a user terminal based on Hypertext Transfer Protocol (HTTP). Accordingly, a network security device operating in a company, a school, a public institution, or the like uses a host in a packet transmitted and received based on HTTP, address (URL) information of HTTP data, Block access.

Recently, for security reasons, there is an increasing number of Web services that allow users to access Web services through Hypertext Transfer Protocol over Secure Socket Layer (HTTPS), which uses encryption based on Secure Sockets Layer (SSL). In such a web environment, access control can not be performed in the same manner as in the HTTP based connection because the transmission / reception packet is encrypted. That is, to control the HTTPS-based web service connection, it decodes the packets transmitted and received to check the address (URL) information of the host and HTTP data in the decrypted packet, encrypts the packet again when the connection to the website is allowed, .

Such a packet decryption and re-encryption process leads to a delay in connection control processing and may involve an overload, which may lead to deterioration in the performance of network security equipment.

SUMMARY OF THE INVENTION The present invention provides a connection control apparatus and method for determining whether to allow a connection to a requested web service without performing a packet decryption and re-encryption process in an HTTPS-based web service connection do.

In addition, the present invention provides an access control apparatus and method for allowing or blocking access to a requested web service based on a CN of a certificate included in a connection response when accessing an HTTPS-based web service.

According to an aspect of the present invention, there is provided a connection control device for a web service, the communication control device including: a communication unit for transmitting and receiving a packet to and from the outside; And a control unit for determining whether or not to allow connection of the web service and allowing or blocking the transmission of the packet, wherein the control unit extracts information on the web service from the packet if the packet is a first protocol- If the packet is a second protocol-based packet, information on the web service is determined based on a certificate extracted from the packet.

In addition, the first protocol is HTTP (Hypertext Transfer Protocol), and the second protocol is HTTPS (Hypertext Transfer Protocol over Secure Socket Layer).

The control unit may extract information about the web service defined in the header of the packet if the packet is the first protocol-based packet.

If the packet is the second protocol-based packet, the control unit extracts a common name (CN) from the certificate included in the packet, and determines information about the web service from the extracted common name .

In addition, the information on the web service includes at least one of a host and a data address of the web service requested by the packet.

The first protocol based packet is a request packet for HTTP data transmitted from a user terminal, and the second protocol based packet is an authentication response packet transmitted from a server.

According to another aspect of the present invention, there is provided a connection control method performed by a connection control apparatus for a web service, the method comprising: determining a protocol of the packet when the packet is received from the outside; Obtaining information about a web service corresponding to the packet based on the determined protocol, and determining whether to allow access to the web service based on the information about the web service, Acquiring information about the web service from the packet if the protocol of the packet is the first protocol and extracting information about the web service from the packet if the protocol of the packet is the second protocol, And determining information about the web service by using the web service.

In addition, the first protocol is HTTP (Hypertext Transfer Protocol), and the second protocol is HTTPS (Hypertext Transfer Protocol over Secure Socket Layer).

The step of extracting information on the web service from the packet may include extracting at least one parameter defined in the header of the packet as information on the web service.

The step of determining information on the web service using the certificate extracted from the packet may include extracting the certificate included in the packet, extracting a common name (CN) from the certificate, And determining information about the web service from the extracted common name.

The connection control apparatus and method according to the present invention allow delays and load caused by packet decryption and re-encryption processes to be removed and quick access control can be performed in deciding whether to allow or block HTTPS based web service connection .

1 is a flowchart illustrating an HTTP-based access control method.
2 is a diagram showing an HTTP packet structure.
3 is a diagram showing an example of an HTTP packet header.
4 is a flowchart illustrating an HTTPS-based access control method.
5 is a diagram showing an HTTPS packet structure.
6 is a flowchart illustrating an HTTPS-based access control method according to the present invention.
7 is a diagram showing an example of an SSL certificate.
8 is a block diagram showing a configuration of a connection control apparatus according to the present invention.
9 is a flowchart showing a connection control method of the connection control apparatus according to the present invention.

In the description of the embodiments of the present invention, if it is determined that a detailed description of known configurations or functions related to the present invention can not be applied to the present invention, detailed description thereof may be omitted.

Quot ;, " include, "" include," as used herein. And the like are intended to indicate the presence of disclosed features, operations, components, etc., and are not intended to limit the invention in any way. Also, in this specification, "include." Or "have." , Etc. are intended to designate the presence of stated features, integers, steps, operations, components, parts, or combinations thereof, may be combined with one or more other features, steps, operations, components, It should be understood that they do not preclude the presence or addition of combinations thereof.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

Hereinafter, the present invention will be described with reference to the accompanying drawings.

1 is a flowchart illustrating an HTTP-based access control method.

Referring to FIG. 1, in HTTP based connection control, a user terminal (client) 1 performs a socket connection with a server 3 providing a web service (11). For example, when the user terminal 2 requests (SYN) a TCP session connection requesting HTTP data to the server 3, the server 3 sends a response to inform the user terminal 2 that the HTTP data is ready to be transmitted (SYN + ACK). The user terminal 2 completes the socket connection with the server 3 by sending a response (ACK) to the server 3 to inform itself that it is ready to receive HTTP data.

When the socket connection is completed, the user terminal 2 transmits an HTTP packet to the server 3 (12). Here, the HTTP packet may be transmitted as a request (request message) in order to receive desired HTTP data from the web service provided by the server 3. Or an HTTP packet may be sent as a request to upload data generated at the user terminal 2 to the server 3. [

The HTTP packet may be composed of an HTTP header (HTTP header) 21 and an HTTP body (HTTP body) 22, as shown in FIG. The HTTP header 21 includes a function 211, a Host 212, a Connection 213, a User-Agent 214, an Accept 215, a Referer 216, an Accept-Encoding 217), and the like.

Function 211 is a parameter that defines an HTTP function that defines an operation to be requested to the server 3 by the user terminal 2 and defines functions such as GET, POST, DELETE, PUT, UPDATE, and OPTIONS . 3 shows an example in which the GET function for defining the address of the HTTP data (HTTP page) that the user terminal 2 wants to request from the server 3 is used.

Host 212 is a parameter that defines information about the host corresponding to the current request. The Connection 213 is a parameter that defines how to process the socket connection after the current request is transmitted. When the connection is maintained, the connection 213 is defined as 'keep-alive' as shown in FIG. 3, Can be defined as 'close'.

The user-agent 214 is a parameter for defining information about the software (browser) used by the user terminal 2. Accept 215 is a parameter for defining information about the media type that the user terminal 2 can comprehend, The Referer 216 is a parameter for defining a Web service (Web link) address that immediately precedes the Accept-Encoding 217, and a Accept-Encoding 217 is a parameter for defining a compression method that the user terminal 2 can understand.

The HTTP packet transmitted from the user terminal 2 is received by the connection control apparatus 1 provided between the user terminal 2 and the server 3 and performing connection control to the server 3 of the user terminal 2 .

Upon receiving the connection request, the access control apparatus 1 analyzes the received HTTP packet and determines information about the requested web service (13).

In one example, the connection control apparatus 1 can determine the host of the requested web service and the address of the HTTP data. 3, the host is determined as t1.daumcdn.net with reference to the Host 212 parameter, and the address is determined as daumtop_deco / images / top / 2017 / txt_pctop_170410.png referring to the function 211 parameter .

The connection control apparatus 1 compares the information about the determined web service with the pre-stored connection control list and determines whether the web service can be accessed according to the request (14).

If it is determined that the web service is to be accessed, the connection control apparatus 1 transfers the received HTTP packet to the destination server 3 (15-1). The server 3 having received the HTTP packet from the connection control apparatus 1 transmits an HTTP packet including the requested HTTP data to the user terminal 2 in response to the request (15-2).

On the other hand, if it is determined that the connection of the Web service is to be interrupted, the connection control apparatus 1 can discard the received HTTP packet (16).

4 is a flowchart illustrating an HTTPS-based access control method.

Referring to FIG. 4, in the HTTPS-based access control, the user terminal 2 performs socket connection with the server 3 providing the web service (41). Since the socket connection process is the same as that described with reference to FIG. 1, a detailed description thereof will be omitted.

When the socket connection is completed, the user terminal 2 and the server 3 perform authentication (handshaking, Hand Shaking) (42).

Specifically, the user terminal 2 transmits an authentication request to the server 3 (421). Here, the authentication request corresponds to a client hello message, and in one embodiment, it may be an SSL connection request.

The server 3 transmits an authentication response to the authentication request to the user terminal 2 (422). Here, the authentication response may correspond to a server hello message. The authentication response is constituted by a certificate including the public key (Public Key) of the server 3.

The user terminal 2 having received the public key and the certificate verifies the received certificate (423). Based on the CA (Certification Authority) of the certificate, the user terminal 2 determines whether the certificate is signed by a trusted root CA, whether the date is valid, whether the certificate is relevant to the web service to be used And so on.

When the verification is successful, the user terminal 2 transmits a session key (a random key, a symmetric key, a secret key, a secret key) corresponding to the public key (Session Key, Random Key, Random Symmetric Encryption Key, , Encrypts it with the public key, and transmits it to the server 3 (424).

Through the authentication process, the user terminal 2 and the server 3 share a session key.

The connection control device 1 provided between the user terminal 2 and the server 3 and performing control of connection to the server 3 of the user terminal 2 acquires the public key, can do.

Thereafter, the user terminal 2 transmits an HTTPS packet to the server 3 (43). Here, the HTTPS packet may be transmitted as a request (request message) in order to receive desired HTTPS data from the web service provided by the server 3. Or an HTTPS packet may be sent as a request to upload data generated at the user terminal 2 to the server 3. [

The HTTPS packet includes an IP header 51, a TCP header 52, an SSL header 53 and an SSL body 54, as shown in FIG. ≪ / RTI > Here, the SSL body 54 may be configured to include an HTTP header 541 and an HTTP body 542 encrypted using the session key. The HTTP header 541 may include information on the web service corresponding to the request of the user terminal 2 as described above.

The HTTPS packet transmitted from the user terminal 2 is received by the connection control device 1. [

The connection control apparatus 1 which has received the connection request decrypts the received HTTPS packet (44). The connection control apparatus 1 can decrypt the HTTPS packet using the session key acquired in the authentication process between the user terminal 2 and the server 3. [

The access control apparatus 1 analyzes the decrypted HTTPS packet to determine information about the requested web service (45). In one example, the connection control apparatus 1 can determine the address of the host and HTTP data for the requested web service. The connection control apparatus 1 can determine information about the web service from the HTTP header extracted through the decryption.

The connection control apparatus 1 compares the information on the determined web service with the pre-stored connection control list and determines whether to permit the connection of the web service according to the request (46).

The connection control apparatus 1 re-encrypts the decrypted HTTPS packet using the session key (step 47-1), and transmits the re-encrypted HTTPS packet to the destination server 3 (47-2). The server 3 that has received the HTTPS packet from the connection control apparatus 1 decrypts the HTTPS packet using the shared session key and transmits an HTTPS packet including the requested HTTPS data to the user terminal 2 (47-3).

On the other hand, if it is determined that the connection of the Web service is to be blocked, the connection control apparatus 1 can discard the received HTTPS packet (48).

As described above, in the HTTPS-based access control, the process of decrypting and re-encrypting the HTTPS packet must be performed, thereby delaying the connection control process and accompanying the overload, thereby causing the performance degradation of the connection control apparatus 1 .

In order to solve such a problem, the present invention provides a method of performing access control based on a CN of a certificate upon HTTPS-based access control.

6 is a flowchart illustrating an HTTPS-based access control method according to the present invention.

Referring to FIG. 6, in the HTTPS-based access control method according to the present invention, at the authentication step between the user terminal 200 and the server 300, it is determined whether or not to allow access to the Web service in advance based on the CN included in the certificate do.

Specifically, after the socket connection is completed (61), the user terminal (200) and the server (300) perform authentication (62).

Specifically, the user terminal 200 transmits an authentication request to the server 300 (621). Here, the authentication request corresponds to a client hello message, and in one embodiment, it may be an SSL connection request.

The server 300 transmits an authentication response to the authentication request to the user terminal 200 (622). Here, the authentication response corresponds to the server hello message, and may be constituted by a certificate including a public key.

The authentication response sent from the server 300 may be received at the connection control apparatus 100. [

Upon receiving the authentication response, the access control apparatus 100 can determine the information about the requested web service based on the CN included in the certificate (623). In one example, the connection control apparatus 100 can determine the host and HTTP data address of the requested web service from the CN included in the certificate.

The certificate included in the authentication response includes a certificate status, a version, a serial number, an issuer, a subject, a validity period, ), Information on the public key of the certificate subject (Subject public key), and the like.

Here, the certificate subject, for example, the CN of the server 300 is defined in the certificate subject field. The CN defines the name of the proof object, and is generally created based on the domain of the web service provision server 300 to which the corresponding certificate is issued. The domain used to define the CN is representative information about the web service provided by the corresponding server 300, and is at least partially identical to the HTTP-based host and the HTTP data address. Accordingly, the connection control apparatus 100 can determine the information about the requested web service, for example, the host and the address of the web service, from the CN in the certificate.

The connection control apparatus 100 compares the information about the web service determined based on the CN with the pre-stored connection control list, and determines whether to permit the connection of the web service according to the request (624).

If it is determined that the web service is to be accessed, the connection control apparatus 100 may forward the received authentication response to the user terminal 200 (625-1).

When the authentication response is transmitted, the user terminal 200 and the server 300 complete authentication through the certificate validation 625-2 and the session key transmission 625-3 of the user terminal 200, An HTTPS packet can be transmitted / received using the shared session key (625-4).

On the other hand, if it is determined to block the connection of the Web service, the connection control apparatus 100 may discard the received authentication response (626). The connection control apparatus 100 may further transmit a notification message to the user terminal 200 to notify the connection disconnection or connection failure.

According to the present invention, in determining whether to allow or block HTTPS-based web service connection, the connection control apparatus 100 removes delay and load caused by the packet decryption and re-encryption process and performs quick access control .

8 is a block diagram showing a configuration of a connection control apparatus according to the present invention.

In various embodiments of the present invention, the access control apparatus 100 is a security device that operates in a network, for example, a firewall, an Intrusion Detection System (IDS), an Intrusion Prevention System (IPS) (PMS), Enterprise Security Management (ESM), Web Application Firewall (WAF), eXtensible Unified Threat Management (XTM), and the like. However, the technical idea of the present invention is not limited to this, and the present invention can be applied to various network devices installed to allow or block access between terminals, servers, and the like in the network.

Referring to FIG. 8, the connection control apparatus 100 according to the present invention may include a communication unit 110, a control unit 120, and a storage unit 130.

The communication unit 110 can perform data communication with an external terminal, a server, and the like through a network to which the connection control apparatus 100 is connected using wire / wireless communication technology. The communication unit 110 may include at least one communication module for processing a packet received from the outside and transmitting the packet to the control unit 120, a communication interface, and the like.

In various embodiments of the present invention, the communication unit 110 may acquire a packet transmitted / received between the user terminal 200 and the server 300 during the authentication process or the HTTP / HTTPS data exchange process, and may transmit the packet to the control unit 120.

The control unit 120 controls each component of the connection control apparatus 100 to perform the connection control operation according to the present invention.

In various embodiments of the present invention, when a packet for accessing an HTTP-based web service is received through the communication unit 110, the control unit 120 may extract information about the web service from the HTTP header of the received packet. Here, the packet for HTTP based web service connection may be an HTTP packet. The control unit 120 compares the information about the extracted web service with the pre-stored connection control list to determine whether to allow the request of the web service by the received packet.

For example, when the connection control list includes information of a web service to be blocked, the controller 120 determines that the web service request is to be blocked if information about the determined web service is included in the connection control list And if the information about the determined web service is not included in the access control list, it can be determined that the request for the corresponding web service is allowed.

On the other hand, when the connection control list includes the information of the web service to be permitted to be connected, the control unit 120 determines that the information about the determined web service is included in the connection control list, And if the information on the determined web service is not included in the access control list, it can be determined to block the request of the corresponding web service.

If it is determined that the request for the web service is to be accepted, the control unit 120 may control the communication unit 110 to transmit the received packet to the destination. On the other hand, if it is determined that the connection to the web service should be blocked, the control unit 120 may control the communication unit 110 to discard the received HTTP packet or to transmit a notification message indicating that the connection is blocked or failed have.

In various embodiments of the present invention, when a packet for HTTPS-based web service connection is transmitted through the communication unit 110, the control unit 120 may extract the CN from the received packet's certificate. Here, the packet for HTTPS-based web service connection may be an authentication response transmitted and received in the authentication process. The control unit 120 may determine information about the requested web service from at least a part of the extracted CN or CN. The control unit 120 compares the information about the determined web service with the pre-stored connection control list to determine whether to allow the request of the web service based on the received packet.

More specifically, the operation of the control unit 120 is the same as that described above with reference to Figs. 1 to 7.

The storage unit 130 stores an operating system, a module, an application program, and the like for operating the connection control apparatus 100 or temporarily or permanently stores input / output data generated in the connection control apparatus 100 Can be stored.

The storage unit 130 may be a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, an SD or xD memory A static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM) Magnetic disk, magnetic disk, magnetic disk, or optical disk.

In various embodiments of the present invention, the storage unit 130 may store, as a connection control list, information (black list) about the domain (white list) and / or domains for which the web service access is to be blocked You can save and manage. The access control list may store a domain name, a host, an address, and the like of a domain in which a web service connection is allowed and / or blocked.

 The information on the domain in which the web service connection is permitted or blocked may be received from the outside via the network or directly from the manager of the connection control apparatus 100. [

9 is a flowchart showing a connection control method of the connection control apparatus according to the present invention.

Referring to FIG. 9, the connection control apparatus 100 according to the present invention determines whether a received packet is an HTTP-based packet (902) when receiving a packet from the outside (901). For example, the connection control apparatus 100 can determine whether or not the packet includes an HTTP header that is not encrypted.

If the received packet is an HTTP-based packet, the connection control apparatus 100 extracts information on the web service from the received packet (903). Here, the HTTP-based packet may be a request packet for requesting an HTTP-based web service, and the information about the web service may be a host and an address extracted from the header.

On the other hand, if the received packet is not an HTTP based packet, the connection control apparatus 100 determines whether the received packet is an HTTPS based packet (904). For example, the connection control apparatus 100 can determine whether a packet is encrypted, whether it contains an SSL header, whether it contains an encrypted HTTP packet, and the like.

If the received packet is an HTTPS-based packet, the access control apparatus 100 extracts the certificate from the received packet (905). Here, the HTTPS-based packet may be an authentication response packet for HTTPS-based authentication.

The connection control apparatus 100 determines information about the web service based on the CN included in the certificate (906). Here, the information on the web service may be a host and an address determined based on the CN.

The connection control apparatus 100 determines whether the connection is allowed (or blocked) based on information about the extracted or determined web service (907). The connection control apparatus 100 compares the information about the web service with the pre-stored connection control list and determines whether or not to allow connection of the web service using the packet.

If the connection is allowed (908), the access control apparatus 100 delivers the received packet to the destination (909). On the other hand, if the connection is not allowed, the connection control apparatus 100 may perform a blocking operation such as discarding the received packet or transmitting a notification message indicating that connection is blocked or connection failure to the terminal that transmitted the packet (910).

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. Accordingly, the scope of the present invention should be construed as being included in the scope of the present invention, all changes or modifications derived from the technical idea of the present invention.

100: Connection control device
110:
120:
130:
200: user terminal
300: server

Claims (10)

A connection control device for a web service,
A communication unit for transmitting and receiving a packet with the outside; And
And a control unit for determining whether or not the connection of the web service is permitted based on the information about the web service judged corresponding to the packet to allow or block the transmission of the packet,
Wherein,
If the packet is a first protocol-based packet, information on the web service is extracted from the packet. If the packet is a second protocol-based packet, information on the web service is determined using a certificate extracted from the packet And the connection control device. 2. The method of claim 1,
HTTP (Hypertext Transfer Protocol)
Wherein the second protocol comprises:
(Hypertext Transfer Protocol over Secure Socket Layer). The apparatus of claim 1,
And if the packet is the first protocol-based packet, extracts information on the web service defined in the header of the packet. The apparatus of claim 1,
Extracting a common name (CN) from the certificate included in the packet if the packet is the second protocol-based packet, and determining information about the web service from the extracted common name controller. 2. The method of claim 1,
And at least one of a host and a data address of the web service requested by the packet. 2. The method of claim 1, wherein the first protocol-
A request packet for HTTP data transmitted from a user terminal,
Wherein the second protocol-
And the authentication response packet is an authentication response packet transmitted from the server. A connection control method performed by a connection control apparatus of a web service,
Determining a protocol of the packet when the packet is received from the outside;
Obtaining information on a web service corresponding to the packet based on the determined protocol; And
Determining whether or not the connection of the web service is permitted based on the information about the web service,
Wherein acquiring information about the web service comprises:
If the protocol of the packet is a first protocol, extracting information on the web service from the packet; And
And if the protocol of the packet is the second protocol, determining information about the web service using the certificate extracted from the packet. 8. The method of claim 7,
HTTP (Hypertext Transfer Protocol)
Wherein the second protocol comprises:
(Hypertext Transfer Protocol over Secure Socket Layer). 8. The method of claim 7, wherein extracting information about the web service from the packet comprises:
And extracting at least one parameter defined in a header of the packet as information on the web service. The method of claim 7, wherein the step of determining information about the web service using the certificate extracted from the packet comprises:
Extracting the certificate included in the packet;
Extracting a common name (CN) from the certificate; And
And judging information about the web service from the extracted common name.

Images