WO2020251166A1

WO2020251166A1 - Internet use method in network separation environment and device therefor

Info

Publication number: WO2020251166A1
Application number: PCT/KR2020/005940
Authority: WO
Inventors: 정원치; 박남제
Original assignee: 제주대학교 산학협력단
Priority date: 2019-06-14
Filing date: 2020-05-06
Publication date: 2020-12-17
Also published as: KR102167027B1

Abstract

An Internet use method in a network separation environment and a device therefor are disclosed. A business network terminal transmits an Internet address to an Internet network terminal through an inter-network data transmission method, and the Internet network terminal scraps a website corresponding to the Internet address, converts the scraped website into an electronic document, and transmits the electronic document to the business network terminal.

Description

Internet usage method and device in network separation environment

An embodiment of the present invention relates to a method and apparatus for using the Internet in a network separation environment in which a business network and an Internet network are separated from each other, and more particularly, to a method and apparatus for using the Internet in a business network.

In places where security is required, such as financial institutions, public institutions, or state institutions, the internal business network is separated from the Internet to fundamentally block attacks such as hacking or malicious code. In the network separation environment, the business network and the Internet network are separated, so the business network terminal cannot directly access the Internet. When Internet data are needed, the person in charge has the inconvenience of having to retrieve the Internet data using an Internet network terminal and then put it in a storage medium (eg, USB) and transmit it to the work network terminal.

A technical problem to be achieved by an embodiment of the present invention is to provide a method and an apparatus for using the Internet in a network separation environment.

An example of an Internet use method in a network separation environment according to an embodiment of the present invention for achieving the above technical problem is, in the Internet use method in a network separation environment in which a business network and an Internet network are separated, the business network terminal Transmitting an Internet address to an Internet network terminal through an inter-network data transmission method; Scraping, by the internet network terminal, a website corresponding to the internet address; The Internet network terminal converting the scraped data into an electronic document; And transmitting, by the Internet terminal, the electronic document to the business network terminal through the network data transmission method.

An example of an Internet network terminal in a network separation environment according to an embodiment of the present invention for achieving the above technical problem is a method for transmitting data between networks in a network separation environment by transmitting an Internet address transmitted by a business network terminal located in a business network. An address receiver to receive through; A scraping unit for scraping a website corresponding to the internet address; A document generator for converting the scraped data into an electronic document; And a transmission unit for transmitting the electronic document to the business network terminal through the network data transmission method.

In order to achieve the above technical problem, an example of a business network terminal in a network separation environment according to an embodiment of the present invention is an address transmission unit that transmits an Internet address to an Internet network terminal through an inter-network data transmission method in a network separation environment. ; A document receiving unit for receiving data scraped from a site corresponding to the Internet address in an electronic document form through the data transmission method from the Internet network terminal; And a document display unit for displaying the received document.

According to an embodiment of the present invention, data of an external Internet network can be easily obtained while adhering to the principle of the basic environment of network separation in a business network terminal.

1 is a diagram showing an example of a network separation environment according to an embodiment of the present invention;

2 and 3 are diagrams showing an example of a data transmission system in a network separation environment according to an embodiment of the present invention;

4 is a diagram showing an example of a method of using the Internet in a network separation environment according to an embodiment of the present invention;

5 is a diagram showing an example of a method for converting an electronic document according to an embodiment of the present invention;

6 is a diagram showing an example configuration of an Internet network terminal in a network separation environment according to an embodiment of the present invention, and,

7 is a diagram illustrating an example configuration of a business terminal in a network separation environment according to an embodiment of the present invention.

Hereinafter, a method and apparatus for using the Internet in a network separation environment according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an example of a network separation environment according to an embodiment of the present invention.

Referring to FIG. 1, the business network 100 and the Internet network 130 are separated from each other, and the business network terminal 110 located in the business network 100 and the Internet network terminal 140 located in the Internet network 130 Exchanges data with each other through the data transmission system 120 through a predefined inter-network data transmission method. Separation of the business network 100 and the Internet network 130 may be physical or logical. In a network separation environment, the business network terminal 110 cannot directly access the Internet.

The business network terminal 110 and the Internet network terminal 140 are computing devices and may be implemented as a general computer or server. In the present embodiment, for convenience of explanation, one

terminal

110 and 140 are respectively shown in the business network 100 and the Internet network 130, but a plurality of terminals may be located in each

network

100 and 130 according to the embodiment. have.

A data transmission system 120 exists between the two networks for data exchange between the business network 100 and the Internet network 130. For example, if the business network 100 and the Internet network 130 are physically or logically separated, the data transmission system 120 may physically or logically connect the business network 100 and the Internet network 130 as necessary. It can connect and exchange data between the two

networks

100 and 130 according to a predefined security policy. An example of the data transmission system 120 is shown in FIGS. 2 and 3.

2 and 3 are diagrams showing an example of a data transmission system in a network separation environment according to an embodiment of the present invention.

Referring to FIG. 2, the data transmission system 120 includes a first control server 200, a shared storage 210 and a second control server 220. The business network 100 and the Internet network 130 are logically separated by a first control server 200 and a second control server 220.

The first control server 200 and the second control server 220 are servers to which a security policy or data transmission policy for implementing a network separation environment between the business network 100 and the Internet network 130 is applied. The first control server 200 is connected to the business network 100, and stores data received from the business network terminal 110 in the shared storage 210 or reads data stored in the shared storage 210 100). The second control server 220 is connected to the Internet network 130 and stores the data received from the Internet network terminal 140 in the shared storage 210 or reads the data stored in the shared storage 210 to the Internet network terminal. send.

When the Internet network terminal 140 wants to transmit data to the business network terminal, the Internet network terminal 140 transmits the data to the second control server 220, and the second control server 220 is an Internet network terminal ( 140) is stored in the shared storage 210 according to a predefined security policy or data transmission policy. The business network terminal 110 reads data stored in the shared storage 210 by the Internet network terminal 140 through the first control server 200. The same method using the shared storage 210 is applied even when the business network terminal 110 wants to transmit data to the Internet network terminal 140.

Referring to FIG. 3, the data transmission system 120 includes a first control server 300, a relay server 310, and a second control server 320. The relay server 310 is not connected to the first control server 300 and the second control server 320 at the same time, but through the automatic switching switch 330, among the first control server 300 and the second control server 320 It is connected with either. That is, when the relay server 310 is connected to the first control server 300, the connection with the second control server 320 is disconnected, and conversely, when the relay server 310 is connected to the second control server 320, the connection with the first control server 300 The connection is broken.

When the Internet network terminal 140 wants to transmit data to the business network terminal 110, the relay server 310 controls the automatic switching switch 330 to be connected to the second control server 320 and the second control server 320 provides the data received from the Internet network terminal 140 to the relay server 310. And the relay server 310 controls the automatic switching switch 330 to disconnect from the second control server 320 and connects with the first control server 300. Thereafter, the business network terminal 110 may receive the data transmitted by the Internet network terminal 140 from the relay server 310. When the business network terminal 110 wants to transmit data to the Internet network terminal 140, the procedure is reversed.

Referring to FIGS. 2 and 3, the data transmission system 120 is only an example for helping understanding of a data transmission method in a network separation environment to which an embodiment of the present invention is applied. It is not limited to the transmission system 120. There are various conventional techniques for data transmission between networks in a network separation environment, and an embodiment of the present invention can use various conventional data transmission methods between networks.

4 is a diagram illustrating an example of a method of using the Internet in a network separation environment according to an embodiment of the present invention.

4, the business network terminal 110 transmits the Internet address of a site to be accessed to the Internet network terminal 140 through a predefined inter-network data transmission method (S400, S410). For example, since direct communication between the business network terminal 110 and the Internet network terminal 140 is impossible, the business network terminal 110 uses the data transmission system 120 as shown in FIG. 2 or 3 to provide an Internet address. Is transmitted to the Internet network terminal 140. In this embodiment, the Internet address refers to all types of addresses that can be used for Internet access, such as a URL (Uniform Resource Locator) address or an IP (Internet Protocol) address.

The Internet network terminal 140 accesses the corresponding site based on the Internet address received through the data transmission system 120 and scrapes the data (S420). For example, if your internet address is'www.google.com'. The Internet network terminal 140 accesses the corresponding site and scrapes data using an Internet browser such as Explorer or Chrome. As another example, the Internet network terminal 140 may scrape data of an Internet site using a headless mode of an Internet browser.

Since the data scraped by the Internet network terminal 140 from the Internet site may contain malicious code, it is not desirable to directly transmit the scraped data to the business network. Accordingly, the Internet network terminal 140 converts the scraped data into an electronic document form in which malicious codes or the like cannot exist (S430). As an example, the Internet network terminal 140 may convert the scraped data into a PDF file or an image file. In another embodiment, if the format of the data exchanged between the two networks is determined according to the policy of the inter-network data transmission method applied to the data transmission system 120, the Internet network terminal 140 uses the scraped data in a predefined data format. It can be converted to an electronic document.

The Internet network terminal 140 provides the electronic document to the business network terminal 110 through the network data transmission method of the data transmission system 120 (S440, S450). When the business network terminal 110 receives the electronic document (S450), it displays it on the screen (S460). Therefore, while adhering to the basic principle of the network separation environment, the user of the business network terminal 110 can obtain the same effect as having directly connected to the Internet.

5 is a diagram illustrating an example of a method for converting an electronic document according to an embodiment of the present invention.

Referring to FIG. 5, data scraped by accessing the Internet network terminal 140 to an Internet site is Internet data such as an HTML document 500. The Internet network terminal 140 converts the HTML document 500 into an electronic document 510 such as a PDF document or an image document. For example, the Internet network terminal 140 may generate an Internet site screen displayed on an Internet browser as a PDF document or an image document. In this case, the Internet network terminal 140 may directly generate the content of the site as an electronic document 510 such as an image without the need to display the Internet site on the Internet browser.

Internet sites may contain links. For example, when accessing the'Naver' site, the user can click various links on the'Naver' site to move to other sites or view other web pages. However, there is no link in an electronic document that converts the screen of an Internet site into an image. In this case, the business network terminal 110 cannot access another web page through a link connected to a specific word or button in the Internet site, like a general Internet connection.

Accordingly, in another embodiment, the Internet network terminal 140 identifies link information (eg, Internet address, etc.) 520 included in the scraped data, and then creates and adds it as an electronic document such as a PDF file or an image file. Can provide. For example, if the Internet site A includes link information 520 that allows access to the Internet site B, the Internet network terminal 140 uses the data scraped from the Internet site A to the first electronic document 510 such as an image. In addition, the link information of the Internet site B included in the Internet site A (that is, the Internet address of the Internet site B) 520 is generated as a second electronic document such as an image and provided to the business network terminal 110 together. I can.

As another example, the Internet network terminal 140 may generate a first electronic document and a second electronic document as one electronic document. For example, the Internet network terminal 140 may generate an electronic document 510 in which link information 520 such as a URL address is additionally displayed in a portion where a link exists in data of an Internet site. That is, if there is a link in the word'shopping', the internet network terminal may display the internet address of the link in overlap with or around the'shopping'. The user of the business network terminal 110 may provide the Internet address of the link to the Internet network terminal 140 to receive the data of the Internet site indicated by the link again.

6 is a diagram illustrating an example configuration of an Internet network terminal in a network separation environment according to an embodiment of the present invention.

Referring to FIG. 6, the Internet network terminal 140 includes an address receiving unit 600, a scraping unit 610, a document generating unit 620 and a transmitting unit 630. Each component of the present embodiment may be implemented as an agent that is a program operable on a computing device.

The address receiver 600 receives the Internet address transmitted by the business network terminal 110 through a data transmission method between networks in a network separation environment.

The scraping unit 610 accesses an Internet site based on an Internet address and scrapes data. The scraping unit 610 may access an Internet site and scrap data through the headless mode of the Internet browser.

The document generation unit 620 converts the scraped data into an electronic document such as a PDF document or an image document. For example, the document generator 620 may generate the screen itself displayed on the Internet browser as an image document.

As another example, the document generator 620 may create an electronic document with link information included in the scraped data. For example, the document generating unit 620 may add link information to the electronic document when converting the scraped data into an electronic document.

Referring to FIG. 7, the business terminal 110 includes an address transmission unit 700, a document receiving unit 710, and a document display unit 720. Each component of the present embodiment may be implemented as a program operable on a computing device.

The address transmission unit 700 transmits the Internet address input from the user to the Internet network terminal 140 through an inter-network data transmission method. For example, the address transmission unit 700 may receive an Internet address input through a conventional Internet browser for user convenience. For example, the user may input an Internet address in an address input window of an Internet browser displayed on the business terminal 100.

The document receiving unit 710 receives an electronic document provided by the Internet network terminal 140 through a data transmission method between networks. The electronic document is a document in which a screen of an Internet site corresponding to an Internet address provided by the address transmission unit 700 is included as a PDF or an image. As another example, in the electronic document, link information included in the corresponding Internet site may be additionally displayed as a URL or the like.

The document display unit 720 displays the received electronic document on the screen. For example, the document display unit 720 may display the received electronic document on the screen of the Internet browser. In this case, since the user of the business terminal 110 inputs an Internet address through an Internet browser and a screen for this is displayed on the Internet browser, he or she can feel as if they have directly connected to the Internet.

As another example, if there is link information displayed as a URL address in the electronic document displayed by the document display unit 720, the user of the business terminal 110 inputs the Internet address corresponding to the link information through the address transmission unit 700 Thus, the electronic document of the Internet site corresponding to the Internet address can be received and viewed. That is, it is possible to achieve the same effect as pressing a link of a corresponding site by accessing the Internet from the business terminal 110.

The present invention can also be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all types of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tapes, floppy disks, and optical data storage devices. In addition, the computer-readable recording medium can be distributed over a computer system connected through a network to store and execute computer-readable codes in a distributed manner.

So far, the present invention has been looked at around its preferred embodiments. Those of ordinary skill in the art to which the present invention pertains will be able to understand that the present invention can be implemented in a modified form without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an illustrative point of view rather than a limiting point of view. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

Claims

In the Internet usage method in a network separation environment where the business network and the Internet network are separated,

The business network terminal transmitting the Internet address to the Internet network terminal through the network data transmission method;

Scraping, by the internet network terminal, a website corresponding to the internet address;

The Internet network terminal converting the scraped data into an electronic document; And

And transmitting, by the Internet terminal, the electronic document to the business network terminal through the inter-network data transmission method.
The method of claim 1,

The Internet use method in a network separation environment, characterized in that the Internet address is a URL address.
The method of claim 1, wherein the converting to the electronic document comprises:

And converting the scraped data into a PDF file.
The method of claim 1, wherein the scraping step,

And acquiring, by the internet network terminal, data of a website corresponding to the internet address through a headless mode of a web browser.
An address receiver for receiving an Internet address transmitted by a business network terminal located in the business network through a network data transmission method in a network separation environment;

A scraping unit for scraping a website corresponding to the internet address;

A document generator for converting the scraped data into an electronic document; And

And a transmission unit for transmitting the electronic document to the business network terminal through the inter-network data transmission method.
The method of claim 5, wherein the scraping unit,

An internet network terminal in a network separation environment, characterized in that acquiring data of a website corresponding to the internet address through a headless mode of a web browser.
An address transmission unit for transmitting an Internet address to an Internet network terminal through an inter-network data transmission method in a network separation environment;

A document receiving unit for receiving data scraped from a site corresponding to the Internet address in an electronic document form through the data transmission method from the Internet network terminal; And

A document display unit for displaying the received document; a business network terminal in a network separation environment comprising: a.
The method of claim 7, wherein the address transmission unit,

A business network terminal in a network separation environment, characterized in that transmitting the Internet address indicated in the document to the Internet network terminal.
A computer-readable recording medium in which a program for performing the method according to claim 1 is recorded.