KR101315686B1 - Control method for posterior auditing of computer network - Google Patents

Abstract

PURPOSE: A post audit control method is provided to extract and store audit data through service packet analysis. CONSTITUTION: An object server information unit determines whether a service providing server is a management object server or not (S210). In case the service providing server is the management object server, an access policy information unit determines access control according to a predetermined access control policy (S220). If the service providing server is accessible, the access policy information unit analyzes a packet according to a service protocol (S230). The access policy information unit extracts audit data from the packet and stores the audit data (S235). The audit data includes service connection information, a user log and a service providing server log. The access policy information unit transmits the packet to a receiver (S240). [Reference numerals] (200) Photo-based packet filtering; (205) Analyze information about a transmitter and a receiver; (210) Check a system for management; (215) By-pass to a receiver; (220) Determine an access control; (225) Deny access; (230) Analyze a packet according to a service protocol; (235) Extract audit data; (240) Transmit the packet to a receiver; (AA) Start; (BB) Service information unit; (CC) Object server information unit; (DD) Access policy information unit; (EE) Allow; (FF) Deny; (GG) Store access information data; (HH) Unit for managing an audit log; (II) Store audit log data; (JJ) End

Description

Post Control Method for Posterior Auditing of Computer Network

The present invention relates to a post audit control method in a network environment.

Auditing agent is installed on the client side for user auditing in the network environment, and the operation screen is saved by image capture method at predetermined time intervals, or audit data is generated for user's event occurrence and server-side processing result event information. The storage method is used.

According to the prior art as described above, an agent installation cost for log auditing is required on a user terminal, and in case of an event method, since different systems operate in different ways, it is difficult to apply to all kinds of systems. In addition, a method of storing an image displayed on a user terminal as a snapshot or an image is a burden on the system of the user terminal and requires a lot of storage space.

An example of a post-audit control method according to the prior art is a technique disclosed in Korean Patent No. 10-0458816, published on December 3, 2004, which provides a user with an intrusion detection system for post-audit in a network environment. Provides event log including source / destination address and access time information or packet acceptance, intrusion prevention system address, system usage time and program in association with predefined log group. However, the method disclosed in this prior patent has a limitation that it provides only a limited audit log according to the event.

An object of the present invention is to provide a post-audit control method independent of the service providing server to be subject to post-audit in the network environment by solving the problems of the prior art.

The post audit control method according to the present invention is performed by the post audit control device in an environment including a user terminal, a service providing server, and a post audit control device capable of communicating with the user terminal and the service providing server. The method comprises (1) a first step of filtering a packet from the user terminal or the service providing server, (2) a second step of analyzing sender and receiver information from the filtered packet, and (3) the A third step of determining whether the service providing server is a managed server; and (4) a fourth step of determining access control according to a predetermined access control policy when the service providing server is a managed server in the third step. (5) analyzing the packet according to the service protocol if it is determined that the access is possible in the fourth step; and (6) service access information, a user log, and a service providing server log from the analyzed packet. A sixth step of extracting and storing the audit data; and (7) a seventh step of transmitting the packet to the receiver.

According to the present invention, since audit data can be extracted and stored through service packet analysis, various services such as different servers can be audited, and additional development cost, time, and management cost of audit data can be reduced. Is provided.

1 is a diagram illustrating an environment in which a post audit control method according to the present invention is performed.
2 is a flowchart of a post audit control method according to the present invention;
Figure 3 is a flow chart of a window remote control method applied post-audit control method according to the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. All components described below are to be interpreted in an illustrative and non-limiting sense, and the components listed in connection with the description of specific embodiments and / or drawings are not to be construed exclusively as constituting the scope of the present invention. do.

1 shows an environment to which the post audit control method according to the present invention is applied.

As shown in Fig. 1, the present environment comprises a user terminal 10, a communication interface 20, a service providing server 80, and a post audit control device 90.

The post audit control device 90 includes a packet extracting unit 30, a packet transmitting unit 40, an access control managing unit 50, an audit log managing unit 60, and a packet processing unit 70.

The packet extracting unit 30 filters and extracts a packet received through the communication interface 20 and transmits the extracted packet to the packet processing unit 70. The packet processor 70 analyzes and processes the filtered packet according to the service protocol.

The access control management unit 50 includes a management target server information unit 51, a service information unit 52, and an access control policy unit 53. The management target server information unit 51 records and manages information such as server IP, server name, and server type of the service providing servers to which the post audit control method according to the present invention is applied. The service information unit 52 records and manages service type information for identifying the type of service provided by the management target server and service port information, which is port information used on a network for providing a service. In the access control policy unit 53, a time limit policy for controlling a user's access based on a date, a time limit policy for controlling a user's access based on a time, and a day restriction policy for controlling a user's access based on a day of the week For example, the IP restriction policy that controls the user's access based on the service providing server IP and the user restriction policy that controls the user's access based on the user's ID are recorded and managed.

The audit log management unit 60 includes a connection information unit 61 and an audit log unit 62.

The connection information unit 61 records and manages identifier information authenticated to use the service, user information which is access client network information, service information of the service providing server 80 which is a management target server, and service use time information. .

The audit log 62 includes environment setting information of the service extracted by analyzing the filtered packet, user log data which is event and request data transmitted from the user terminal 10 to the service providing server 80, and Log data of the service providing server, which is response data according to an event or request, and time stamp information, which is a time at which such information is extracted, are recorded and managed.

The environment setting information of the service is an access which is authentication information of a user terminal (client) or network information of the service providing server 80 connected to the service providing server 80 in order to use the service provided by the service providing server 80. Information and setting information which is environment setting information of the service providing server 80 or the user terminal 10.

The user log data includes input device (eg, mouse and / or keyboard) event information and request log information transmitted from the user terminal 10 to the service providing server 80 when providing a service.

The log data of the service providing server includes image data processed according to an event or a request of a user, and a response log.

2 is a flowchart of a post audit control method according to the present invention.

When the user requests to use the service to the service providing server 80 through the user terminal 10, the post audit control device 90 is based on the service type information and port information defined in the service information unit 52 of the access control management unit 50. The service packet is filtered based on 200. Next, in step 205, the sender and the receiver information are analyzed, and in step 210, the service providing server 80 applies the post-monitoring control method according to the present invention. Check whether it is the target system. This confirmation is performed by checking whether or not it is a service providing server registered in the service information unit 52 of the access control management unit 50. If the service providing server 80 is not the management target server, the service is bypassed to the receiver (215), and in the case of the management target server, the access control determination is performed (220). The access control determination is performed by referring to the access control policy unit 53 of the access control management unit 50. The connection information data is stored in the connection information unit 61 of the audit log management unit 60.

As a result of the access control determination, when access is allowed, the packet is analyzed according to the protocol applied to the service by using the information of the service information unit 52 (230). Audit data extracted by packet analysis, for example, service access information, a user log, a server log of a service providing server, and the like are stored in the audit log unit 62 of the audit log manager 60. Next, the process proceeds to step 240 and transmits the packet to the receiver to provide communication between the user terminal 10 and the service providing server 80.

3 is a flowchart of an embodiment in which the post audit control method according to the present invention is applied to a Windows Remote Desktop Protocol (RDP).

If there is a window remote control service request, the service packet is filtered with reference to the service information unit 52 (300), and the sender and receiver information is analyzed (305). The packet is divided into a case of a user packet and a case of a server packet.

[Packet is user packet]

In this case, it is first checked whether the management target server to which the post-audit control method according to the present invention is applied is referred to the receiver network information of the packet (310). This confirmation is performed with reference to the target server information unit 51 of the access control management unit 50. If it is not the management target server transmits the packet to the server (350). In the case of the management target server, the access control policy unit 53 determines whether to access control (320). The connection information and the user information are stored in the connection information unit 61.

If the access is granted, the service type is checked (330), and the user packet is analyzed (335). The user audit data extracted by analyzing the user packet is stored in the audit log manager 62. User audit data includes user information, service information, user logs, and the like. In step 345, the user packet is reassembled, and the packet is transmitted to the server which is the receiver of the packet (350).

If the packet is a server packet

In step 355, the service type is confirmed, and the service information is stored in the access information unit 61. Next, the server packet is analyzed (360) and the extracted server audit data is stored in the audit log manager 62 (365). The server packet is recombined (370) and transmitted to the client (user terminal) (375).

While the invention has been described above with reference to the accompanying drawings, the scope of the invention is determined by the claims that follow, and should not be construed as limited to the embodiments and / or drawings described above. It is to be expressly understood that improvements, changes and modifications that are obvious to those skilled in the art are also within the scope of the present invention as set forth in the claims.

10: User terminal
20: communication interface
80: service delivery server
90 "post audit control unit

Claims (1)

A post audit control method performed by a post audit control device in an environment including a user terminal, a service providing server, and a post audit control device capable of communicating with the user terminal and a service providing server,
A first step of filtering a packet from the user terminal or the service providing server;
Analyzing sender and receiver information from the filtered packet;
Determining whether the service providing server is a server to be managed;
A fourth step of determining access control according to a predetermined access control policy when the service providing server is a management target server in the third step;
A fifth step of analyzing a packet according to a service protocol if it is determined that the access is possible in the fourth step;
A sixth step of extracting and storing audit data including service access information, a user log, and a service providing server log from the analyzed packet;
A seventh step of transmitting the packet to a receiver;
Post audit control method.

Images