WO2017204566A1 - Line control device and method - Google Patents

Abstract

According to one aspect of the present invention, a line control device for managing a security communication device controlling an Internet network access of a user terminal between the user terminal and a network access device comprises: a line information collection unit for collecting line information from the network access device; a state checking unit for identifying a device connected to the network access device in the collected line information, and checking the state of the identified device in a security communication device control server; and a line blocking unit for selectively blocking a line of the network access device according to the state checking result of the identified device.

Description

Line control device and method

This application entails a priority claim based on Korean Patent Application No. 10-2016-0063629, filed May 24, 2016, and all the contents disclosed in the specification and drawings of that patent application are incorporated in this application.

The present invention relates to a circuit control apparatus and method, and more particularly, to a rotation control apparatus and method for managing a secure communication device for controlling the Internet network access of the user terminal between the user terminal and the network connection device.

In order to access the Internet through a user terminal capable of internet communication, for example, a computer, the user terminal must be connected to a network access device connected to an internet network such as an L2 switch. Such a network connection device is a network device of a telecommunication company, and when a customer joins the Internet, the network connection device is opened to enable the Internet connection.

If the Internet subscription customer is a business, a large number of users generally use the Internet through one network access device, and thus, an enterprise attempts to control the range of Internet use for security. Generally, software or separate hardware equipment is used to control the scope of the Internet. However, in the case of the software method, the software may be forcibly terminated by the user, or there may be a possibility of illegal Internet use by formatting the storage medium in which the software is stored and removing the software.

Therefore, there is an attempt to control the range of Internet use by using a separate hardware device, that is, a secure communication device, in order to overcome the limitation of this software method. That is, a separate secure communication device is connected to the network connection device, and the user terminal is connected to the secure communication device to be connected to the Internet, and the secure communication device limits the range of Internet use of the user terminal. However, even when such a secure communication device is used, the user may not prevent the user from attempting to connect the user terminal directly to the network connection device by removing the secure communication device, or after modulating the user terminal as if it is a secure communication device by software, the secure communication device If you connect directly to a network connection device to access the Internet, you cannot block it.

The present invention has been proposed to solve the above problems, and in controlling the Internet access through a secure communication device, removes the secure communication device or modulates the user terminal as if it is the secure communication device. It is an object of the present invention to provide a circuit control apparatus and method for blocking the operation.

According to an aspect of the present invention for achieving the above object, a line control device for managing a secure communication device for controlling the Internet network connection of the user terminal between the user terminal and the network connection device, the line from the network connection device A line information collecting unit for collecting information; A status checker for identifying a device connected to a network access device from the collected line information, and checking a status of the identified device in a secure communication device control server; And a circuit breaker for selectively blocking a circuit of the network access device according to a result of the status check of the identified device.

The line blocking unit may maintain the line of the network connection device when the state of the identified device identified by the secure communication device control server is in a normal state and block the line when it is in an abnormal state.

The secure communication device periodically transmits status information to the secure communication device control server when connected to the user terminal, and transmits a disconnection message to the secure communication device control server when the connection with the user terminal is released. Periodic transmission of status information can be stopped.

The status check unit includes an abnormal flag from the secure communication device control server when the connection release message is not received from the identified device to the secure communication device control server and the status information is not received during the transmission period of the status information. A status information response can be received.

The status check unit may receive a status information response including an abnormal flag from the secure communication device control server when there is no periodic transmission record of the status information from the identified device to the secure communication device control server.

The line blocking unit may periodically check the state of the identified device in the secure communication device control server.

The line information includes a port number of the network connection device and identification information of a device connected to the port number, and the status checking unit is configured to identify the device using the identification information of the device included in the line information. The line blocking unit may check a state and transmit a block command of the port number to the network connection device.

According to another aspect of the present invention for achieving the above object, a method for managing a secure communication device in the circuit control server for controlling the Internet network connection of the user terminal between the user terminal and the network connection device, from the network connection device Collecting circuit information; Identifying a device connected to a network connection device from the collected line information, and confirming a state of the identified device in a secure communication device control server; And selectively blocking a line of the network access device according to a result of checking the status of the identified device.

The blocking may include maintaining the line of the network access device when the state of the identified device identified in the secure communication device control server is in a normal state and cutting off the line in an abnormal state.

The secure communication device periodically transmits status information to the secure communication device control server when connected to the user terminal, and transmits a disconnection message to the secure communication device control server when the connection with the user terminal is released. Periodic transmission of status information can be stopped.

The checking may include, when the connection release message is not received from the identified device to the secure communication device control server and the status information is not received during the transmission period of the status information, the abnormal flag from the secure communication device control server. It may receive a status information response including.

The checking may include receiving a status information response including an abnormal flag from the secure communication device control server when there is no periodic transmission record of the status information from the identified device to the secure communication device control server.

The present invention can reinforce security of a group in which security of an enterprise, a military unit, etc. is important by removing a secure communication device or modulating a user terminal as if it is the secure communication device to block direct Internet access to the user terminal.

1 is a diagram illustrating a system for controlling Internet access according to an embodiment of the present invention.

2 is a diagram showing the configuration of a circuit control server according to an embodiment of the present invention.

3 is a flowchart illustrating a line control method according to an embodiment of the present invention.

4 is a flowchart illustrating a line control method according to another embodiment of the present invention.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a system for controlling Internet access according to an embodiment of the present invention.

Referring to FIG. 1, the system according to the present embodiment includes a secure communication device 110, a network connection device 120, a DHCP server 130, a line control server 140, a secure communication device control server 150, The communication network 160 and the user terminal 170 is included.

The user terminal 170 is a terminal capable of internet communication, and includes, for example, a notebook computer, a desktop computer, a tablet PC, and the like. Preferably, in the present embodiment, the user terminal 170 may not communicate through a general mobile communication network, but may be a terminal capable of internet communication through a wireless LAN or a wired interface. However, the present invention is not limited thereto, and when the area in which the secure communication device 110 is installed is not a service area of the mobile communication network, the user terminal 170 may also include a smartphone that can be connected to the secure communication device 110. .

The secure communication device 110 is connected to the network connection device 120 through a LAN cable and wirelessly or wiredly connected to the user terminal 170 to control the connection of the user terminal 170 to the network connection device 120. . The secure communication device 110 is a hardware security device having a processor (CPU), an operating system (OS), and a memory. When the secure communication device 110 is connected to the user terminal 170, the secure communication device 110 receives power and boots, and is a system independent of the user terminal 170. It works. In addition, when the secure communication device 110 is connected to the user terminal 170, some functions of the user terminal 170 may be disabled. For example, the communication function of the user terminal 170 may be deactivated.

When the user terminal 170 is connected and booted with power, the secure communication device 110 periodically transmits status information to the secure communication device control server 150. When the secure communication device 110 is normally disconnected from the user terminal 170, the secure communication device 110 transmits a disconnection message to the secure communication device control server 140, and the secure communication device 110 no longer supplies power. Do not send status information. The status information includes a transmission time, a unique identification code, a MAC address of the secure communication device 110, and the like.

The secure communication device 110 may be connected to the user terminal 170 through a communication interface. The communication interface may be selected from various wired and wireless interfaces. For example, the communication interface may be a USB interface, but other communication interfaces that may be connected to the user terminal 170 are possible. In addition, the secure communication device 110 may further include a communication interface connectable with the network connection device 120, and may include, for example, a wired communication interface capable of connecting to a communication network using a wired cable.

The secure communication device 110 stores a white list, which is a list of access allowable Internet addresses, in a memory, and controls the user terminal 170 to access only the Internet addresses in the white list. The secure communication device 110 may receive and update a white list from the secure communication device control server 150. In addition, the security communication device 110 may include a sensor for recognizing biometric information, and may recognize the biometric information of the user, and may use the same when comparing and matching the biometric information stored in advance.

The network connection device 120 is a device for connecting the secure communication device 110 and the communication network 160, and includes an L2 switch, an L3 switch, and the like. The L2 switch plays the role of the data link layer in the Open System Interconnection (OSI) 7-layer model. Specifically, the L2 switch is responsible for data transmission between physical networks, physical addressing, error detection, frame forwarding, and data flow. Manage control One Internet line may be connected to one port of the L2 switch. The L2 switch obtains the MAC addresses of the devices connected to each port and stores them in the MAC table. Therefore, in the present embodiment, the MAC address and the port number of the secure communication device 110 are matched and stored in the MAC table. When the frame is received through the communication network 160, the L2 switch determines which port to send the frame to by referring to the MAC table. The L3 switch performs the role of a network layer in the OSI 7 layer model, and uses an ARP (Address Resolution Protocol) protocol to map IP addresses of the secure communication device 110 and the user terminal 170 to MAC addresses. Is stored in the ARP table. In other words, if you look up the ARP table, you can check the IP addresses of the devices and their corresponding MAC addresses.

The Dynamic Host Configuration Protocol (DHCP) server 130 manages a pool of IP addresses and, upon receiving an IP address assignment request, retrieves and assigns an IP address from the pool. In the present embodiment, when the user terminal 170 is connected to the secure communication device 110 and receives an IP address assignment request, the user terminal 170 allocates an IP address to the secure communication device 110 and the user terminal 170. The IP address allocation request may include MAC addresses of the user terminal 170 and the secure communication device 110. The DHCP server 130 may request the authentication by transmitting the MAC addresses of the user terminal 170 and the secure communication device 110 to the circuit control server 140 and may assign an IP address when an authentication success response is received. Alternatively, the DHCP server 130 may request authentication by transmitting only the MAC address of the secure communication device 110 to the line control server 140.

The secure communication device control server 150 controls the secure communication device 110. The secure communication device control server 150 stores and manages a white list, which is a list of allowed Internet addresses for each secure communication device, and transmits and updates the white list to the secure communication device 110 when the secure communication device 110 is connected. can do. According to an embodiment, identification information (eg, MAC address) of a plurality of user terminals may be stored for each secure communication device, and the white list may be different for each user terminal.

The secure communication device control server 150 periodically receives and stores state information from the secured communication device 110. The state information stored includes a reception time, a unique identification code of the secure communication device 110, a MAC address, and the like. When the secure communication device control server 150 receives a state information request for the specific secure communication device 110 from the line control server 140, the secure communication device control server 150 retrieves the state information of the corresponding specific secure communication device 110, and retrieves the retrieved state information. In response to the result, a status information response including a flag is returned. The flag here includes a normal flag or an abnormal flag. The normal flag indicates that the secure communication device 110 is normally connected to the network connection device 120, and the abnormal flag indicates that the secure communication device 110 is not normally connected to the network connection device 120. The abnormal flag is, for example, a case where the secured communication device 110, which is powered on, is normally connected to the network connection device 120 and is forcibly removed from the network connection device 120. The secure communication device control server 150 sets an abnormal flag when no status information is received and no connection release message is received even when the state information receiving period of the secure communication device 110 has arrived. Alternatively, the secure communication device control server 150 returns a status information response including an abnormal flag even when a status information request for the secure communication device 110 for which the status information is not received is received.

When the secure communication device control server 150 receives the state information request for the specific secure communication device 110 from the line control server 140, the secure communication device control server 150 retrieves the state information of the corresponding specific secure communication device 110 and displays a normal flag. Or transmits a status information response including an abnormal flag to the circuit control server 140. The status information request may include the MAC address or IP address of the secure communication device 110.

The circuit control server 140 stores information of a subscriber who has subscribed to an internet access control service using the secure communication device 110. The subscriber's information may include, for example, a company name, information (IP address, MAC address, port number, etc.) of the network connection device 120, identification information (eg, MAC address) of the secure communication device 110, the Internet in the enterprise. It may include identification information (eg, MAC address) of the licensed user terminals.

The circuit control server 140, upon receiving an authentication request for IP address assignment from the DHCP server 130, returns an authentication response based on the subscriber information. The authentication request may include identification information of the secure communication device 110, and the line control server 140 may authenticate successful response when the identification information of the secure communication device 110 included in the authentication request matches the subscriber information. Reply. In addition, the authentication request may further include identification information of the user terminal 170, the circuit control server 140, both the identification information of the secure communication device 110 and the identification information of the user terminal 170 is consistent with the subscriber information. In this case, the authentication success response can be returned.

The line control server 140 periodically collects line information of the network connection device 120. The line information includes the IP address, port number, and identification information (eg, MAC address, IP address) of the secure communication device 110 connected for each port number.

The line control server 140 identifies the secure communication device 110 connected to the network connection device 120 from the collected line information, and transmits status information about the identified secure communication device 110 to the secure communication device control server. Request 150 to receive a status information response. The circuit control server 140 selectively blocks the circuit of the network connection device 120 based on the status information response.

Specifically, the circuit control server 140 transmits a status information request including identification information (eg, MAC address, IP address) of the identified secure communication device 110 to the secure communication device control server 150. . The circuit control server 140 receives the status information response from the secure communication device control server 150 and selectively blocks the circuit of the network access device 120 according to a flag included in the status information response. If there is a normal flag, the line control server 140 maintains the line of the network connection device 120, and if there is an abnormal flag, transmits a block command for a specific port to the network connection device 120.

In addition, when the MAC address of the same secure communication device 110 is found in the line information collected from the plurality of network connection devices 120, the line control server 140 determines that it is a fraudulent use and thus corresponds to the plurality of network connection devices. In operation 120, a block command for the port where the corresponding MAC address is found may be transmitted. For example, after connecting the first user terminal to the secure communication device 110 connected to the first network connection device 120, the second user terminal that modulates the MAC address to the other second network connection device 120. In this case, the corresponding port of the first and second network connection devices 120 is blocked.

2 is a diagram showing the configuration of a circuit control server according to an embodiment of the present invention.

The circuit control server 140 shown in FIG. 2 may include a memory, a memory controller, one or more processors (CPUs), peripheral interfaces, input / output (I / O) subsystems, display devices, input devices, and communication circuits. . These components communicate via one or more communication buses or signal lines. These various components may be implemented in hardware, software or a combination of both hardware and software, including one or more signal processing and / or application specific integrated circuits.

The memory may include fast random access memory, and may also include one or more magnetic disk storage devices, nonvolatile memory such as flash memory devices, or other nonvolatile semiconductor memory devices. Access to memory by other components of the server, such as processors and peripheral interfaces, may be controlled by the memory controller. In the memory, information of a subscriber who has subscribed to the Internet access control service using the secure communication device 110 is stored. Subscriber information may be input by the input device. The subscriber's information may include, for example, a company name, information (IP address, MAC address, port number, etc.) of the network connection device 120, identification information (eg, MAC address) of the secure communication device 110, the Internet in the enterprise. It may include identification information (eg, MAC address) of the licensed user terminals.

The peripheral interface connects the server's input and output peripherals with the processor and memory. One or more processors execute a set of instructions stored in various software programs and / or memories to perform various functions for the system and process the data. In some embodiments, the software component is loaded (installed) with an operating system, a graphics module (instruction set), and a program for performing operations for the present invention. The operating system may be, for example, a built-in operating system such as Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, iOS, etc., and may be a general system task (e.g., memory management , Various software components and / or devices that control and manage storage devices, power management, and the like, and facilitate communication between various hardware and software components. The graphics module includes several well known software components for presenting and displaying graphics on the display device. The term "graphics" includes all objects that can be displayed, including, without limitation, text, web pages, icons (eg, user interface objects including soft keys), digital images, videos, animations, and the like. . In some embodiments, peripheral interfaces, processors and memory controllers may be implemented on a single chip such as a chip. In some other embodiments, they may be implemented in separate chips.

The I / O subsystem provides an interface between the input and output peripherals of peripheral devices such as display devices and input devices. The display device may use a liquid crystal display (LCD) technology or a light emitting polymer display (LPD) technology, and the display device may be a touch display such as a capacitive type, a resistive type, or an infrared type. The touch display provides an output interface and an input interface between the system and the user. The touch display presents visual output to the user. The visual output may include text, graphics, video, and combinations thereof. Some or all of the visual output may correspond to user interface objects. The touch display forms a touch sensitive surface that accepts user input. A processor is a processor configured to perform operations associated with a system and to perform instructions, for example, using instructions retrieved from memory to control the reception and manipulation of input and output data between components of the system.

The communication circuit may include an Ethernet communication circuit and an RF circuit. The Ethernet communication circuit performs wired communication, and the RF circuit transmits and receives electromagnetic waves. RF circuitry converts electrical signals into electromagnetic waves and vice versa and communicates with communications networks, other mobile gateways, and communications devices through the electromagnetic waves.

Referring to FIG. 2, the line control server 140 may include an authenticator 210, a line information collecting unit 220, a state checking unit 230, and a line blocking unit 240. Such components may be manufactured as a program, stored in a memory and operated by a processor, or may be manufactured by a combination of software and hardware.

The authenticator 210 determines whether to assign an IP address to a device connected to the network connection device 120. Specifically, when the authentication unit 210 receives an authentication request for IP address assignment from the DHCP server 130, the authentication unit 210 returns an authentication response based on the subscriber information stored in the memory. The authentication request may include identification information of the secure communication device 110, and the authenticator 210 may generate an authentication success response when the identification information of the secure communication device 110 included in the authentication request matches the subscriber information. Reply In addition, the authentication request may further include identification information of the user terminal 170, the authentication unit 210, the identification information of the secure communication device 110 and the identification information of the user terminal 170, both match the subscriber information In this case, the authentication success response can be returned.

The line information collection unit 220 periodically collects line information of the network connection device 120. The line information includes the IP address, port number, and identification information (eg, MAC address, IP address) of the secure communication device 110 connected for each port number.

The status checker 230 identifies the secure communication device 110 connected to the network connection device 120 from the collected line information, and transmits the status information on the identified secure communication device 110 to the secure communication device control server. Check at 150. The status checker 230 transmits a status information request including identification information (eg, MAC address, IP address) of the identified secure communication device 110 to the secure communication device control server 150, and Receive a status information response.

The line blocking unit 240 selectively blocks the line of the network connection device 120 according to a flag included in the status information response. If there is a normal flag, the line blocking unit 240 maintains the line of the network connection device 120, and if there is an abnormal flag, transmits a block command for a specific port to the network connection device 120.

In addition, when the MAC address of the same secure communication device 110 is found in the line information collected from the plurality of network connection devices 120, the line blocking unit 240 determines that the network connection device is a fraudulent use. In operation 120, a block command for the port where the corresponding MAC address is found may be transmitted. For example, after connecting the first user terminal to the secure communication device 110 connected to the first network connection device 120, the second user terminal that modulates the MAC address to the other second network connection device 120. In this case, the corresponding port of the first and second network connection devices 120 is blocked.

3 is a flowchart illustrating a line control method according to an embodiment of the present invention.

Referring to FIG. 3, the user connects the secure communication device 110, which is connected to the network connection device 120 with a wired cable, to the user terminal 170 (S301). For example, the secure communication device 110 may be connected to a USB port of the user terminal 170 by supporting USB communication.

The user terminal 170 supplies power to the secure communication device 110, and the secure communication device 110 boots and transmits an IP address allocation request to the DHCP server 130 (S303). The IP address allocation request includes the MAC addresses of the user terminal 170 and the secure communication device 110.

Before allocating an IP address, the DHCP server 130 may transmit an authentication request including a MAC address of the user terminal 170 and the secure communication device 110 included in the IP address allocation request. To transmit (S305). Since the circuit control server 140 stores the MAC addresses of the user terminal 170 and the secure communication device 110 as information of a subscriber subscribed to the service, the user terminal 170 and the security included in the authentication request are stored. Authentication is performed by comparing the MAC address of the communication device 110 with the information of the subscriber.

The circuit control server 140 returns an authentication success response to the DHCP server 130 when the authentication is successful, and returns an authentication failure response to the DHCP server 130 when the authentication fails (S307). In the present embodiment, it will be described that the authentication is successful. According to an embodiment, the MAC address of the user terminal 170 may not be included in the authentication request in step S305. In this case, the line control server 140 may perform authentication by comparing only the MAC address of the secure communication device 110 with the information of the subscriber. This embodiment is an example in which no user terminal 170 that can use the Internet is designated.

In step S305 and step S307, it is possible to prevent using the Internet by using an unspecified user terminal 170 or by using an unspecified secure communication device 110.

Upon receiving the authentication success response, the DHCP server 130 assigns an IP address to the secure communication device 110 and the user terminal 170 (S309, S311). The secure communication device 110 assigned the IP address periodically transmits state information to the secure communication device control server 140 (S313). The status information includes the time of transmission, the unique identification code, the MAC address of the secure communication device 110, and the like.

On the other hand, the line control server 140 periodically collects line information from the network connection device 120 (S315). The line information includes the IP address, port number, and identification information (eg, MAC address, IP address) of the secure communication device 110 connected for each port number.

The line control server 140 identifies the secure communication device 110 connected to the network connection device 120 from the collected line information, and controls the secure communication device for requesting status information for the identified secure communication device 110. The server 150 transmits the data to the server 150 (S317). At this time, the status information request includes identification information (eg, MAC address, IP address) of the identified secure communication device 110.

The secure communication device control server 150 retrieves corresponding state information by using the identification information of the identified secure communication device 110 and sends a state information response including the retrieved state information to the line control server 140. It transmits (S319). The status information response may include a normal flag indicating that the identified secure communication device 110 is normally connected. Therefore, the rotation control server 140 maintains the line of the network connection device 120 without blocking.

The secure communication device 110 may not be normally terminated and may be forcibly disconnected from the network connection device 120. For example, the user may remove the secure communication device 110 for malicious purposes (S323). As such, when the secure communication device 110 is removed, the normal connection release message is not transmitted to the secure communication device control server 150.

Accordingly, since the security communication device control server 150 no longer receives the status information and the connection release message has been received even though the status information receiving cycle arrives, the secure communication device control server 150 determines that the connection has been abnormally disconnected and includes an abnormal flag therefor. The status information response is transmitted to the line control server 140 (S325). The rotation control server 140 transmits a command to block the line, that is, the port to which the secure communication device 110 is connected, to the network access device 120 (S327). Therefore, the connection is no longer possible with the line where the secure communication device 110 is forcibly removed, so that the user terminal 170 cannot be directly connected to the network connection device 120 without the secure communication device 110 to use the Internet. .

4 is a flowchart illustrating a line control method according to another embodiment of the present invention.

Referring to FIG. 4, the user may modulate the MAC address of the user terminal 170 to have the same MAC address as the secure communication device 110 (S401). In operation S403, the user directly connects the user terminal 170 to the network access device 120. The user terminal 170 transmits an IP address allocation request to the DHCP server 130 (S405). The IP address allocation request includes the MAC address of the user terminal 170.

Before allocating the IP address, the DHCP server 130 transmits an authentication request including the MAC address of the user terminal 170 included in the IP address allocation request to the line control server 140 (S407). The circuit control server 140 stores MAC addresses of the user terminal 170 and the secure communication device 110 as information of a subscriber subscribed to the service, and includes the MAC of the user terminal 170 included in the authentication request. Since the address is the same as the MAC address of the secure communication device 110, the line control server 140 transmits an authentication success response to the DHCP server 130 (S409).

Upon receiving the authentication success response, the DHCP server 130 assigns an IP address to the user terminal 170 (S411). Since the user terminal 170 is directly connected to the network connection device 120, the secure communication device 110 does not transmit status information to the secure communication device control server 140.

On the other hand, the line control server 140 periodically collects line information from the network connection device 120 (S413). Here, the line information includes the IP address of the network connection device 120, the port number, and identification information (eg, MAC address, IP address) of the connected device for each port number. In this embodiment, identification information of the user terminal 170 is included as identification information of a device connected to a specific port.

The line control server 140 identifies the secure communication device 110 connected to the network connection device 120 from the collected line information. In this embodiment, since the user terminal 170 is directly connected to the network access device 120 without the secure communication device 110, the MAC address of the user terminal 170 is the same as the MAC address of the secure communication device 110. The user terminal 170 is identified as being the secure communication device 110. The rotation control server 140 transmits a state information request for the secure communication device 110, that is, the user terminal 170, to the secure communication device control server 150 (S415). At this time, the status information request includes identification information (eg, MAC address, IP address) of the user terminal 170.

Since the secure communication device 110 does not transmit the state information to the secure communication device control server 140, the secure communication device control server 150 includes identification information (eg, MAC address and IP address) of the user terminal 170. There is no status information corresponding to). Therefore, the secure communication device control server 150 transmits a status information response including an abnormal flag to the line control server 140 (S417). Since the abnormal flag is received, the rotation control server 140 transmits a command to block the line, that is, the port, to which the user terminal 170 is connected, to the network access device 120 (S419). Therefore, the user terminal 170 modulated by the MAC address can no longer use the Internet.

The embodiment described with reference to FIGS. 3 and 4 describes an example of fraudulent use in one network connection device 120. In another exemplary embodiment, after connecting the first user terminal to the secure communication device 110 connected to the first network access device 120, the second user terminal modulating the MAC address to the other second network access device 120. You can connect to the internet. In this case, the circuit control server 140 does not check the status information as in the embodiment of FIG. 4, and when the same MAC address is found in a plurality of different network access devices 120 when collecting the line information, the corresponding plurality The network access device 120 may transmit a block command for the port where the corresponding MAC address is found.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, the features described in the individual embodiments herein can be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment herein can be implemented individually in various embodiments or in combination appropriately.

Although the operations are described in a particular order in the drawings, they should not be understood as being performed in a particular order as shown, or in a sequence of successive orders, or all described actions being performed to obtain a desired result. . Multitasking and parallel processing may be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be packaged in a single software product or multiple software products.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

Claims (12)

A line control device for managing a secure communication device for controlling an internet network connection of a user terminal between a user terminal and a network connection device, A circuit information collecting unit which collects circuit information from the network connection device; A status checker for identifying a device connected to a network access device from the collected line information, and checking a status of the identified device in a secure communication device control server; And And a circuit breaker for selectively blocking a circuit of the network access device according to a result of checking the status of the identified device. The method of claim 1, The line breaker, And maintaining the line of the network connection device when the state of the identified device identified in the secure communication device control server is in a normal state and cutting off the line in an abnormal state. The method of claim 2, The secure communication device, When connected with the user terminal, periodically transmits status information to the secure communication device control server, and when the connection with the user terminal is released, transmits a disconnection message to the secure communication device control server and periodically transmits the status information. Suspended line control device. The method of claim 3, wherein The state check unit, If the connection release message is not received from the identified device to the secure communication device control server and the status information is not received during the transmission period of the status information, a status information response including an abnormal flag is received from the secure communication device control server. Receiving line control device. The method of claim 3, wherein The state check unit, And if there is no periodic transmission record of the status information from the identified device to the secure communication device control server, receiving a status information response including an abnormal flag from the secure communication device control server. The method according to any one of claims 1 to 5, The line breaker, And periodically checking the status of the identified device in the secure communication device control server. The method according to any one of claims 1 to 5, The line information includes a port number of the network connection device and identification information of a device connected to the port number. The status checking unit checks the status of the identified device using the identification information of the device included in the line information, And the circuit breaker is configured to transmit a block command of the port number to the network connection device. A method for managing a secure communication device in a line control server that controls an Internet network connection of a user terminal between a user terminal and a network access device, the method comprising: Collecting line information from the network connection device; Identifying a device connected to a network connection device from the collected line information, and confirming a state of the identified device in a secure communication device control server; And Selectively blocking a line of the network access device according to a result of the status check of the identified device. The method of claim 8, The blocking step, Maintaining the line of the network connection device when the state of the identified device identified in the secure communication device control server is in a normal state, and disconnecting the line in an abnormal state. The method of claim 9, The secure communication device, When connected with the user terminal, periodically transmits status information to the secure communication device control server, and when the connection with the user terminal is released, transmits a disconnection message to the secure communication device control server and periodically transmits the status information. How to stop. The method of claim 10, The checking step, If the connection release message is not received from the identified device to the secure communication device control server and the status information is not received during the transmission period of the status information, a status information response including an abnormal flag is received from the secure communication device control server. How to receive. The method of claim 10, The checking step, And if there is no periodic transmission record of status information from the identified device to the secure communication device control server, receiving a status information response including an abnormal flag from the secure communication device control server.

Images