[go: up one dir, main page]

WO2021020918A1 - Procédé de production d'un réseau interne logique, et terminal mobile et application pour la mise en œuvre d'un tel réseau - Google Patents

Procédé de production d'un réseau interne logique, et terminal mobile et application pour la mise en œuvre d'un tel réseau Download PDF

Info

Publication number
WO2021020918A1
WO2021020918A1 PCT/KR2020/010090 KR2020010090W WO2021020918A1 WO 2021020918 A1 WO2021020918 A1 WO 2021020918A1 KR 2020010090 W KR2020010090 W KR 2020010090W WO 2021020918 A1 WO2021020918 A1 WO 2021020918A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
access
network
information
application
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/KR2020/010090
Other languages
English (en)
Korean (ko)
Inventor
김찬우
최성준
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Viascope Inc
Original Assignee
Viascope Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Viascope Inc filed Critical Viascope Inc
Publication of WO2021020918A1 publication Critical patent/WO2021020918A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/18—Service support devices; Network management devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/50—Service provisioning or reconfiguring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Definitions

  • It relates to a technology for implementing a logical internal network with an application installed in a mobile terminal.
  • Intranet In particular, due to the need for stable network speed and security, organizations and companies have built and utilized internal networks.
  • the internal network (intranet) requires a lot of cost and time to be built with complex configurations such as firewall-only devices, routers, wireless LAN controllers, and redundancy of switches, and a lot of manpower costs to operate them.
  • network-managed devices such as desktops, laptops, tablets, PCs, NAS, Internet phones, printers, etc. are gradually increasing inside the enterprise
  • management in terms of efficiency and stability increases as the number of devices using the internal network increases. Is having difficulty.
  • An object to be solved by the present invention is to provide a technology for implementing an internal network through an application installed in a mobile terminal and allowing access to the internal network to a terminal that has performed authorization authentication.
  • the problem to be solved by the present invention is to provide a technology for setting a policy level differently for each mobile terminal on which an application is installed, and allowing or blocking network access between mobile terminals based on the policy level.
  • the application performs the authentication of the inputted user, and the authentication of the user from the linked policy server Requesting network access authority information according to the user's network authority information and receiving the user's network authority information, receiving a connection request from one or more terminals corresponding to the user's authentication when the user's access authority is approved, and requesting an integrity check result to the terminal
  • the integrity of the terminal is verified, issuing an IP to the terminal, collecting connection request information or access information for the terminal connected to the issued IP and sharing it with the policy server, and encrypting and transmitting packets generated by the terminal. And decrypting the received encrypted packet and forwarding it to the terminal.
  • the policy server may manage authentication information for applications of a plurality of mobile terminals, set access rights, and established network policies, and record access authority request information and terminal information received from each mobile terminal in a database.
  • the policy server upon receiving a request for permission to access a network according to user authentication, may provide accessable terminal information including information on a different mobile terminal that can be connected or a terminal that has connected to the mobile terminal, along with whether to allow network access.
  • the method may further include forwarding a corresponding transport packet to an application of the terminal and transmitting a response packet received in response to the transport packet to the terminal.
  • step of checking whether the information of the accessible terminal is included in the information of the accessible terminal if the destination terminal is not included in the accessible terminal information received from the policy server, it is possible to check whether access is permitted by requesting the access right of the destination terminal to the policy server.
  • a packet may be dropped and a drop message may be transmitted to the terminal.
  • the terminal includes a network access control client that performs integrity access and monitoring, and the step of issuing an IP to the terminal is to transmit the network policy shared from the existing policy server to the terminal, and the integrity based on the network policy. You can request to perform one or more of the scans for access, essential software installation, and malicious software installation.
  • step of issuing an IP to the terminal when the integrity of the terminal is confirmed, tethering is performed for access to the terminal, and an IP address that is not duplicated may be issued for each terminal.
  • the step of synchronizing driving rights and user information of the application by interlocking with a policy server and a network, and providing an interface.
  • Upon receiving user authentication information through the user authentication information requesting network access authority information according to the user authentication information to the policy server, receiving network access authority information, and providing tethering to detect one or more terminals requesting connection, the corresponding terminal Checking the integrity of the network, issuing a non-overlapping IP to the corresponding terminal in response to the checked integrity, and receiving packets generated from the terminal connected to the IP, and the packets based on the network access authority information. It contains instructions that execute the step of determining whether to forward.
  • Receiving the network access right information from the policy server that manages the authentication information for the application, the set access right, and the established network policy, whether or not to allow network access, different accessible mobile terminals or terminals connected to the mobile terminal.
  • Accessible terminal information including information may be received.
  • integrity can be checked by receiving an integrity connection and monitoring result through a network access control client included in the terminal.
  • Determining whether to forward packets is the step of checking whether the destination terminal is included in the accessible terminal information when a packet to be transmitted from the terminal to the destination terminal is received. If the destination terminal can be accessed but is connected to a different mobile terminal, a different It may include instructions for performing the step of forwarding a corresponding transport packet to an application of the mobile terminal, and transmitting a response packet corresponding to the transport packet from an application of a different mobile terminal to the terminal.
  • Determining whether to forward packets may include encapsulating and forwarding a transport packet, and receiving an encapsulated response packet from an application of a different mobile terminal.
  • a point-to-point connection control method in an existing network, a router for transmitting packets to a destination, a switch for a hub function that connects a MAC bridge and a network unit, etc.
  • VPN point-to-point connection control method
  • connection through high transmission speed and ultra-delay technology is implemented by implementing an internal network by utilizing the maximum advantages of 5G, which are data transmission speed, delay time, and terminal capacity, without additional network equipment. Loss of connection due to delay can be prevented.
  • the utilization of the internal network is improved, and an independent internal network for each mobile terminal is established based on a set policy level.
  • complex network policies can be implemented more conveniently and conveniently.
  • FIG. 1 schematically illustrates a system implementing a logical internal network according to an embodiment of the present invention.
  • FIG. 2 is a block diagram showing a mobile terminal, a policy server, and a terminal implementing an internal network according to an embodiment of the present invention.
  • FIG. 3 is an exemplary diagram for explaining a network connection according to a policy between groups of mobile terminals according to an embodiment of the present invention.
  • FIG. 4 is a flowchart illustrating communication of a terminal through mobile terminals implementing an internal network according to an embodiment of the present invention.
  • FIG. 5 is a flowchart illustrating a process of controlling a network between terminals by implementing an internal network by a mobile terminal according to an embodiment of the present invention.
  • FIG. 6 is an exemplary diagram showing a database of a policy server according to an embodiment of the present invention.
  • the mobile terminal and the terminal are computing devices including hardware such as a processor, memory, display, and communication module.
  • the processor runs the application in cooperation with the hardware.
  • the display may display a user interface screen provided by an application and receive a user input (eg, a touch input).
  • a user input eg, a touch input
  • the terminal may receive a user input through a keyboard.
  • the communication module is connected to the communication network. Through the communication network, the application and the server transmit and receive data.
  • a mobile terminal is a terminal in which an application implementing an internal network is installed, and the terminal refers to a device that accesses and communicates with an internal network using an application of the mobile terminal.
  • the mobile terminal and the terminal are classified according to whether or not an application is installed, but the implemented form may be the same.
  • a terminal can be implemented in various forms, and generally described by taking a mobile terminal as an example, but it will be implemented in the form of various types of computers such as a pad-type terminal such as a smart pad, a laptop computer, a wearable device, and a TV terminal. I can.
  • the application is software stored in a computer-readable storage medium, and includes instructions and data for executing the operation of the present invention.
  • the application is installed on the terminal, executed on the terminal, communicates with a designated policy server through a communication network, and can implement a logical internal network.
  • FIG. 1 schematically illustrates a system implementing a logical internal network according to an embodiment of the present invention.
  • the policy server 100 for managing a network policy and the mobile terminals 200 installed with the internal network implementation application are connected through a communication network, and each mobile terminal 200 has a separate terminal 300 ) Are connected, and data communication between the corresponding terminals 300 is performed.
  • the communication network connected between the policy server 100 and the mobile terminals 200 may include all types of communication networks that transmit data, such as a wired communication network, a short-range or long-distance wireless communication network, and a mixed network thereof. It can be implemented in the form of a private network built using.
  • the policy server 100 sets and manages a policy for managing a network environment, and collects and manages information of the mobile terminals 200 connected to the network.
  • the policy server 100 may store and manage the access management policy in the network system as a database.
  • the access management policy relates to whether or not to access a network, and may include information on an access authority level as well as whether to access an internal network.
  • the policy server 100 can access a destination terminal that is below the access authority level of the target terminal, but has the access authority level or higher of the target terminal.
  • the access authority level can be managed so that access to the destination terminal is impossible. (N is a natural number)
  • the policy server 100 may manage individual access rights for the terminals 300 connected to the mobile terminal 200 in addition to access rights assigned to the mobile terminals 200.
  • This policy can be reset by the network administrator in one embodiment, and can be changed and set according to the network environment later.
  • the mobile terminal 200 executes an application that implements an internal network and communicates with the policy server 100 through a communication network.
  • the mobile terminal 200 accesses the policy server 100 using a 5G network and receives access to the input ID, but it is also possible through a 3G/LTE (Long Term Evolution) network. I can.
  • the mobile terminal 200 may be a mobility terminal of various types and uses, such as a portable terminal, a notebook computer, an IoT terminal, a vehicle terminal, and a display terminal.
  • the application installed in the mobile terminal 200 provides a kind of user interface screen, and a user ID and a password according to the user ID may be input through the corresponding user interface screen.
  • the application installed in the mobile terminal 200 checks the user authority according to the network policy based on the input user ID, connects one or more terminals according to the identified user ID, and each terminal Performs the function of transmitting the packet generated in.
  • Such an application may be installed in the mobile terminal 200 designated in advance in a separate user authentication process or a security program.
  • the network-implemented application may be described as a subject of the operation, or the mobile terminal 200 running the installed network-implemented application may be described as the subject of the operation.
  • the terminal 300 is a device that transmits and receives packets by accessing a network implemented by an application installed in the mobile terminal 200, and may be implemented in the same or various forms as the mobile terminal 200, for example, a smart pad. It may be implemented in the form of various types of computers, such as pad type terminals, laptop computers, wearable devices, and TV terminals.
  • the terminal 300 communicates with each other through an internal network provided by an application of the mobile terminal 200 and may also communicate with different terminals connected to other mobile terminals.
  • the terminal 300 includes a network access control client that performs integrity access and audit.
  • the network access control client may perform integrity and audit based on a network policy received from an application, and may perform role-based access control (RBAC), a security policy compliance check, and media control such as USB.
  • RBAC role-based access control
  • security policy compliance check a security policy compliance check
  • USB media control
  • the terminal transmitting the packet is referred to as the target terminal 300-1, and the receiving terminal of the packet is referred to as the destination terminal 300-2.
  • the target terminal 300-1 connects to the mobile terminal A 200-A and uses an internal network through a network implementation application installed in the mobile terminal A 200-A. At this time, when the target terminal 300-1 wants to access the destination terminal 300-2, the mobile terminal A 200-A to which the target terminal 300-1 is connected and the destination terminal 300-2 Communication between the connected mobile terminals N (200-N) is performed.
  • the target terminal 300-1 and the destination terminal 300-2 are connected only when access between mobile terminal A (200-A) and mobile terminal N (200-N) is allowed to each other, and on the same internal network. Unlimited network use is possible.
  • FIG. 2 is a block diagram showing a mobile terminal, a policy server, and a terminal implementing an internal network according to an embodiment of the present invention.
  • the application 210 of the mobile terminal 200 checks whether the access right to the internal network, and establishes a connection with the terminal 300. To transmit and receive packets.
  • the policy server 100 checks the authority requested from the mobile terminal 200 and returns a policy management unit 110 to the mobile terminal 200 and a database 120 that stores information on the network policy or the mobile terminal 200. ).
  • the policy management unit 110 searches for a preset database 120 based on a corresponding user ID through communication with the mobile terminal 200 and checks the matched ID for the database 120.
  • the policy management unit 110 When the policy management unit 110 has the requested authority for the matched ID information, it transmits the feedback on the authorization approval to the mobile terminal 200, and if it does not have the requested authority, the feedback on the authorization disapproval is sent to the mobile device. It can be transmitted to the terminal 200.
  • the policy management unit 110 collects data such as login information (ID/Password), issued IP address and MAC address, and access authority level from the connected mobile terminal 200 in real time, and stores the data in the database 120 in the form of a table. Can be stored and managed.
  • the policy management unit 110 includes basic information, unique numbers, IP addresses, MAC addresses, S/N [signal-noise ratio], traffic information, and usage history information of terminals 300 connected to a plurality of connected mobile terminals 200. Etc. can be collected and stored.
  • the policy management unit 110 may perform real-time communication with the mobile terminals 200 to receive various pieces of information collected by the mobile terminals 200, and record and manage them in the database 120.
  • the policy management unit 110 may individually recognize the terminals and apply an individual policy set for each terminal. For example, some different access rights from the connected mobile terminal 200 may be applied to the terminal 300.
  • the policy management unit 110 provides a user ID for access rights to an internal network implemented through an application of the mobile terminal 200 or access rights to a terminal 300 connected to a different mobile terminal 200.
  • the authority can be checked based on the authority and a response corresponding thereto can be provided.
  • a network policy database in which network access rights, access rights to other mobile terminals, etc. are set based on a user ID, and a database storing information of a mobile terminal connected in real time may be separately constructed.
  • the policy server 100 and the mobile terminal 200 are closely connected through a network to synchronize the driving rights and user information of the application installed in each mobile terminal 200.
  • the application 210 of the mobile terminal 200 includes a policy management unit 211, a packet reception unit 212, a terminal management unit 213, and a packet forwarding unit 214 for managing network access rights.
  • the policy management unit 211 connects to the policy server 100 in real time based on the user ID and password input by executing the application to check the access authority of the user.
  • the policy management unit 210 receives an access permission response through the policy server 100 and an access permission query in order to authenticate the permission to access the internal network in a mobile network environment.
  • the policy management unit 211 pre-registers IDs for users who can use the mobile terminal, separately manages a user authentication database to check whether the user ID input from the application matches the password, and then uses only the user ID.
  • the policy server 100 can check whether access is authorized.
  • the method used for user authentication is described with a user ID and password, but is not limited thereto, and authentication may be performed using a user's human body authentication method (iris, fingerprint, etc.) or pattern recognition.
  • the policy management unit 211 searches for a user having a feature point extracted through the authentication method in the user authentication database to determine whether it is matched, and when the user authentication is confirmed in the user authentication database, the policy management unit 211 responds to each user.
  • the authentication code that is used may be transmitted to the policy server 100 to receive access authorization.
  • the packet receiving unit 212 receives all packets generated from a terminal to access a network implemented by an application.
  • the packet receiving unit 212 receives an access packet, a data transmission/reception packet, a control signal packet, and the like from the terminal 300 located in a certain short distance.
  • the terminal management unit 213 checks the integrity connection of the terminal 300 in response to the Wi-Fi access request from the terminal 300 and then performs Wi-Fi tethering.
  • the terminal management unit 213 may request an integrity check result from the terminal 300 that has transmitted the connection request, and check the integrity check result transmitted through the packet receiving unit 212.
  • the terminal management unit 213 may manage a list of available IPs to issue an available IP to the terminal 300 requesting a Wi-Fi connection.
  • Wi-Fi tethering will be described, but the present invention is not limited thereto, and USB tethering, Bluetooth tethering, and the like may be performed according to an applied situation.
  • the terminal management unit 213 may create a list in which an IP issued to connect and manage one or more terminals 300 and a unique number for each terminal 300 are associated. Accordingly, the terminal management unit 213 may collect the connection request information of the terminal 300 and record it in the database in association with the connection request information of the terminal 300 and the issued IP address, which is then transferred to the policy server 100. Can be transmitted.
  • the terminal management unit 213 may collect tracking data on traffic and usage history based on the IPs of the terminals.
  • the packet forwarding unit 214 transmits the packet to the specific terminal or transmits the packet received from the connected terminal 300 to the terminal 300.
  • the packet receiving unit 212 and the packet forwarding unit 214 may perform encryption/decryption of a packet.
  • the packet receiving unit 212 decodes the packet to check the destination of the packet, and if the destination is the terminal 300 to which the destination is connected, the packet forwarding unit 214 decrypts the packet.
  • One packet may be transmitted to the terminal 300.
  • the packet forwarding unit 214 may encrypt the packet received and transmit it to the destination.
  • the packet receiving unit and the packet forwarding unit may respectively perform encryption and decryption on the packet.
  • encryption and decryption steps are performed in transmitting/receiving packets even if the process of encryption and decryption is not separately described.
  • the terminal 300 wirelessly accesses an IP issued through an internal wireless Internet module (Wi-Fi) and performs communication through an internal network implemented in the mobile terminal 200.
  • Wi-Fi wireless Internet module
  • the terminal 300 may include a network access control client, and check and monitor integrity access through the network access control client.
  • one or more of a variety of tests for checking the integrity of a terminal may be tested.
  • FIG. 3 is an exemplary diagram for explaining a network connection according to a policy between groups of mobile terminals according to an embodiment of the present invention.
  • the mobile terminals 200 are provided with an internal rule including a level of access authority assigned to an authenticated user ID, a department corresponding to the user ID, a title, a title, etc. It can be grouped as G10, G20, and G30 based on policies, etc.
  • an unlimited network can be used without a separate connection availability confirmation procedure between mobile terminals in the same group, but a procedure for access authority must be performed between mobile terminals in different groups.
  • the mobile terminal A accesses the policy server 100 to access the terminal to communicate with. After checking, you can transmit and forward the packet.
  • a terminal belonging to the G20 group can freely communicate with a terminal belonging to the G10 group, but network use is limited with a terminal belonging to the G30 group.
  • a terminal belonging to the G30 group may receive a packet from the G10 group, but may be configured to limit data transmission to the outside.
  • the terminal belonging to the G10 group can transmit the packet to the terminal belonging to the G30 group and check only the response packet that has been transmitted.
  • the group policy can be easily changed and set by an administrator later, and communication between various terminals connected to a specific mobile terminal can be managed differently according to the policy.
  • individual access rights can be set based on unique values (IP, S/N, MAC, etc.) of the terminal connected to the mobile terminal.
  • terminal 1 and 2 connected to the mobile terminal terminal 1 may be set to have access rights according to the access rights of the mobile terminal, and terminal 2 may be set to have access rights different from the access rights of the mobile terminal.
  • the terminal 2 can be set so that the mobile terminal cannot connect to the accessible terminals, and conversely, the mobile terminal can be set to allow access to some specific terminals among the terminals to which the mobile terminal is not accessible.
  • a policy can be applied to terminals that access the mobile terminal as a standard, or access can be controlled through policies individually set for the terminals.
  • a code for performing an individual policy may be additionally described or a policy level may be set differently and managed by the mobile terminal 200 and the policy server 100.
  • FIG. 4 is a flowchart illustrating communication of a terminal through mobile terminals implementing an internal network according to an embodiment of the present invention.
  • the terminal 300-1 is connected to the mobile terminal A 200-A with an IP issued through ID authentication, and the terminal 300-2 has an ID on the mobile terminal B 200-B. Communication is being performed through each internal network while connected to the IP issued through authentication.
  • the terminal 300-1 transmits a destination access packet destined for the terminal 300-2 to the mobile terminal 200-A.
  • the mobile terminal 200-A checks whether the destination terminal 300-2 for the destination access packet is a terminal connected to the same group.
  • the mobile terminal 200-A may check whether it is a different terminal connected to the mobile terminal 200-A or a terminal connected within a group including the mobile terminal 200-A. This is because the mobile terminal 200-A manages information on the connected terminal, it is possible to check whether there is matching information between the information of the terminal connected in the same group and the destination terminal 300-2.
  • the mobile terminal 200 -A may access the policy server 100 to check access information of the destination terminal 300-2 and request access permission.
  • a destination access packet is transmitted from the packet forwarding unit 214 of the mobile terminal A 200-A to the mobile terminal B 200-B corresponding to the access information of the destination terminal 300-2. Can be transmitted.
  • the mobile terminal A (200-A) may transmit a destination access packet by adding a security code indicating a packet for which access is permitted.
  • the destination access packet may be encapsulated and transmitted to the mobile terminal B 200-B.
  • Encapsulation refers to a technique that hides information within an object and provides external access that allows other objects to interact with that information, but does not allow direct access to it.
  • the encapsulated destination access packet is checked (Encapsulation), and the terminal management unit 133 recognizes that the destination terminal is one of the connected terminals. Confirm. Then, after checking whether the packet is a packet received from the terminal 300-1 to which access is permitted, the corresponding destination access packet is transmitted to the destination terminal 300-2.
  • the mobile terminal B may access the policy server 100 to check whether the connection of the terminal 300-1 is allowed, or check the security code added to the packet itself.
  • the destination terminal 300-2 transmits a destination response packet according to the received destination access packet, which is transmitted from the mobile terminal B 200-B to the mobile terminal A 200-A in the same manner as described above, This is transmitted to the terminal 300-1 again.
  • a packet transmitted/received between terminals 300 connected to the mobile terminal 200 and a packet transmitted/received between different mobile terminals may be encrypted and decrypted through different methods.
  • FIG. 5 is a flowchart illustrating a process of controlling a network between terminals by implementing an internal network by a mobile terminal according to an embodiment of the present invention
  • FIG. 6 is an exemplary diagram showing a database of a policy server according to an embodiment of the present invention.
  • the mobile terminal 200 performs user authentication by driving an application (S110).
  • the mobile terminal 200 may perform login by checking an ID and password input from a user through an interface screen provided by the application 210.
  • the mobile terminal 200 checks the access authority for the user authentication information (S120).
  • the mobile terminal 200 requests the policy server 100 for permission to access the ID. Accordingly, the policy server 100 stores the access permission request information received from the mobile terminal 200 in a database, and searches for information matching the access permission request information with previously established policy information. Through this, the policy server 100 may transmit permission information or approval for a corresponding access permission request.
  • the authority information further includes reference information for grouping, policy information between groups, accessible terminal information or access authority level including information of different mobile terminals that can be accessed or terminals that have accessed the mobile terminal. Can include.
  • the mobile terminal 200 activates the hotspot (S130).
  • the mobile terminal 200 activates a hotspot at the same time as accessing the application of the terminal, and through this, the terminal requests permission to access Wi-Fi.
  • the mobile terminal 200 performs connection approval for the connection request of the terminal corresponding to the corresponding ID and issues an IP to the terminal (S140).
  • the application running on the mobile terminal 200 collects and records Wi-Fi connection request information of the terminal 300, and requests an integrity connection check and monitoring result to the terminal 300. Accordingly, if integrity is verified from the terminal 300, an available IP is issued to establish a Wi-Fi connection to allow the terminal 300 to use the network.
  • the mobile terminal 200 may share the collected information of the terminal 300, access request information, integrity check information, issued IP, and the like with the policy server 100.
  • the terminal 300 can access the network through the connected Wi-Fi and use the Internet.
  • the mobile terminal 200 receives an access packet to be transmitted to the destination terminal from the terminal connected with the issued IP (S150).
  • the mobile terminal 200 receives all packets generated by the terminal 300 and checks whether forwarding is performed.
  • the mobile terminal 200 checks whether connection with the destination terminal is possible (S160).
  • the mobile terminal 200 may check whether a destination terminal is connected within the same group in order to check a group to which the destination terminal belongs, and may request permission from the policy server 100 to the destination terminal.
  • the policy server 100 may compare terminal information shared from the mobile terminals 200 to check a group to which the destination terminal belongs, and check a policy between the corresponding terminal 300 and the destination terminal 300-1.
  • the policy server 100 may check detailed policies indicating individual access rights of terminals 300 connected to each mobile terminal in addition to policies between mobile terminals.
  • the mobile terminal 200 drops an access packet and transmits a drop message to the terminal (S170).
  • the access information indicating the mobile terminal to which the destination terminal 300-1 is accessed is displayed together with the access permission approval. Receive.
  • the mobile terminal 200 when the mobile terminal 200 receives an access packet including the IP of the destination terminal 300-1 from the terminal 300, the mobile terminal 200 checks whether access to the destination terminal 300-1 is possible using the IP. Alternatively, the policy server 100 may request access authority confirmation. Accordingly, when the access authority is granted, the mobile terminal 200 forwards the access packet to the corresponding IP, so that different mobile terminals managing the IP may receive the access packet.
  • the mobile terminal 200 can access the destination terminal, it transmits a packet to another mobile terminal connected to the destination terminal, receives a response packet, and delivers it to the terminal (S180).
  • Step S180 of transmitting and receiving packets between the terminal 300 and the destination terminal 300-2 through packet communication between the mobile terminals 200 has been previously described in FIG. 4, and thus a redundant description will be omitted.
  • the policy server 100 stores and manages access information between the mobile terminal 200 and the terminal 300 in the database 120.
  • connected terminal information Based on user ID and password (PWD), connected terminal information, IP address, MAC address, and each set network policy are stored and managed in a table.
  • tracking data on the traffic and usage history of each terminal, and a control plan for the application accordingly, can be stored and managed in connection with each application.
  • the policy server 100 searches for access information of the destination terminal and access rights of the terminals, and transmits permission approval feedback only to the matched terminals, thereby controlling access of unauthorized terminals and implementing an independent intranet in the network. .
  • a system implementing a logical internal network constructs an internal network by replacing the complex configuration of essential items (firewall (VPN) router, core switch, distribution switch) constituting the existing internal network through a mobile application. You can minimize the cost of doing it.
  • Firewall VPN
  • access control for the source IP/MAC address and destination IP included in the packet generated by a terminal such as a PC connected to the mobile terminal is performed, and communication between groups of the internal network is performed by grouping mobile terminals implementing the network through an application.
  • a network can be constructed using the maximum advantages of 5G, such as data transmission speed, delay time, and terminal capacity. For example, a network with a maximum transmission speed of 20 Gbps can be established. While in use, it is possible to prevent loss of connection due to connection delay between mobile and terminal through ultra-low delay technology.
  • the computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination.
  • the medium may be specially designed and configured, or may be known and usable to those skilled in computer software.
  • Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floppy disks, and ROM, RAM, flash memory, and the like.
  • Hardware devices specially configured to store and execute the same program instructions are included.
  • the medium may be a transmission medium such as an optical or metal wire or a waveguide that transmits a signal specifying a program command or a data structure.
  • Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé de production d'un réseau interne logique par une application installée sur un terminal mobile, le procédé comprenant les étapes dans lesquelles l'application va : effectuer l'authentification d'un utilisateur reçu par celle-ci ; demander, à un serveur de règles connecté, des informations de droit d'accès au réseau en fonction de l'authentification de l'utilisateur, et recevoir les informations de droit d'accès au réseau de l'utilisateur ; lorsque le droit d'accès de l'utilisateur est approuvé, recevoir une demande de connexion en provenance d'au moins un terminal correspondant à l'authentification de l'utilisateur ; demander le résultat d'un contrôle d'intégrité au terminal, et lorsque l'intégrité du terminal est confirmée, délivrer une adresse un IP au terminal ; collecter des informations de demande de connexion ou des informations d'accès du terminal qui accède par l'intermédiaire de l'adresse IP délivrée, et les partager avec le serveur de règles ; et chiffrer et transmettre des paquets générés à partir du terminal, et déchiffrer les paquets chiffrés reçus et les transférer au terminal.
PCT/KR2020/010090 2019-07-30 2020-07-30 Procédé de production d'un réseau interne logique, et terminal mobile et application pour la mise en œuvre d'un tel réseau Ceased WO2021020918A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR20190092731 2019-07-30
KR10-2019-0092731 2019-07-30

Publications (1)

Publication Number Publication Date
WO2021020918A1 true WO2021020918A1 (fr) 2021-02-04

Family

ID=74229251

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2020/010090 Ceased WO2021020918A1 (fr) 2019-07-30 2020-07-30 Procédé de production d'un réseau interne logique, et terminal mobile et application pour la mise en œuvre d'un tel réseau

Country Status (2)

Country Link
KR (1) KR102211238B1 (fr)
WO (1) WO2021020918A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102309116B1 (ko) * 2021-09-07 2021-10-08 프라이빗테크놀로지 주식회사 데이터 플로우 기반 애플리케이션의 네트워크 접속을 제어하기 위한 시스템 및 그에 관한 방법
KR102718515B1 (ko) * 2021-12-23 2024-10-17 주식회사 이노그리드 대규모 멀티클러스터 프로비저닝을 위한 엣지 클라우드 운영 시스템

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20130028323A (ko) * 2011-09-09 2013-03-19 삼성에스디에스 주식회사 네트워크 접근 제어 시스템 및 방법
KR20130044107A (ko) * 2011-10-22 2013-05-02 주식회사 비티비솔루션 관리 정책 기반의 단말제어 보안 시스템 및 그 방법
KR20140146941A (ko) * 2013-06-18 2014-12-29 숭실대학교산학협력단 사용자 단말 인증 서버 및 인증 방법
KR20170057803A (ko) * 2015-11-17 2017-05-25 주식회사 넥슨코리아 사용자 접속에 대한 보안 인증 시스템 및 그 방법
KR20180131765A (ko) * 2017-06-01 2018-12-11 주식회사 우리들아이티 관리자 모드 네트워크 접속관리시스템 및 접속 방법

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20130028323A (ko) * 2011-09-09 2013-03-19 삼성에스디에스 주식회사 네트워크 접근 제어 시스템 및 방법
KR20130044107A (ko) * 2011-10-22 2013-05-02 주식회사 비티비솔루션 관리 정책 기반의 단말제어 보안 시스템 및 그 방법
KR20140146941A (ko) * 2013-06-18 2014-12-29 숭실대학교산학협력단 사용자 단말 인증 서버 및 인증 방법
KR20170057803A (ko) * 2015-11-17 2017-05-25 주식회사 넥슨코리아 사용자 접속에 대한 보안 인증 시스템 및 그 방법
KR20180131765A (ko) * 2017-06-01 2018-12-11 주식회사 우리들아이티 관리자 모드 네트워크 접속관리시스템 및 접속 방법

Also Published As

Publication number Publication date
KR102211238B1 (ko) 2021-02-02

Similar Documents

Publication Publication Date Title
WO2021060854A1 (fr) Système de commande d'accès réseau et procédé associé
WO2013025085A2 (fr) Appareil et procédé permettant de prendre en charge un nuage de famille dans un système informatique en nuage
WO2020189926A1 (fr) Procédé et serveur permettant de gérer une identité d'utilisateur en utilisant un réseau à chaîne de blocs, et procédé et terminal d'authentification d'utilisateur utilisant l'identité d'utilisateur basée sur un réseau à chaîne de blocs
WO2013062352A1 (fr) Procédé et système de contrôle d'accès dans un service informatique en nuage
WO2019127973A1 (fr) Procédé, système et dispositif d'authentification d'autorité pour référentiel de miroirs et support de stockage
WO2019225921A1 (fr) Procédé de stockage de clé numérique, et dispositif électronique
WO2018026030A1 (fr) Véhicule, et procédé de commande associé
WO2021112603A1 (fr) Procédé et dispositif électronique permettant de gérer des clés numériques
WO2013183814A1 (fr) Système de service en nuage à fonction de sécurité améliorée et son procédé de prise en charge
WO2022102930A1 (fr) Système did utilisant une authentification par pin de sécurité basée sur un navigateur, et procédé de commande associé
WO2013025060A2 (fr) Dispositif et procédé pour l'authentification de sécurité entre dispositifs basée sur une puf lors de la communication entre machines
WO2013065915A1 (fr) Procédé d'interfonctionnement de confiance entre une région de confiance et une région non de confiance, procédé, serveur et terminal pour commander le téléchargement d'applications de confiance, et système de commande les appliquant
WO2014185594A1 (fr) Système et procédé à authentification unique dans un environnement vdi
WO2018151390A1 (fr) Dispositif de l'internet des objets
WO2012093900A2 (fr) Procédé et dispositif pour authentifier une entité de réseau personnel
WO2020050424A1 (fr) SYSTÈME ET PROCÉDÉ BASÉS SUR UNE CHAÎNE DE BLOCS POUR UNE AUTHENTIFICATION DE SÉCURITÉ MULTIPLE ENTRE UN TERMINAL MOBILE ET UN DISPOSITIF D'IdO
WO2020022700A1 (fr) Élément de sécurité de traitement et d'authentification de clé numérique et procédé de fonctionnement associé
WO2013191325A1 (fr) Procédé pour authentifier un identifiant d'ouverture par plate-forme de confiance, et appareil et système associés
WO2012099330A2 (fr) Système et procédé de délivrance d'une clé d'authentification pour authentifier un utilisateur dans un environnement cpns
WO2023211121A1 (fr) Système de commande d'émission et de réception de fichier d'application sur la base d'un proxy, et procédé associé
WO2014003505A1 (fr) Système et procédé de configuration d'aspect social d'un dispositif
WO2012044072A2 (fr) Procédé d'attribution de clé utilisateur dans un réseau convergent
WO2014003516A1 (fr) Procédé et appareil de fourniture de partage de données
WO2017209467A1 (fr) Procédé et appareil pour fournir un service de sécurité de données p2p dans un environnement iot
WO2019132270A1 (fr) Procédé de communication sécurisé dans un environnement nfv et système associé

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20846560

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20846560

Country of ref document: EP

Kind code of ref document: A1