KR100958438B1 - Connection relay system and method, user terminal for managing packet transmission and recording medium thereof - Google Patents

Abstract

The present invention relates to a connection relay system and a method thereof.

The access relay system of the present invention receives and stores session establishment information for first private access devices of a private network including a plurality of first private access devices and a plurality of second private access devices that are matched to each other. In response to a request for access to a content providing device from a user terminal, one or more first private access devices that form the lowest session among a plurality of first private access devices are selected based on the session establishment information. Thereafter, a public IP address corresponding to the first private access device selected to access the content providing device through the second private access device is provided to the user terminal.

According to the present invention, by providing a bypass to the content providing device of the user terminal using a private network, it can be expected to effectively block the attack on the content providing device of the server attack type clients secretly installed in the user terminal.

Private network, access, relay, attack, DDos, traffic, TCP, UDP

Description

A connection relay system and method thereof, and a user terminal for managing packet transmission and a recording medium thereof {ACCESS RELAY SYSTEM AND METHOD THEREOF, TERMINAL MANAGING PACKET TRANSMISSION AND RECODING MEDIUM THEREOF}

The present invention relates to a connection relay system and a method thereof. In particular, the present invention relates to a connection relay system and a method for relaying a connection to a content providing device for user terminals through a private network.

Conventionally, when a content server (or a content providing device) providing content is subjected to a server attack such as D-Dos (Distributes Denial of Service; hereinafter referred to as "D-Dos"), access acceptance resources are exhausted and further. There is a phenomenon that no connection is received from the above clients. When such a loss of server function occurs, the network bandwidth of the content server becomes full and many users who want to use the content cannot access the corresponding content server.

D-Dos attacks are a primitive way of sending large amounts of bad traffic, and there is currently no ultimate solution. In order to block D-Dos attack, the most attacking UDP port (currently, 70% of attacks occur through UDP port) should be blocked, but in reality, Internet Service Provider (ISP) or Internet Data Center (IDC) ), UDP port blocking cannot be done.

When such a D-Dos attack occurs, the function for the content server that can access the public IP should be blocked, and the user should be instructed to access the same content server through another path. However, if an agent for a D-Dos attack is installed in the user terminal, providing a route through the public IP has little meaning.

Accordingly, there is a need for a technology for managing server attack agents installed in a user terminal and a new access relay technology capable of providing a content service while blocking a D-Dos attack.

An object of the present invention is to provide a connection relay system and method for relaying a connection to a content providing device for user terminals through a private network.

In accordance with an aspect of the present invention for solving the above problems, a connection relay system for controlling data transmission and reception between a content providing device for providing content and a user terminal,

A first access terminal including a plurality of first private access devices for receiving a message for transmission from a user terminal to the content providing device, the first access device having a public IP address and a private IP address corresponding thereto; A second connection end including a plurality of second private access devices corresponding to the plurality of first private access devices, the second private access devices being connected to the same private IP address as the corresponding first private access device; A public IP address corresponding to each of the first private access devices is stored, and the user terminal selects one or more first private access devices from among the plurality of first private access devices, and corresponds to the selected first private access device. An access relay device providing a public IP address; And a relay device that receives the message from the second private access device corresponding to the selected first private access device and delivers the message to the content providing device.

Here, the connection relay device,

Receive and store session formation information of each of the plurality of first private access devices, and store a public IP address corresponding to a private access device that forms a lowest session among the plurality of first private access devices based on the session formation information. Provided to the user terminal.

Here, the connection relay device,

A storage unit which stores session establishment information for each of the plurality of first private access devices; An information collector configured to periodically request session establishment information from the plurality of first private access devices, receive a response thereto, and store the response in the storage; And a client access processor configured to provide a public IP address corresponding to a first private access device that forms a lowest session among the plurality of first private access devices to the user terminal based on the session establishment information stored in the storage unit. .

According to an aspect of the present invention, a connection relay method of a connection relay system for controlling data transmission and reception between a content providing device for providing content and a user terminal,

Receiving and storing session establishment information for the first private access devices of a private network including a plurality of first private access devices and a plurality of second private access devices that are matched with each other; Receiving a request for access to the content providing device from the user terminal; Selecting at least one first private access device that has formed a lowest session among the plurality of first private access devices based on the session establishment information; And providing the user terminal with a public IP address corresponding to the selected first private access device to access the content providing device through the second private access device.

Here, receiving and storing the session establishment information,

Periodically requesting the session establishment information for the plurality of first private access devices; And receiving and storing the session establishment information from the plurality of first private access devices, respectively.

According to a feature of the present invention, a user terminal connected to a private access device and performing data transmission / reception with a device providing content through the private access device,

A communication unit including a communication interface and transmitting and receiving data to and from the private access device using the communication interface; A traffic monitoring unit for monitoring a packet transmitted from the communication unit to the private access device and measuring a packet transmission amount for packets transmitted during a set time; And a connection manager to determine whether the packet transmission amount received from the traffic monitoring unit is greater than a preset reference value, and block packet transmission transmitted through the communication unit when the packet transmission amount is greater than the preset reference value.

Here, the communication unit transmits a Transmission Control Protocol (TCP) and a User Datagram Protocol (UDP) packet, and the connection manager determines whether the packet transmission amount is a TCP packet or a UDP packet, and based on the set reference values, respectively, the communication interface. Block the transmission of packets sent through

According to a feature of the present invention, a recording medium for transport packet management of a user terminal connected to a private access device and transmitting and receiving data to and from a device providing content through the private access device,

Monitoring a packet transmitted to the private access device in real time for a preset time and measuring a packet transmission amount; Determining whether the packet transmission amount exceeds a preset transmission reference value; And blocking the packet transmission when the packet transmission amount exceeds the reference value.

Here, the function of measuring the packet transmission amount,

And a function of measuring a packet transmission amount by monitoring in real time a Transmission Control Protocol (TCP) packet or a User Datagram Protocol (UDP) packet transmitted to the private access device.

According to the present invention, by providing a bypass to the content providing device of the user terminal using a private network, it can be expected to effectively block the attack on the content providing device of the server attack type clients secretly installed in the user terminal, Through this, it is possible to expect an effect that can always provide a smooth service to users.

In addition, the connection relay device periodically checks the state of the private connection device to control the connection of the user terminal, thereby providing an effect of providing a fast connection to the content providing device.

In addition, by monitoring the congestion traffic of the user terminal in advance to block the congestion traffic of the server attack type clients, such as D-DoS, it is possible to expect the effect of blocking the attack of the content providing device.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

A connection relay system and a method thereof according to an embodiment of the present invention will now be described with reference to the drawings.

1 is a block diagram illustrating a connection relay system according to an exemplary embodiment of the present invention.

As shown in Fig. 1, the connection relay system of the present invention includes a connection relay device 200, a first connection end 300, a second connection end 400, and an L4 (Layer 4) device 500 (hereinafter, “ Relay device), the content providing device 600. Then, data is transmitted and received with the user terminal 100 connected through the network.

The content providing device 600 is a device for providing content and includes a plurality of content providing devices 600-1, 600-2, 600-3, and 600-n.

The plurality of content providing apparatuses 600-1, 600-2, 600-3, and 600-n perform the function of providing the same content, but are different from the public IP (hereinafter referred to as "IP"). Has

Here, each of the content providing apparatuses 600-1, 600-2, 600-3, and 600-n operate in association with each other and share content and user information stored through one database (omitted). do.

The second access terminal 400 includes a plurality of virtual private networks 400-1, 400-2, 400-n, and a plurality of private access devices 400-1, 400-2, 400-n. n) is connected to the content providing device 600 through the L4 device 500 using the public IP.

The private connection devices 400-1, 400-2, and 400-n of the second connection terminal 400 may include a plurality of private connection devices 300-1 and 300-2 included in the first connection terminal 300. And 300-n) are matched to each other. In addition, the L4 device (receiving a request for accessing the content providing device 600 from the user terminal 100 received from the private access devices 300-1, 300-2, and 300-n of the first access terminal 300). The content providing device 600 is accessed through the 500.

In addition, the private connection devices 400-1, 400-2, and 400-n of the second connection terminal 400 are respectively the private connection devices 300-1, 300-2, of the first connection terminal 300. 300-n), a message from the user terminal 100 for transmission to the content providing device 600 is received. Then, the received message is transmitted to the public IP address corresponding to the L4 device 500 configured to transmit the message. At this time, the private access devices 400-1, 400-2, and 400-n of the second access terminal respectively store access addresses for the L4 device.

The L4 device 500 stores the public IP addresses of the plurality of content providing devices 600, and selects one public IP address arbitrarily from among the public IP addresses of the plurality of content providing devices 600 to store the contents. Send the received message to the device.

The first connection terminal 300 includes a plurality of private access devices 300-1, 300-2, and 300-n, and a plurality of private access devices 300-1, 300-2, and 300-n. Are connected to a plurality of private access devices 400-1, 400-2, and 400-n included in the second access terminal 400 through private IP addresses, respectively.

Here, each of the private access devices 300-1, 300-2, and 300-n of the first access terminal 300 is connected to the private IP when the user terminal 100 accesses through the public IP. It connects to the private access devices 400-1, 400-2, and 400-n of the second access terminal 400 via IP to transmit a message received from the user terminal 100.

In addition, the private connection devices 300-1, 300-2, and 300-n of the first connection terminal 300 transmit state information (session formation information, etc.) at the request of the connection relay device 200.

Meanwhile, the private connection devices 300-1, 300-2, and 300-n of the first connection terminal 300 and the private connection devices 400-of the second connection terminal 400 according to the embodiment of the present invention. 1, 400-2, and 400-n each include a function of encrypting / decrypting data to be transmitted and received. The private connection devices 300-1, 300-2, and 300-n of the first connection terminal 300 and the private connection devices 400-1, 400-2, and 400-of the second connection terminal 300 are provided. n) maintains tunneling for a predetermined time through data transmission and reception.

The connection relay device 200 is a device that performs connection relay so that the user terminal 100 can access the content providing device 600. The private connection devices 300-1 and 300-2 of the first connection terminal 300 are provided. , 300-n) receives and stores network usage state information (use state information on session establishment) for each. In addition, the public IP address is provided to the user terminal 100 based on the stored use state information so that the user can access the content providing apparatus 600. In this case, the connection relay device 200 selects one or more private access devices forming the lowest session among the plurality of private access devices 300-1, 300-2, and 300-n, and public IP of the selected private access device. The address is provided to the user terminal 100.

Such a connection relay device 200 according to an embodiment of the present invention will be described later with reference to FIG. 2.

On the other hand, the access relays 200 to each other in order to defend against traffic (Server-down) attacks, such as traffic (D-DoS) (D-DoS) (D-DoS) (D-DoS) It may also include multiple access relays 200 having different public IP addresses.

The user terminal 100 is a device that provides the same content as the content providing device 600 (omitted) and can be directly provided through a public IP address to receive the content.

Specifically, the user terminal 100 relays a public IP address for accessing the content providing device 600 when the device (omitted) connected through the public IP address is not attacked by the D-Dos or the like. A request is made to the device 200, and the content service device 600 is provided with a content service by accessing the content providing device 600 through a public IP address.

In addition, the user terminal 100 may include a connection management agent 110 to block a server attack on the content providing device 600 in advance.

Here, the user terminal 100 includes all wired and wireless terminals capable of transmitting and receiving data based on IP, such as a personal computer (PC).

This, a user terminal according to an embodiment of the present invention will be described later with reference to FIG.

2 is a detailed block diagram illustrating a connection relay apparatus according to an exemplary embodiment of the present invention.

As shown in FIG. 2, the connection relay apparatus 200 according to an exemplary embodiment of the present invention may include a communication unit 210, a first connection end information collection unit 220, a client connection processing unit 240, and a state information storage unit 230. ).

The communication unit 210 performs data transmission / reception with each private access device 300-1, 300-2, 300-n of the first access terminal 300 through a network.

The first access point information collecting unit 220 receives the state information of the private access device from each of the private access devices 300-1, 300-2, and 300-n of the first access point 300, and receives the received state information. The state information storage unit 230 stores.

In this case, the first access point information collecting unit 220 periodically requests the state information to each of the private access devices 300-1, 300-2, and 300-n, and receives a response to the state information storage unit. Save to 230.

Here, when each private access device 300-1, 300-2, or 300-n periodically transmits state information, the first access point information collecting unit 220 does not request the state information, but periodically As a result, the state information received from each of the private access devices 300-1 and 300-2 300-n may be stored in the state information storage unit 230.

When the client connection processing unit 240 is requested to access the content providing apparatus 600 from the user terminal 100, the client connection processing unit 240 connects to the content providing apparatus 600 based on the state information stored in the state information storage unit 230. The private access device of the first access terminal 300 is selected and the public IP address of the selected private access device is provided to the user terminal 100. In this case, the client access processor 240 selects the private access device having the smallest session establishment among the private access devices 300-1, 300-2, and 300-n of the first access terminal 300.

The state information storage unit 230 receives the state information on the private access devices 300-1, 300-2, and 300-n of the first access terminal 300 from the first access terminal information collection unit 220. Save it.

3 is a block diagram illustrating in detail a user terminal according to an exemplary embodiment of the present invention.

As shown in FIG. 3, the user terminal 100 according to an embodiment of the present invention includes a connection management agent 110 and a communication unit 120.

The connection management agent 110 includes a connection management unit 112 and a traffic monitoring unit 114.

The connection manager 112 receives the packet transmission amount of the communication unit 120 from the traffic monitoring unit 114, determines whether the packet transmission amount is greater than a preset reference value, and blocks the packet transmission of the communication unit 120. .

At this time, the connection manager 112 checks whether the received packet transmission amount is a Transmission Control Protocol (TCP) packet or a User Datagram Protocol (UDP) packet, respectively. It may be determined whether the packet transmission amount is large based on the preset reference value.

In addition, the connection management unit 112 requests the access relay device 200 a public IP address for accessing the content providing device 600, and accesses the content providing device 600 through the received public IP address corresponding thereto. do.

The traffic monitoring unit 114 transmits a communication control protocol (TCP) and a user datagram protocol (UDP) hereinafter transmitted from the communication unit 120 to a private access device of the first access terminal 300. The packet transmission amount for " UDP " in real time, and provides the monitored packet transmission amount to the connection management unit 112.

Specifically, the traffic monitoring unit 114 monitors the TCP and UDP packets transmitted through the network interface card (hereinafter referred to as "NIC") of the communication unit 120, and counts the TCP and UDP packets by The amount of packet transmission for a preset time is measured and provided to the connection manager 112.

The communication unit 120 includes a NIC and transmits a TCP or UDP packet received from an upper application service unit (omitted) through a network.

Such a user terminal according to an embodiment of the present invention, when a direct connection to a device (omitted) that provides the same content as the content providing device 600 through the public IP address, if the connection is not made to the device of the public IP address In response to the user's request, the access relay apparatus 200 may request a public IP address for accessing the content providing apparatus 600, and may access the content providing apparatus 600 through the received public IP address. . Through this, the user can bypass the connection to the content providing device through the private network, thereby providing the content.

In addition, by separately including a traffic monitoring unit for monitoring traffic in the user terminal according to an embodiment of the present invention, there is a great advantage that can minimize the traffic generated by the server attack type client.

 Next, a method of operating a user terminal according to an exemplary embodiment of the present invention will be described with reference to FIG. 4.

4 is a flowchart illustrating a method of operating a user terminal according to an exemplary embodiment of the present invention.

As shown in FIG. 4, the method for operating the user terminal 100 according to an exemplary embodiment of the present invention is performed by the connection management agent 110 of the user terminal 100 monitoring the NIC of the communication unit 120.

The connection management agent 110 of the user terminal 100 monitors a packet transmitted from the NIC of the communication unit 120 in real time (S100).

The connection management agent 110 counters TCP and UDP packets based on the packets transmitted to the private access device of the first access terminal 300 (S102), and the amount of packet transmission per hour during the set time is set to each reference value. It is determined whether to exceed (104).

As a result of the determination in step S106, when the packet transmission amount per hour exceeds the reference value, the access management agent 110 blocks the transmission of the corresponding packet of the NIC (S106).

As a result of the determination in step S106, when the packet transmission amount per hour does not exceed the reference value, the connection management agent 110 monitors the packet transmitted through the NIC in the next period.

Such a user terminal can be expected to effectively block congestion packets generated by a client program for a server attack such as D-Dos through a connection management agent.

5 is a data flowchart illustrating a connection relay method of a connection relay system according to an exemplary embodiment of the present invention.

As shown in FIG. 5, in the connection relaying method of the connection relay system according to the embodiment of the present invention, the connection relay device 200 periodically connects the private connection devices 300-1 and 300-of the first connection terminal 300. 2, 300-n).

First, the connection relay device 200 periodically requests status information from the private access devices 300-1, 300-2, and 300-n of the first access terminal 300, and receives the status information. Store it (S200, S202).

The user terminal 100 connects to the access relay device 200 in order to receive a public IP address for accessing the content providing device 600 at the user's request (S204).

At this time, when the user terminal 100 directly accesses a device (not shown) that provides the same content as the content providing device 600 through a public IP address, if the connection to the device of the public IP address is not made, In order to receive a public IP address for accessing the content providing device 600, the access relay device 200 is connected.

In addition, the user terminal 100 generates a public IP request message for accessing the content providing device 600 and transmits it to the access relay device 200 (S206).

The access relay device 200 receives a public IP request message from the user terminal 100 and private access devices 300-1 and 300-2 of the first access terminal 300 stored in the access relay device 200. , Status information for the (300-n) is checked (S208).

In addition, the connection relay device 200 is one private access device having the least session establishment among the private access devices 300-1, 300-2, and 300-n of the first access terminal 300 based on the state information. Select 300-1 (S210), and transmits the public IP address of the selected private access device to the user terminal 100 (S212).

In this case, the connection relay device 200 selects one or more private access devices with less session formation among the plurality of private access devices 300-1, 300-2, and 300-n of the first access terminal 300, The public IP address of the selected private access device may be transmitted to the user terminal 100.

The user terminal 100 receives a public IP address from the access relay device 200 and transmits a connection request message to the private access device 300-1 of the received public IP address (S214).

The private access device 300-1 of the first access terminal 300 receives a connection request message from the user terminal 100 (S216), and connects to the private access device 300-1 of the first access terminal 300. The access request message is transmitted to the private access device 400-1 of the second access terminal 400 of the matched private IP address (S218). At this time, the first private access device 300-1 and the second private access device 400-1 are connected to the same private IP address.

The private connection device 400-1 of the second connection terminal 400 receives a connection request message from the private connection device 300-1 of the first connection terminal 300 (S220) and the first connection terminal 300. In step S222, the message received from the private access device 300-1 is transmitted to a public IP address corresponding to the L4 device 500. Here, the private connection device 300-1 of the first connection terminal 300 and the private connection device 400-1 of the second connection terminal 400 form tunneling for a predetermined time through data transmission and reception. do.

The L4 device 500 receives a connection request message from the private access device 400-1 and transmits it to one of the plurality of content providing devices 600. At this time, the L4 device 500 stores public IP addresses as many as the number of content providing devices 600, and arbitrarily selects one public IP address to transmit a message.

The content providing device 600 receives a connection request message of the user terminal 100 from the private access device 400-1 of the second access terminal 400, and provides content information (web page) to be provided to the user terminal 100. Information) is transmitted to the private access device 400-1 of the second connection terminal 400 (S224).

The private access device 400-1 of the second access terminal 400 transmits content information to the user terminal 100 through the private access device 300-1 of the matched first access terminal 300 ( S226).

The user terminal 100 receives the content information, and provides the received content information to the user (S228).

Thereafter, the user terminal 100 may provide a content providing device through tunneling formed between the private access device 300-1 of the first access terminal 300 and the private access device 400-1 of the second access terminal 400. 600) and transmits and receives data (S230).

When the user terminal cannot access the content providing device due to a server error such as a D-Dos attack or a server down through the connection relay method, the user terminal accesses the content through another private content providing device that provides the same content through a private network. There is an advantage that can be provided.

In particular, by providing a bypass of the content providing device of the user terminal through a connection relay method using a private network, there is a great advantage that can effectively block attacks on the content providing device of server attack clients secretly installed in the user terminal.

The embodiments of the present invention described above are not only implemented through the apparatus and the method, but may also be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a block diagram illustrating a connection relay system according to an exemplary embodiment of the present invention.

2 is a detailed block diagram illustrating a connection relay apparatus according to an exemplary embodiment of the present invention.

3 is a block diagram illustrating in detail a user terminal according to an exemplary embodiment of the present invention.

4 is a flowchart illustrating a method of operating a user terminal according to an exemplary embodiment of the present invention.

5 is a data flowchart illustrating a connection relay method of a connection relay system according to an exemplary embodiment of the present invention.

Claims (13)

A connection relay system for controlling data transmission and reception between a content providing device providing content and a user terminal, A first access terminal comprising a plurality of first private access devices for receiving a message for transmission from a user terminal to the content providing device, the first private access device having a public IP address and a private IP address corresponding thereto; ; A second connection end including a plurality of second private access devices corresponding to the plurality of first private access devices, the second private access devices being connected to the same private IP address as the corresponding first private access device; A public IP address corresponding to each of the first private access devices, and receives and stores session formation information of the plurality of first private access devices, respectively, based on the session establishment information; An access relay device providing a public IP address corresponding to a private access device forming a lowest session among the access devices to the user terminal; And A relay device which receives the message from the second private access device corresponding to the selected first private access device and delivers the message to the content providing device. Connection relay system comprising a. delete The method of claim 1, The connection relay device, A storage unit which stores session establishment information for each of the plurality of first private access devices; An information collector configured to periodically request session establishment information from the plurality of first private access devices, receive a response thereto, and store the response in the storage; And A client connection processor configured to provide a public IP address corresponding to a first private access device that forms the lowest session among the plurality of first private access devices to the user terminal based on the session establishment information stored in the storage unit; Connection relay system comprising a. The method according to claim 1 or 3, The second private connection device, And a tunneling (Tunneling) for transmitting and receiving a message for a predetermined time with the first private access device that transmitted the message. The method according to claim 1 or 3, The first private connection device and the second private connection device, A connection relay system that performs encryption / decryption when transmitting and receiving messages to each other. In the connection relay method of a connection relay system for controlling data transmission and reception between a content providing device for providing content and a user terminal, Receiving and storing session establishment information for the first private access devices of a private network including a plurality of first private access devices and a plurality of second private access devices that are matched with each other; Receiving a request for access to the content providing device from the user terminal; Selecting at least one first private access device that has formed a lowest session among the plurality of first private access devices based on the session establishment information; And Providing a public IP address corresponding to the selected first private access device to the user terminal to access the content providing device through the second private access device; Connection relay method comprising a. The method of claim 6, Receiving and storing the session establishment information, Periodically requesting the session establishment information for the plurality of first private access devices; And Receiving and storing the session establishment information from the plurality of first private access devices, respectively. Connection relay method comprising a. The method according to claim 6 or 7, And the first private access device connects with the second private access device using the private IP address of the second private access device. delete delete delete delete delete

Images