Apparatus and method for securing internet server

• US 20060126518A1
• Filed: 03/21/2005
• Published: 06/15/2006
• Est. Priority Date: 11/25/2004
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Jang, Jong Soo, Nam, Taek Yong, Lee, Seungmin
• Application Number:
  US11/085,893
• Publication Number:
  US 20060126518A1
• Time in Patent Office: Days
• US Class Current: 370/244
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Provided are an apparatus and a method for securing internet server, including: a conformance determiner which determines whether or not packets received from a network are normal, and outputs a determination result; a rate limiter which classifies packets according to predetermined rates, and limits bandwidth; and a server global information base which contains basic information including user information and site information, and is used to determine whether or not a packet is normal, and provides basic information to the conformance determiner and the rate limiter. The apparatus and the method for securing the internet server, that are applied to a main server that provides internet service, by preventing external attacks, intrusion, or vulnerability before the internet server fails, and continuously providing normal internet service through prompt recovery when the internet server fails, in order to guarantee reliable internet service.

Claims

1. An apparatus for securing an internet server, comprising:

a conformance determiner which determines whether or not packets received from a network are normal, and outputs a determination result;

a rate limiter which classifies packets according to predetermined rates, and limits bandwidth; and

a server global information base which contains basic information including user information and site information, and is used to determine whether or not a packet is normal, and provides basic information to the conformance determiner and the rate limiter.

2. The apparatus of claim 1, wherein the conformance determiner comprises:

a basic packet checker which analyzes packets received from the network based on the user information and site information, and outputs analysis information; and

a flow analyzer which passes normal packets, and analyzing a failure cause of abnormal packets, when the internet server fails.

3. The apparatus of claim 2, wherein the flow analyzer is alternatively operated when the internet server fails since the basic packet checker does not deal with a network failure, separates black packets and white packets, and applies packet information to the server global information base.

4. The apparatus of claim 1, wherein the rate limiter comprises:

a classifier which classifies packets according to three rates of normal, suspicious, and abnormal based on the determination result; and

a controller which controls the bandwidth of packets having classified rates.

5. The apparatus of claim 1, wherein the server global information base has detailed user information including black and white lists relating to users'"'"' IP addresses and user variation per time period as the basic information.

6. The apparatus of claim 1, further comprising:

a dynamic platform which dynamically applies a new function and a policy of an external device to the apparatus while the apparatus operates.

7. A method of securing an internet server, comprising:

preparing basic information including user information and site information used to determine whether or not a packet is normal;

receiving packets from a network, and determining whether or not the packets are normal; and

classifying the packets according to rates, and limiting bandwidth according to the rates.

8. The method of claim 7, wherein receiving the packets comprises:

checking whether or not received packets are normal based on the user information and site information; and

passing normal packets, and analyzing a failure cause of abnormal packets when the internet server fails.

9. The method of claim 8, wherein passing the normal packets comprises collecting packets, creating a packet flow, and analyzing the failure cause.

10. The method of claim 7, wherein the packets are classified into three rates of normal, suspicious, and abnormal, and the bandwidth is limited according to the three rates.

11. A computer readable medium having embodied thereon a computer program for executing a method, comprising:

preparing basic information including user information and site information used to determine whether or not a packet is normal;

receiving packets from a network, and determining whether or not the packets are normal; and

classifying the packets according to rates, and limiting bandwidth according to the rates.