CONTROL SYSTEM AND PROTECTION METHOD FOR INTEGRATED INFORMATION SECURITY SERVICES

• US 20100122345A1
• Filed: 03/19/2009
• Published: 05/13/2010
• Est. Priority Date: 11/07/2008
• Status: Active Grant

• Current Assignee: Chunghwa Telecom Co., Ltd.
• Original Assignee: Chunghwa Telecom Co., Ltd.
• Inventors: Du, Bing-Hung, Yu, Feng-Peng, Yao, Jen-Hao, Wu, I-Fang, Lee, Wei
• Granted Patent: US 8,621,612 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A control system and protection method for integrated information security services are provided, which include protecting data packets of a user end device by a protecting device; generating an event log according to the protection result and transmitting the recorded event log to a collective control platform for standardizing and analyzing association by the collective control platform; detecting and transmitting abnormal information by the collective control platform to a service platform for integrating the information with network status information; displaying the integrated information on a webpage interface and transmitting the same to the user end device, thereby providing direct information on network security to save the high costs of purchasing, configuring and maintaining an information security protection system by the user.

Claims

1. A control system for integrated information security services, comprising:

a user end device;

a routing device for providing connection routing paths for the user end device;

a protecting device for performing an information security service on data packets from the routing device and generating an event log based on results of the information security service;

a collective monitoring platform for extracting and collecting the event log, and performing association analysis on the event log to detect abnormal information; and

a service platform for extracting the abnormal information and network status information,

wherein the service platform displays the abnormal information and the network status information on a webpage interface, and sends the abnormal information and the network status information to the user end device.

2. The control system of claim 1, further comprising a network status detecting device for detecting user network status of the routing device and generating the network status information, wherein the service platform displays the network status information on the webpage interface and sends the network status information to the user end device.

3. The control system of claim 1, wherein the routing device directs data packets of the user end device to a specific routing path based on a profile of the corresponding user end device, and the protecting device performs the information security service on the received data packets.

4. The control system of claim 1, wherein the routing device mirrors the data packets of the user end device to the protecting device, which performs the information security service for the data packets.

5. The control system of claim 1, wherein the protecting device receives or transmits the data packets on behalf of the user end device.

6. The control system of claim 1, wherein the collective monitoring platform further comprises:

an event collecting device for collecting the event log and standardizing the event log;

an event analyzing device for making the association analysis on the standardized event log, and providing functionalities for system functions setup, user setup, association analysis rules setup and interfacing with a maintenance platform;

an event storage device for storing the event log and result of the association analysis; and

an event processing device for forming a list of events based on the association analysis and sorting the events into levels.

7. The control system of claim 6, wherein the event analyzing device makes association analysis on the event log based on predetermined analysis rules.

8. The control system of claim 6, wherein the event processing device sends an informing message to the maintenance platform for carrying out maintenance operations when a specific event occurs.

9. The control system of claim 6, wherein the event processing device is capable of managing procedures of information security events.

10. The control system of claim 1, wherein the service platform further comprises:

a management device for managing information of the user end device;

an informing device for sending the abnormal information to the user end device; and

a webpage device for displaying the abnormal information on the webpage interface.

11. The control system of claim 10, wherein the informing device informs the user end device by electronic mails or Short Message Service (SMS) messages.

12. The control system of claim 1, further comprising a provision platform that provides user information to the collective monitoring platform and the service platform.

13. The control system of claim 1, wherein the user end device is connected to the service platform through at least one of a Wide Area Network (WAN), a Virtual Private Network (VPN), a Local Area Network (LAN) and a wireless network.

14. The control system of claim 1, wherein the user end device is one selected from the group consisting of a workstation, desktop computer, a laptop computer, a digital television, a Personal Digital Assistant (PDA), and a mobile phone.

15. The control system of claim 1, wherein the protecting device provides functions of virus scanning, cleaning, malicious packets/connection blocking, invasion denial, invasion detection, content screening, webpage threat protection and or virus protection.

16. A protection method for integrated information security services, comprising the following steps:

(1) allowing a protecting device for performing a information security service on data packets of a user end device and generating an event log based on results of the information security service;

(2) allowing a collective monitoring platform to standardize the event log, and to perform association analysis on the event log;

(3) allowing the collective monitoring platform to detect abnormal information and to send the abnormal information to a service platform; and

(4) allowing the service platform to display the abnormal information and network status information on a webpage interface, and sends the abnormal information and the network status information to the user end device.

17. The protection method of claim 16, wherein the step (1) further comprises the following steps:

allowing the user end device to be connected to a routing device; and

allowing the routing device to direct the data packets of the user end device to the protecting device based on a profile of the corresponding user end device.

18. The protection method of claim 16, wherein the step (1) further comprises the following steps:

allowing the user end device to be connected to a routing device; and

allowing the routing device to mirror the data packets corresponding to the user end device to the protecting device.

19. The protection method of claim 16, wherein the step (1) further comprises the following steps:

allowing the user end device to be connected to a routing device; and

allowing the routing device to connect the protecting device, so as for the protecting device to perform data packet transmission on behalf of the user end device.

20. The protection method of claim 16, wherein the step (2) further comprises the following steps:

(2-1) allowing an event collecting device to collect and standardize the event log; and

(2-2) allowing an event analyzing device to make the association analysis on the event log.

21. The protection method of claim 20, further comprising the following steps:

(2-3) allowing an event storage device to store the event log and result of the association analysis; and

(2-4) allowing an event processing device to make a list of events based on the association analysis, classify the events into levels, and send informing messages to a maintenance platform when a specific event occurs.

22. The protection method of claim 16, where the step (4) further comprises the following steps:

(4-1) allowing an alarming device to obtain the network status information provided by a network status detecting device;

(4-2) allowing the alarming device to send the network status information and the abnormal information to a webpage device, so as to display the network status information and the abnormal information on the webpage interface;

(4-3) allowing the alarming device to obtain information of the user end device from a management device and carry out comparison; and

(4-4) allowing the alarming device to send the network status information and the abnormal information to the user end device.

23. The protection method of claim 16, wherein the user end device is one selected from the group consisting of a workstation, desktop computer, a laptop computer, a digital television, a Personal Digital Assistant (PDA), and a mobile phone.

24. The protection method of claim 16, wherein the user end device is connected to the service platform through at least one of a Wide Area Network (WAN), a Virtual Private Network (VPN), a Local Area Network (LAN) and a wireless network.

25. The protection method of claim 16, wherein the protecting device provides functions of scanning and cleaning virus, malicious packet/connection blocking, invasion denial, invasion detection, content screening, webpage threat protection and/or virus protection.