SYSTEM AND METHOD FOR CONTROLLING VIRTUAL NETWORK INCLUDING SECURITY FUNCTION

• US 20150304344A1
• Filed: 04/28/2014
• Published: 10/22/2015
• Est. Priority Date: 04/22/2014
• Status: Active Grant

• Current Assignee: Korea Internet & Security Agency
• Original Assignee: Korea Internet & Security Agency
• Inventors: SHIN, Youngsang, LEE, Seulgi, HWANG, Tongwook, PARK, Haeryong
• Granted Patent: US 9,166,988 B1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/342 between virtual entities, e.g. orchestrators, SDN or NFV entities
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Disclosed therein are system and method for controlling a virtual network with a security function which can manage security states of virtual machines in a cloud datacenter, analyze security states of malicious virtual machines, and isolate and treat the malicious virtual machines in order to cope with intrusion of a virtual network under a cloud computing environment. The virtual network controlling system and method reduce the number of packets to which the IPS carries out a signature matching inspection through a DPI test by diffusing blocking against the previously detected intruder by the network level, so as to enhance performance of the virtualized network IPS.

Claims

1. (canceled)

2. (canceled)

3. (canceled)

4. A method for controlling a virtual network with a security function comprising the steps of:

receiving an attack detection-related security alert (expressed in a common event format) from vIPSs in a virtual network controlling system including a cloud ESM (Enterprise Security Management) system;

analyzing traffic or an attack pattern detected in the vIPS through a correlation analysis by the cloud ESM system when the attack detection-related security alert is received;

determining a real time blocking reaction against the detected traffic or attack in the cloud ESM system on the basis of the analyzed results and sending the blocking reaction command to the vIPS;

creating real time blocking rules by the vIPS according to the blocking reaction command;

sending the real time blocking rules to the vSwitch and blocking the intruder'"'"'s attacking traffic by the vSwitch according to the received blocking rules;

checking whether or traffic blocking was actually carried out during a blocking time when the blocking time is lapsed according to the blocking rules;

deleting the created blocking rules and terminating the corresponding traffic blocking by the vIPS if the traffic blocking was not carried out actually during the blocking time; and

extending the blocking time based on the present state to which the blocking rules were applied and terminating blocking of the corresponding traffic by the vIPS if the traffic blocking was carried out actually during the blocking time,

wherein the cloud ESM system comprises;

a cloud collection information management module which stores and manages virtualization resource information and security events collected in the vIPS;

a cloud security event analysis and security state monitoring module which carries out attack correlation analysis in reference to information received from the vIPS; and

a cloud security control management module which forcedly migrates the malicious virtual machine in a logical/physical manner, recognizes a change in information of the virtual machine and sends a security control command according to a policy change to the vIPS through a cloud agent.

6. The virtual network controlling method according to claim 4, wherein the vIPS comprises:

an intrusion response processing module which request creation of the real time blocking rules according to the blocking reaction command;

a policy and signature management module which manages creation, update and deletion of the real time blocking rules;

an external interface module which provides an interface to send and receive policies of the real time blocking rules; and

a hypervisor security API module which sets up or deletes the blocking rules on the vSwitch.

7. The virtual network controlling method according to claim 4, wherein the vIPS sends the created real time blocking rules to an SDN controller so as to expand security of the virtual network system to an SDN network.

5. (canceled)