WO2013094847A1

WO2013094847A1 - Apparatus and method for a web firewall service in a cloud system

Info

Publication number: WO2013094847A1
Application number: PCT/KR2012/007147
Authority: WO
Inventors: 김진봉
Original assignee: (주)케이티
Priority date: 2011-12-23
Filing date: 2012-09-06
Publication date: 2013-06-27
Also published as: KR20130093714A; KR101342592B1

Abstract

The present invention relates to an apparatus and method for providing a virtualized-type web firewall service in a cloud system by creating a virtual machine (VM) to provide the VM to a subscriber who applies for the web firewall service.

Description

Apparatus and method for web firewall service in cloud system

The present invention relates to an apparatus and a method for a web firewall service in a cloud system, and more particularly, to an apparatus and a method for configuring a web firewall as a virtual machine (VM) in a cloud system to serve.

Modern society is an information society. The leading figure in this information society is the Internet.

As a lot of information is provided through the web and the Internet, anyone can access various information easily and conveniently. Wherever you are connected to the Internet, you can buy a variety of things you need to live with just a few clicks, or check your friends and acquaintances through messenger, cyworld, and blogs.

I live in an age when Internet banking is more familiar than going to a bank.

The Web is constantly evolving and creating new changes, providing us with a variety of conveniences and usefulness.

However, various information security related accidents lurk behind these conveniences.

Recently, a large amount of personal information leakage cases, personal website hacking cases, and financial banking hacking incidents in Korea have caused direct financial damage beyond the leakage of information from individuals, companies, and public institutions. Was done.

* Information security-related infringement incidents of companies are more important than ever, not only adversely affecting corporate image due to lowered credibility of the company, but also leading to class action lawsuits and ending the crisis of corporate existence.

Companies operating web sites should provide services to users safely.

To do this, it is important to build a secure web service. To build a secure web service, it is designed from the design stage with security in mind. In the development stage, continuous development source verification is required using source verification tools. When the service development is completed, the service vulnerability should be checked and corrected through consulting with a security expert before opening.

However, most companies have a hard time finding a secure Web site from scratch and developing it from scratch. In this case, the Web Application Firewall is used to protect the website and provide safe services to customers.

Web applications are always in our lives, and the homepages and most services we use through the Internet are Web applications.

1 shows a typical website structure.

Most of the web attack is to attack the web server (120) or exploit the contents of the DB (130) by using vulnerabilities generated when building a web application.

An attacker inserts a code that bypasses a specific attack code or a vulnerability that only a specific web application has in the HTTP request and sends it to the web server.

Eventually, the web application will behave unintentionally, and the result is to send various information to the attacker via HTTP reply.

It inspects all HTTP request packets transmitted from the web firewall toward the web server 120 and prevents unintended contents from being transmitted to the web application. Also, it monitors the contents of HTTP Reply Packet passing through Web Server and prevents the leakage of specific information.

Web firewalls filter web protocols from the outside to establish web application vulnerability and response processes against web hacking attacks. Unlike existing security solutions, web firewalls perform analysis and blocking at the application level instead of the network layer.

FIG. 2 is a diagram illustrating a relay concept of a conventional proxy server.

The principle of a web firewall is to inspect and block the contents of packets by applying the proxy principle to all packets entering and leaving a web server.

Proxy is a service technology used to access a proxy server from a web browser. When a proxy is specified in the web browser, the URL requested from the web client is not connected to the server, but is connected to the proxy server 220. do.

The proxy server 220 receiving the proxy request sends a request by connecting to the corresponding server of the URL, receives a response instead of the client, and delivers the request to the client 210.

An embodiment of the present invention is directed to an apparatus and method for providing a web firewall service in a virtual form in a cloud system by creating and providing a virtual machine (VM) to a subscriber who has applied for a web firewall service.

Web firewall service device in a cloud system according to an embodiment of the present invention for achieving the above technical problem, by receiving a packet to a predetermined public IP (Public IP) for each of the first Private (IP) IP and subscriber A virtual router for transmitting the packet to the assigned first port; Blocking or checking the packet forwarded to the assigned first private IP and the first port, and a second port corresponding to a second private IP and the first port A virtual web proxy server for transmitting the packet to the server; And a web server configured to receive the second private IP and the packet forwarded to the second port and provide a web service.

Preferably, the virtual router and the virtual web proxy server are characterized in that a virtual machine (VM) in a cloud system.

Preferably, the information of the first private IP and the first port of the virtual web proxy server is allocated by the virtual router.

Preferably, the virtual web proxy server and the web server are configured in plural, each virtual web proxy server having a different first private IP, and each web server having a different second private ( Private) characterized in that the IP (IP) is assigned.

Preferably, the virtual web proxy server and a cloud stack (API) interworking with an API (application programming interface) (API); further comprising, the virtual web proxy server is an api including service information requested by the subscriber (API) is received from the cloud stack (Cloud stack) characterized in that the configuration of the configuration and the allocation bandwidth of the virtual web proxy server automatically.

Preferably, the first private IP and the second private IP are floating IPs.

Preferably, the apparatus further comprises a load balancer configured to distribute the load of the packet in proportion to the number of the virtual web proxy server and the web server.

Web firewall service method in a cloud system according to an embodiment of the present invention for achieving the above technical problem, in a web firewall service method comprising a plurality of web servers, creating a first virtual machine (VM) Generating a virtual router by allocating a public IP to the first virtual machine; A virtual web proxy server is created by creating a second virtual machine (VM) and assigning different first ports for each first private IP and subscriber to the second virtual machine. Creating a virtual web proxy server; Transmitting a packet received by the virtual router to the first private IP and the first port, and forwarding the packet to the virtual web proxy server; A packet inspecting step of blocking or inspecting the packet at the virtual web proxy server; And a web server mapping step of forwarding the packet based on a second private IP and a second port assigned to each web server. Characterized in that it comprises a.

Preferably, the virtual web proxy server includes a plurality of virtual web proxy servers, each virtual web proxy server having a different first private IP, and each web server having a different second private IP ( IP) is assigned.

Preferably, the virtual web proxy server and a cloud stack (API) linked to the API (API: application programming interface); further comprising, the virtual web proxy server is an AP including service information requested by the subscriber (API) is received from the cloud stack (Cloud stack) characterized in that the configuration of the configuration and the allocation bandwidth of the virtual web proxy server automatically.

Preferably, the first private IP and the second private IP are floating IPs.

Preferably, a load balancing step of distributing the load of the packet in proportion to the number of the virtual web proxy server and the web server by a load balancer;

Preferably, the virtual web proxy server, the web server and the load balancer are configured in a redundant structure.

According to an apparatus and method for a web firewall service in a cloud system according to the present invention, a service such as a single (dual, dual) and bandwidth (Basic, Standard, Advanced, Preminum) of a web firewall that a subscriber has applied for through a cloud portal is used as an API type. It is possible to set automatically by calling.

According to the apparatus and method for a web firewall service in a cloud system according to the present invention, a web firewall, a web server, and a load balancer are configured in a redundant manner to provide a stable service.

1 shows a typical website structure.

3 is a diagram showing the configuration of a web firewall service apparatus in the cloud system of the present invention.

4 is a diagram illustrating a cloud network configuration including a web firewall service apparatus of the present invention.

5 is a flowchart illustrating a web firewall service method in a cloud system of the present invention.

Web firewall service apparatus in a cloud system according to an embodiment of the present invention, by receiving a packet to a predetermined public IP (Public IP) to the first private (IP) and the first port assigned to each subscriber to the first port (IP) A virtual router for transmitting a packet; Blocking or checking the packet forwarded to the assigned first private IP and the first port, and a second port corresponding to a second private IP and the first port A virtual web proxy server for transmitting the packet to the server; And a web server configured to receive the second private IP and the packet forwarded to the second port and provide a web service.

DETAILED DESCRIPTION In order to fully understand the present invention, the operational advantages of the present invention, and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents described in the drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

The web firewall service apparatus of the present invention relates to an apparatus and method for providing a web firewall service in a virtual form in a cloud system by creating and providing a virtual machine (VM) to a subscriber who has applied for a web firewall service.

According to an apparatus and method for a web firewall service in a cloud system according to the present invention, a service such as a single (dual, dual) and bandwidth (Basic, Standard, Advanced, Preminum) of a web firewall that a subscriber has applied for through a cloud portal is used as an API type. It can be set automatically by calling.

Web firewall service apparatus and method of the present invention is that the web firewall provided in the existing HW appliance products are virtualized and provided to the subscriber in the form of a virtual machine (VM).

Apparatus and method 300 for providing a web firewall service of the present invention includes a virtual router 310, a virtual web proxy server 320, and a web server 330.

The virtual router and the virtual web proxy server are composed of virtual machines (VMs) in a cloud system.

The virtual web proxy server 320 inspects and blocks the contents of the packet by applying a proxy principle to all packets entering and leaving the web server 330 as a web application firewall.

The URL requested by the web client is not directly connected to the web server 330, but is connected to the virtual web proxy server 320.

The virtual web proxy server 320 receiving the proxy request sends a request by connecting to the corresponding web server of the URL, and receives and returns a response on behalf of the client.

The virtual router 310 receives a predetermined public IP and receives a packet through the public IP, and the virtual router 310 acts as a Dynamic Host Configuration Protocol (DHCP) server to provide a virtual web proxy server 320. It assigns floating private IP to.

In addition, the virtual router 310 performs a port forwarding of the received packet to the assigned port by assigning a separate port for each subscriber.

The virtual web proxy server 320 blocks or inspects a packet forwarded to a private IP and a port allocated by the virtual router 310.

In addition, the virtual web proxy server 320 serves to deliver the packet received to the private IP (IP) and port assigned to the web server 320.

That is, the virtual web proxy server 320 maps its private IP and port information to the private IP and port of the web server 330 and transmits it. will be.

However, since the firewall function is executed at the same time, it blocks the packet to be transmitted to the other port or blocks the packet detected by the virus.

The web server 330 receives a port forwarded packet to its own private IP and port to provide a web service.

However, when the web service is provided, the response is not immediately performed by the client, but the client forwards the response through the virtual web proxy server 320.

The floating private IP and port of the virtual web proxy server 320 are allocated by the virtual router.

The virtual web proxy server 320, which is a virtual machine (VM), is interworked with a cloud stack and an application programming interface (API).

The virtual web proxy server 320 automatically receives an API (API) including service information requested by the subscriber from the cloud stack and automatically configures the configuration and allocation bandwidth of the virtual web proxy server.

The virtual web proxy server 320, which is a web application firewall, may be configured in a single or dual form, and bandwidth may also provide services in various forms such as basic, standard, advanced, and preminum.

The virtual web proxy server 320 and the web server 330 may include a plurality of load balancers for distributing the load of packets in proportion to the number of the configured virtual web proxy server 320 and the web server 330 ( Not shown) may be further included.

The virtual web proxy server 450 is configured as a virtual machine (VM) that executes a web firewall.

Subscribers can apply for web application firewall services in the form of single or dual through the ucloud portal, or apply for bandwidth in various forms such as basic, standard, advanced, and preminum.

In the virtual web proxy server 450, a virtual router 440, which is a system server, acts as a DHCP server and a virtual web proxy server 450 acts as a client. Allocate Private IP).

Private port for the private IP (Private IP) for the use of the management tool (WEB GUI) to set the detailed environment of the individual web firewall virtual machine of the virtual web proxy server 450 is configured for each subscriber.

Configure 5000 ports for Web Firewall (WAF) API, 5433 Port for using PostgreSQL (Open Source Database), and 22 Port for SSH access.

The virtual web proxy server 450 starts Apache to receive a configuration set by a customer in a virtual machine (VM), which is an individual web firewall (WAF), in the form of an API.

License key from central key management server is set and used for automatic online update function.

The subscriber's ucloud portal calls basic, standard, advanced, and preminum product information in the form of API to process the service level functions in the web firewall (waf) virtual machine (VM).

The web firewall (WAF) virtual machine (VM), which is the virtual web proxy server 450, is a CentOS-based VM, and the root area is 20G and the data area is 380G.

In the proxy server, the additional data area is used to manage the logs that WAF inspects and detects packets. In the past, engineers must configure the partitions for storage in the data area and mount them for use by PostgreSQL DB. There was a problem that was difficult for the customer to set up.

Therefore, in the present invention, in order to automate this in the virtual web proxy server 450, an automatic configuration script is created in the WAF VM template, and the parameters are received from the portal and the automatic configuration script is executed.

The script first checks if there is any unallocated storage in the VM, and if there is any unallocated storage, it performs partition creation, mount, and DB configuration.

In addition, if the partition creation, mounting, and DB configuration have already been set, this operation will not be performed.

The web firewall (WAF) virtual machine (VM), which is the virtual web proxy service 450, is kept in a state capable of receiving an API through the 5000 port.

Portal can configure service for WAF through API.

Existing web firewall is usually configured to check the inbound packet in the inline method in the network section and outbound to the corresponding web server, but in the present invention, the Layer 2 network (virtual network) method provided in the cloud is a virtual router. There is a virtual machine (VM) system G / W (440), and the public IP (Public IP) is assigned after the service by dividing the port (Port) for each subscriber.

A web firewall (WAF) virtual machine (VM), which is a virtual web proxy server 450, is located at the customer's virtual router 440 and web server 460, and inspects port forwarded packets and sends them back to the web server 460. It works in a proxy manner.

The proxy method of the virtual web proxy server 450 transmits the received private IP: port information to a private IP: port of the web server 460. .

The virtual web proxy server 450 is automatically configured through API calls, and registers proxy processing for web firewall (WAF) servers, URL and IP registration for web firewall (WAF) servers, and web firewall (WAF). ) Defining detection level, automatic storage allocation, license key registration.

Portal system and cloud stack (Cloudstack) (430) manages all the IP and port information of the customer account VM can be configured by mapping with simple information, even if the customer does not have a complex configuration.

The cloud stack 430 performs automatic configuration through API call, and creates a web firewall (WAF) server, a service port forwarding process, a WAF management tool, a DB port, and an SSH port forwarding process.

Port information of a web firewall (WAF) virtual machine (VM) and a web server (Web server) 460 may be exposed, and the information may be received and configured by an API of the WAF VM.

It is automatically configured through API on Web Firewall (WAF) virtual machine (VM) by receiving customer's URL or IP registration of actual serviced web site and security rule verification level for the site.

Proxy configuration and URI registration can be configured by accessing the WAF administration tool.

The load balancer 420 is a VPX is composed of a commercial SW Load Balancer of Citrix.

The load balancer 420 handles automatic configuration and port load balancing through a VPX Load Balancer API (API) call.

The load balancer 420 processes load balancing in proportion to the number of web firewall virtual machines and web servers to enable load balancing for large packets.

In addition, the load balancer 420 may process the virtual router 440 (Roter VM) and the virtual web proxy server 450 through the TCP session reuse function.

The load balancer 420 and the VPX have an API, which configures the VPX for customer service and distributes ports for load balancing.

In addition, port forwarding is possible from the virtual router (Router VM) to the virtual web proxy server (WAF VM) through the ports distributed by the load balancer 420, which is an API in the cloud stack 430. Call to configure automatically.

Web firewall service apparatus of the present invention can be a redundant configuration.

Rack where web proxy server (WAF VM) is created consists of redundant 10G Service, Storage Switch and 1G Network Switch.

Compute Node, where the virtual machine (VM) is created, is redundant in power, and even if the node itself fails, it is automatically migrated to other nodes in the cluster (8 nodes) to enable continuous service.

Disk is also mirrored so that service is not affected even in the event of a disk failure.

The load balancer 420 (VPX) is also redundantly configured in two nodes, and the VPX periodically sends a tcp packet to the web server to determine whether it is a normal service or not.

By using this, the web firewall (WAF) is configured as a duplication of Active and Active, and the web server 460 is configured in plural numbers under the virtual web proxy server (WAF) 450 which is a web firewall.

The number of load balancing ports in the VPX 420, which is the load balancer, is divided by the number of virtual web proxy servers X web servers 460 which are web firewalls (WAFs).

When the web server 460 configures the virtual web proxy server 450, which is a web firewall (WAF), to send packets forwarded to the proxy by different web firewalls (WAF), one web firewall (WAF) is abnormal. By performing the operation, it is possible for the rest of the web firewall (WAF) to utilize the resources of the entire web server 460 while processing the packet.

In addition, even if one web server performs abnormal operation, it is possible to configure active and active redundancy without affecting the processing of the entire web firewall (WAF) and the remaining web servers.

Web firewall service method in the cloud system of the present invention comprises a plurality of web servers.

A virtual machine (VM) is created in the cloud system, and a public router (IP) is assigned to the generated virtual machine (VM) to generate a virtual router (Suter).

Create a virtual machine (VM) for the web firewall, and create a virtual proxy server by allocating different ports for each first private IP and subscriber to the created virtual machine (VM). (S520).

Port forwarding the packet received from the virtual router to the virtual private IP (IP) and the assigned port is transmitted to the virtual web proxy server (S530).

The packet is inspected through the proxy principle of blocking or inspecting the packet in the virtual web proxy server (S540).

The packet is port forwarded based on a private IP and a port allocated to each web server (S550).

The information of the private IP and the port of the virtual web proxy server is allocated by the virtual router (Router VM).

It further includes a cloud stack (API) linked to the virtual web proxy server and API (API: application programming interface); The virtual web proxy server includes a cloud stack API (Api) including the service information requested by the subscriber Receives from (Cloud stack) and automatically configures the configuration and allocation bandwidth of the virtual web proxy server.

The private IP assigned to the virtual web proxy server assigned in the router VM and the private IP assigned to the web server are floating IPs.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims

A virtual router receiving the packet through a predetermined public IP and transmitting the packet to a first private IP and a first port allocated to each subscriber;

Blocking or checking the packet forwarded to the assigned first private IP and the first port, and a second port corresponding to a second private IP and the first port A virtual web proxy server for transmitting the packet to the server; And

And a web server configured to provide the web service by receiving the second private IP and the packet port forwarded to the second port.
The method of claim 1, wherein the virtual router and the virtual web proxy server

Web firewall service device in the cloud system, characterized in that the virtual machine (VM) in the cloud system.
3. The method of claim 2, wherein the virtual web proxy server

The first private IP and the information of the first port is assigned by the virtual router, the web firewall service device in the cloud system.
The method of claim 1,

The virtual web proxy server and the web server are configured in plural, each virtual web proxy server having different first private IPs, and each web server having different second private IPs. Web firewall service device in the cloud system, characterized in that the (IP) is assigned.
The method of claim 4, wherein

And a cloud stack interworking with the virtual web proxy server and API (application programming interface).

The virtual web proxy server receives an API including the service information requested by the subscriber from the cloud stack and automatically configures the configuration and allocated bandwidth of the virtual web proxy server. Web firewall service device in the cloud system.
The method of claim 4, wherein

The first private IP (IP), the second private IP (IP) is a web firewall service device in the cloud system, characterized in that the floating IP (IP).
The method of claim 4, wherein

And a load balancer for distributing the load of the packet in proportion to the number of the virtual web proxy server and the web server.
In the web firewall service method comprising a plurality of web servers,

A virtual router creation step of generating a virtual router by creating a first virtual machine and allocating a public IP to the first virtual machine;

A virtual web proxy server is created by creating a second virtual machine (VM) and assigning different first ports for each first private IP and subscriber to the second virtual machine. Creating a virtual web proxy server;

Transmitting a packet received by the virtual router to the first private IP and the first port, and forwarding the packet to the virtual web proxy server;

A packet inspecting step of blocking or inspecting the packet at the virtual web proxy server; And

A web server mapping step of port forwarding the packet based on a second private IP and a second port assigned to each web server; Web firewall service method in the cloud system comprising a.
9. The method of claim 8, wherein the virtual web proxy server

The information of the first private IP and the first port is allocated by the virtual router.
The method of claim 8,

The virtual web proxy server includes a plurality of virtual web proxy servers, each virtual web proxy server having a different first private IP, and each web server having a different second private IP. Web firewall service method in the cloud system, characterized in that the assignment.
The method of claim 10,

And a cloud stack interworking with the virtual web proxy server and API (application programming interface).

The virtual web proxy server receives an API including the service information requested by the subscriber from the cloud stack and automatically configures the configuration and allocated bandwidth of the virtual web proxy server. Web firewall service method in cloud system.
The method of claim 10,

The first private IP (IP), the second private IP (IP) is a web firewall service method in the cloud system, characterized in that the floating IP (IP).
The method of claim 10,

And a load balancing step of distributing the load of the packet in proportion to the number of the virtual web proxy server and the web server by a load balancer.
The method of claim 13,

The web firewall service method in the cloud system, characterized in that the virtual web proxy server, the web server and the load balancer configured in a redundant structure.