Network protection device and method for internal flow control via switch ARP modulation and access lists

1 . A network protection device, comprising:

a communication device;

a storage device configured to store a white list that defines access rights between a plurality of first terminals belonging to a target network; and

a control device configured to modulate an address resolution protocol (ARP) table of each of the plurality of first terminals using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and block the first communication flow or transmit the first communication flow to a destination based on the white list when the first communication flow is received,

wherein the control device is further configured to:

modulate the ARP table of each of the plurality of first terminals using an ARP packet so that a second communication flow transmitted from any one of the plurality of first terminals to an external network is received by the communication device;

store domain name system (DNS) information of a DNS response packet in a DNS table when the DNS response packet is received from the external network; and

block the second communication flow without transmitting the second communication flow to a destination when it is determined that the second communication flow is a communication flow generated without a DNS query by referring to the DNS table, and

wherein the DNS information includes an IP address and a domain address included in the DNS response packet.

2 . The network protection device of claim 1 , wherein:

the control device is further configured to:

generate an ARP response packet including, as a source address information, an IP address of a first terminal in which a media access control (MAC) address is to be modified within the ARP table and the MAC address of the network protection device; and

modulate the ARP table by transmitting the ARP response packet to each of the plurality of first terminals.

3 . The network protection device of claim 2 , wherein:

the control device is further configured to collect address information of each of the plurality of first terminals using an ARP request packet, and

the address information includes an IP address and a MAC address of the corresponding first terminals.

4 . The network protection device of claim 3 , wherein:

the control device is further configured to:

detect an unauthorized terminal among the plurality of first terminals based on the address information; and

modify a MAC address included in an ARP table of the unauthorized terminal into a MAC address with which communication is not possible using an ARP packet to block a communication by the unauthorized terminal.

5 . The network protection device of claim 1 , wherein:

the control device is further configured to:

execute a completely automated public turing test to tell computers and humans apart (CAPTCHA) process in a first terminal which is a source of the first communication flow when the received first communication flow is a communication flow permitted to access by the white list; and

block the received first communication flow or transmit the received first communication flow to a destination according to a CAPTCHA authentication result in the first terminal which is the source.

6 . The network protection device of claim 1 , wherein:

the storage device further stores a black list that defines access rights between the plurality of first terminals and the external network of the target network, and

the control device is further configured to:

block the second communication flow or transmit the second communication flow to the external network based on the black list when the second communication flow is received.

7 . The network protection device of claim 6 , wherein:

the control device is further configured to:

generate an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as source address information, and

modulate a MAC address of the gateway in the ARP table by transmitting the ARP response packet to each of the plurality of first terminals.

8 . The network protection device of claim 1 , wherein:

the control device is further configured to:

store flow information of a communication flow whose source or destination is the plurality of first terminals in a flow table;

determine whether a third communication is a communication flow generated by a request from any one of the plurality of first terminals by referring to the flow table when the third communication flow directed to any one of the plurality of first terminals is received from an external network of the target network; and

transmit the third communication flow to the first terminal as the destination when it is determined that the third communication flow is a communication flow generated by a request from any one of the plurality of first terminals, and

the flow information includes address information of the source and destination of the corresponding communication flow and protocol information.

9 . The network protection device of claim 8 , wherein:

the control device is further configured to:

instruct a second terminal on which an agent is installed to detect an access point (AP) located on a communication path between the network protection device and the second terminal,

instruct the second terminal to collect terminal information of at least one third terminal connected to the AP when the AP is detected in the communication path by the second terminal;

receive address information of the at least one third terminal collected by the second terminal using an ARP packet from the second terminal;

detect an unauthorized terminal among the at least one third terminal based on the address information of the at least one third terminal; and

instruct the second terminal to block the communication of the unauthorized terminal using an ARP packet when the unauthorized terminal is detected.

10 . A method for protecting a network of a network protection device, comprising:

modulating an ARP table of each of a plurality of first terminals belonging to a target network using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the network protection device;

blocking the first communication flow or transmitting the first communication flow to a destination based on a white list defining access rights between the plurality of first terminals when the first communication flow is received;

modulating the ARP table using an ARP packet so that a second communication flow transmitted from any one of the plurality of first terminals to an external network of the target network is received by the network protection device;

whenever a DNS response packet is received from the external network, storing DNS information of the received DNS response packet in a DNS table;

determining whether the second communication flow is a communication flow generated without a DNS query by referring to the DNS table; and

blocking the second communication flow without transmitting the second communication flow to a destination when the second communication flow is a communication flow generated without a DNS query, and

wherein the DNS information includes an IP address and a domain address included in the DNS response packet.

11 . The method of claim 10 , wherein:

the modulating includes:

generating an ARP response packet including, as a source address information, an IP address of a first terminal in which a media access control (MAC) address is to be modified within the ARP table and a MAC address of the network protection device; and

modulating the ARP table by transmitting the ARP response packet to each of the plurality of first terminals.

12 . The method of claim 11 , further comprising:

collecting address information for each of the plurality of first terminals using an ARP request packet,

wherein the address information includes an IP address and a MAC address of the corresponding first terminal.

13 . The method of claim 12 , further comprising:

detecting an unauthorized terminal among the plurality of first terminals based on the address information; and

modifying a MAC address included in an ARP table of the unauthorized terminal into a MAC address with which communication is not possible using an ARP packet to block a communication by the unauthorized terminal.

14 . The method of claim 10 , further comprising:

executing a CAPTCHA process in a first terminal that is a source of the first communication flow; and

receiving a CAPTCHA authentication result from the first terminal that is the source,

wherein the blocking of the first communication flow or the transmitting of the first communication flow to the destination includes blocking the first communication flow or transmitting the first communication flow to a destination based on the CAPTCHA authentication result and the white list.

15 . The method of claim 10 , further comprising:

blocking the second communication flow or transmitting the second communication flow to the external network by referring to a black list defining access rights between the plurality of first terminals and the external network when the second communication flow is received.

16 . The method of claim 15 , wherein:

the modulating of the ARP table so that the second communication flow is received by the network protection device includes:

generating an ARP response packet including an IP address of a gateway connected between the plurality of first terminals and the external network and a MAC address of the network protection device as source address information; and

modulating a MAC address of the gateway in the ARP table by transmitting the ARP response packet to each of the plurality of first terminals.

17 . The method of claim 10 , further comprising:

whenever the communication flow is generated with the plurality of first terminals as the source or destination, storing flow information of the generated communication flow in a flow table;

receiving a third communication flow from the external network of the target network to any one of the plurality of first terminals; and

transmitting the third communication flow to a first terminal as the destination when it is determined by referring to the flow table that the third communication flow is a communication flow generated by a request from any one of the plurality of first terminals,

wherein the flow information includes address information of the source and destination of the corresponding communication flow and protocol information.