System for controlling network access of terminal based on tunnel and method thereof

1. A node comprising:

a communication circuit;

a processor operatively connected to the communication circuit; and

a memory operatively connected to the processor and storing a target application and an access control application,

wherein the memory stores instructions that when executed by the processor, cause the node to:

detect, through the access control application, a network access event of the target application to a destination network,

identify, through the access control application, whether a tunnel exists between the node and a gateway,

identify, through the access control application, whether the target application is accessible to the destination network, based on data flow information received from an external server, wherein the data flow information is based on the target application and the destination network,

in response to determining that the tunnel exists and the target application is accessible to the destination network, transmit, through the access control application, a data packet of the target application via the tunnel, and

in response to determining that the tunnel does not exist or the target application is not accessible to the destination network, drop, through the access control application, the data packet of the target application.

2. The node according to claim 1 , wherein the instructions cause the node to:

before detecting the network access event, request, through the access control application, controller access to the external server,

receive, from the external server, a first response comprising control flow information corresponding to the access control application and the external server.

3. The node according to claim 1 , wherein the instructions cause the node to:

in response to detecting the network access event, request, through the access control application, network access to the external server,

receive, from the external server, a second response comprising the data flow information.

4. The node according to claim 3 , wherein the instructions cause the node to:

before requesting the network access, perform, through the access control application, a validity check of the target application based on an access policy database received from the external server, and

drop the data packet of the target application, when the validity check of the target application fails.

5. The node according to claim 3 , wherein the data flow information further comprises information for generating the tunnel, and

wherein the instructions cause the node to:

in response to determining that the tunnel does not exist, generate the tunnel with the gateway based on the data flow information, and

when generating the tunnel is completed, transmit the data packet of the target application via the tunnel.

6. The node according to claim 1 , further comprising a display, and

wherein the instructions cause the node to:

output a screen provided from the destination network through the display when the data packet is transmitted, and

output a user interface screen indicating that access to the destination network is not allowed through the display when the data packet is dropped.

7. The node according to claim 1 , wherein the instructions cause the node to:

receive a user input requesting user authentication,

request user authentication to the external server, the user authentication request including information corresponding to the user input,

receive, from the external server, a third response indicating whether the user authentication is completed or not.

8. A method of a node in which a target application and an access control application are installed, comprising:

detecting, by the access control application, a network access event of the target application to a destination network;

identifying, by the access control application, whether a tunnel exists between the node and a gateway;

identifying, through the access control application, whether the target application is accessible to the destination network, based on data flow information received from an external server, wherein the data flow information is based on the target application and the destination network;

in response to determining that the tunnel exists and the target application is accessible to the destination network, transmitting, by the access control application, a data packet of the target application via the tunnel; and

in response to determining that the tunnel does not exist or the target application is not accessible to the destination network, dropping, by the access control application, the data packet of the target application.

9. A method of a sever comprising:

receiving, from an access control application of a node, a network access request of a target application of the node to a destination network;

identifying whether the target application is accessible to the destination network based on identification information of the target application and address information of the destination network; and

in response to determining that the target application is accessible to the destination network, transmitting data flow information which is based on the target application and the address information of the destination network.

10. A method of a gateway comprising:

receiving, from an external server, information required to generate a tunnel, wherein the information is based on a target application and a destination network;

generating the tunnel between the gateway and a node which stores the target application based on the information;

receiving a data packet;

identifying whether the received data packet is received through the tunnel;

in response to determining that the data packet is received through the tunnel, forwarding the data packet to the destination network; and

in response to determining that the data packet is not received through the tunnel, dropping the data packet.