Granted Patent B2

US 12,381,890 · App. 17/656,136 · Granted Aug 5, 2025

Inventors: Young Rang Kim (Seoul, KR); Pil Ho Song (Seoul, KR); Hyun Seok Woo (Seoul, KR)

Assignee: PRIBIT Technology, Inc.

H04L63/1416H04L63/1425H04L63/145H04L63/20

Abstract

Claims (58)

1. A system, comprising:

a terminal;

a gateway located on a boundary of a network to which the terminal belongs, wherein the gateway is different from the terminal; and

a server configured to manage data transmission between the terminal and the gateway,

wherein the server generates control flow between the terminal and the server,

wherein when the server receives a controller access request from the terminal, the server transmits identification information of the control flow and a threat detection policy stored in a database of the server to the terminal, receives a controller access update request including threat detection information indicating a result of executing a threat detection function loaded into the terminal based on the threat detection policy from the terminal, and releases the control flow based on the threat detection policy, when threat detection is identified from the threat detection information,

wherein the server receives a network access request including the identification information of the control flow and the threat detection information from the terminal, determines whether network access of the terminal is possible based on the identification information of the control flow, and releases the control flow depending on the threat detection policy and transmits information indicating network access failure to the terminal, when the threat detection is identified from the threat detection information,

wherein the threat detection function is configured to detect a direct threat applied to a minimized attack surface for access to a destination network.

2. The system of claim 1 , wherein the server determines that the network access of the terminal is possible based on an access policy stored in the database and transmits information for generating a tunnel and data flow between the terminal and the gateway to the terminal and the gateway.

3. The system of claim 1 , wherein the gateway detects a threat using a threat detection function loaded into the gateway, when receiving a data packet from the terminal, drops the data packet, when the threat is detected, and stores a threat detection log including a time when the threat is detected, identification information of a terminal, the threat of which is detected, and a type of the threat, and transmits the stored threat detection log to the server on a periodic basis.

4. The system of claim 3 , wherein the gateway routes the data packet to the destination network, when the threat is not detected and the data packet is valid.

5. The system of claim 3 , wherein the server analyzes the threat detection log to identify a terminal, the threat of which is detected, and performs an access release procedure of the terminal, the threat of which is detected.

6. The system of claim 1 , wherein the terminal transmits the threat detection information to the server on a periodic basis.

7. The system of claim 1 , further comprising:

a security system configured to detect a terminal threat and a network threat using a threat detection technique and transmit information about the detected threats and identification information of a terminal, the threat of which is detected, to the server.

8. A server, comprising:

a communication circuitry;

a memory storing a database; and

a processor operatively connected with the communication circuitry and the memory,

wherein the processor manages data transmission between a terminal and a gateway located on a boundary of a network to which the terminal belongs,

wherein the gateway is different from the terminal, and

wherein the processor receives an access request requesting controller access to the server from the terminal, determines whether access of the terminal is possible, based on identification information included in the access request and the database, generates identification information of control flow between the server and terminal, when the access of the terminal is possible, transmits a response including the identification information of the control flow and a threat detection policy included in the database to the terminal, using the communication circuitry, receives a controller access update request including the identification information of the control flow and threat detection information indicating a result of executing a threat detection function based on the threat detection policy from the terminal, determines whether network access of the terminal is possible based on the identification information of the control flow, determines whether to release the control flow between the server and the terminal based on the threat detection information and the threat detection policy, transmits a result of processing the controller access update request to the terminal, releases the control flow depending on the threat detection policy and transmits information indicating network access failure to the terminal, when threat detection is identified from the threat detection information.

9. A terminal, comprising:

a communication circuitry;

a processor operatively connected with the communication circuitry; and

a memory storing instructions executed by the processor,

wherein the processor detects a controller access event for an external server, transmits a controller access request to the external server, using the communication circuitry, receives identification information of control flow between the terminal and the external server in response to the controller access request, from the external server, executes a threat detection function based on a threat detection policy received from the external server, transmits an access update request requesting to update controller access to the external server, using the communication circuitry, and receives and processes a response to the access update request from the external server,

wherein the access update request includes threat detection information indicating a result of executing the threat detection function and information necessary to update the controller access,

wherein the response includes a result of updating the controller access based on the threat detection information,

wherein the processor detects a network access event requesting access to a destination network, requests network access from the external server, using the communication circuitry, receives and processes a response to a network access request from the external server, and transmits the threat detection information together to the external server, when requesting the network access, and

wherein the response to the network access request includes information indicating whether the network access is possible, the information being determined based on the threat detection information.

10. The terminal of claim 9 , wherein the processor starts a controller access update procedure again after waiting during a predetermined time, when it succeeds in updating the controller access, and outputs a user interface indicating controller access update failure on a display, when it fails in updating the access.

11. The terminal of claim 9 , wherein the processor generates a tunnel between the terminal and a gateway based on received information necessary to generate the tunnel and transmits a data packet through the generated tunnel, when the information necessary to generate the tunnel is received in response to the network access request from the external server.

12. The terminal of claim 9 , wherein the processor transmits a data packet to a gateway based on information about an authorized tunnel, when the information about the authorized tunnel between the terminal and the gateway is received in response to the network access request from the external server.

13. A method, comprising:

transmitting, by a terminal, a controller access request to a server;

managing, by the server, data transmission between the terminal and a gateway located on a boundary of a network to which the terminal belongs, wherein the gateway is different from the terminal;

generating, by the server, control flow between the terminal and the server;

transmitting, by the server, identification information of the control flow and a threat detection policy stored in a database of the server to the terminal;

executing, by the terminal, a threat detection function loaded into the terminal based on the threat detection policy;

transmitting, by the terminal, a controller access update request including threat detection information indicating a result of executing the threat detection function to the server; and

releasing, by the server, the control flow based on the threat detection policy, when identifying threat detection based on the threat detection information;

transmitting, by the terminal, a network access request including the identification;

information of the control flow and the threat detection information to the server;

determining, by the server, whether network access of the terminal is possible based on the identification information of the control flow; and

releasing, by the server, the control flow based on the threat detection policy and transmitting, by the server, information indicating network access failure to the terminal, when identifying the threat detection based on the threat detection information,

wherein the threat detection function is configured to detect a direct threat applied to a minimized attack surface for access to a destination network.

14. The method of claim 13 , further comprising:

transmitting, by the terminal, a data packet to a gateway;

detecting, by the gateway, a threat using a threat detection function loaded into the gateway, when receiving the data packet;

dropping, by the gateway, the data packet, when the threat is detected, and storing, by the gateway, a threat detection log including a time when the threat is detected, identification information of a terminal, the threat of which is detected, and a type of the threat; and

transmitting, by the gateway, the stored threat detection log to the server on a periodic basis.

15. The method of claim 14 , further comprising:

routing, by the gateway, the data packet to a destination network, when the threat is not detected and the data packet is valid.

16. The method of claim 15 , further comprising:

analyzing, by the server, the threat detection log to identify the terminal, the threat of which is detected, and performing, by the server, an access release procedure of the terminal, the threat of which is detected.

17. The method of claim 13 , further comprising:

detecting, by a security system, a terminal threat and a network threat using a threat detection technique and transmitting, by the security system, information about the detected threats and identification information of a terminal, the threat of which is detected, to the server.

Assignments (1)

Priority Claims (1)

Continuity (3)

References Cited (359)