Abstract: A network access control system and a method are disclosed. In a step of generating a transmission control protocol (TCP) session between a terminal and a gateway (or a server), the TCP session is authenticated, and whether or not to generate the TCP session is determined on the basis of a result of the authentication, thereby preventing, in advance, a target application within the terminal from bypassing control of an access control application and transmitting a data packet to a destination network through an authorized tunnel.

Abstract: A system and a method for providing a secure network access of a terminal, the system including: a terminal; a gateway located at a boundary of a network to which the terminal belongs; and a server which manages data transmission between the terminal and the gateway. The server: generates a control flow between the terminal and the server upon receiving a controller access request from the terminal; transmits, to the terminal, identification information of the control flow, and a threat detection policy stored in a database of the server; receives, from the terminal, the controller access update request including threat detection information indicating a result of executing a threat detection function installed in the terminal on the basis of the threat detection policy; and, when detection of a threat is confirmed from the threat detection information, cancels the control flow on the basis of the threat detection policy.

Abstract: A network access control device generates, in a tunnel-based access control network environment, a tunnel that connects a terminal application to the gateway of a destination network, on the basis of a tunnel between the terminal application and a gateway and a tunnel between gateways, thereby enabling safe transmission of a data packet from the terminal application to a destination node. It can include: a memory for storing a tunnel policy, a tunnel routing policy, and a tunnel table; and a control unit which generates tunnel information and data flow information on the basis of the tunnel policy, the tunnel routing policy, and the tunnel table according to a network access request of the terminal, and which transmits the generated tunnel information and data flow information to the terminal and the gateway of each network so that a tunnel between the terminal and the destination network is generated.

Abstract: A network access control system and a method are disclosed. In a step of generating a transmission control protocol (TCP) session between a terminal and a gateway (or a server), the TCP session is authenticated, and whether or not to generate the TCP session is determined on the basis of a result of the authentication, thereby preventing, in advance, a target application within the terminal from bypassing control of an access control application and transmitting a data packet to a destination network through an authorized tunnel.

Abstract: A node includes: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect a network access event of the target application to a destination network through the access control application, identify whether a tunnel corresponding to identification information of the target application and the destination network and authorized by an external server exists, transmit a data packet of the target application through the authorized tunnel using the communication circuit, when the authorized tunnel exists, and drop the data packet of the target application, when the authorized tunnel does not exist.

Abstract: A node includes: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect a network access event of the target application to a destination network through the access control application, identify whether a tunnel corresponding to identification information of the target application and the destination network and authorized by an external server exists, transmit a data packet of the target application through the authorized tunnel using the communication circuit, when the authorized tunnel exists, and drop the data packet of the target application, when the authorized tunnel does not exist.

Abstract: A node includes: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect a network access event of the target application to a destination network through the access control application, identify whether a tunnel corresponding to identification information of the target application and the destination network and authorized by an external server exists, transmit a data packet of the target application through the authorized tunnel using the communication circuit, when the authorized tunnel exists, and drop the data packet of the target application, when the authorized tunnel does not exist.

Abstract: A node includes: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect a network access event of the target application to a destination network through the access control application, identify whether a tunnel corresponding to identification information of the target application and the destination network and authorized by an external server exists, transmit a data packet of the target application through the authorized tunnel using the communication circuit, when the authorized tunnel exists, and drop the data packet of the target application, when the authorized tunnel does not exist.