Controller-based system for controlling network access, and method therefor

A server, comprising:

• a communication circuit;
• a memory configured to store a database;
• and
• a processor operatively connected to the communication circuit and the memory,
• wherein the processor is configured to:
• receive a network access request from an access control application of a node, wherein the network access request includes control flow identification information, identification information of a target application of the node, and identification information and port information of a destination network;
• identify whether an access of the target application is possible, based on the identification information of the target application, the identification information of the destination network, and the port information;
• when the access of the target application is possible, generate a data flow;
• identify whether a data packet of the target application is capable of being transmitted to the destination network through a virtual router;
• when the data packet is capable of being transmitted through the virtual router, update the data flow, wherein the virtual router is included in an SDN switch between the node and the destination network;
• and
• transmit the updated data flow to the node and an SDN controller connected to the SDN switch.

An operating method of an access control application installed in a node, the method comprising:

• performing a network access request to an external server through the access control application, wherein the network access request includes identification information of a target application and identification information of a destination network;
• receiving a data flow from the external server through the access control application;
• wherein the data flow corresponds to identification information of the node and the identification information of the destination network and the data flow includes information about whether a data packet is capable of being transmitted through a virtual router;
• and
• transmitting a data packet of the target application based on the received data flow, through the access control application,
• wherein the virtual router is included in an SDN switch through which the node transmits the data packet.