JP2007221442A - Packet search management apparatus and packet search management method - Google Patents

Abstract

A packet search management apparatus and a packet search management method capable of efficiently searching for a packet source.
A shared information management system receives a first search request for requesting a search for a packet source from a packet search system of a request source network, and a second for requesting a source search. Is sent to the packet search system of the other network excluding the request source network. Further, the shared information management system 11 receives the search result of the transmission source from the packet search system of the network that has received the second search request.
[Selection] Figure 1

Description

  The present invention relates to a packet search management apparatus and a packet search management method for managing a packet search system for searching for a packet source.

  In recent years, attacks that attempt to interfere with services provided on the network by continuously transmitting packets have become a problem. In order to cope with such an attack, there is an IP traceback system (IP-TBS) that traces (searches) the source of an attack packet. Recently, in order to identify the source of a spoofed attack, a mechanism has been studied in which IP-TBS in a domain (a network of units managed by a communication carrier or the like) performs tracing (for example, non-patented). Reference 1 and 2). In Non-Patent Document 1, the same type of IP-TBS is connected in series, and in Non-Patent Document 2, different types of IP-TBS are connected in series. ing.

  FIG. 7 shows a hierarchical connection architecture that is attracting attention as an interconnection system between different IP-TBSs. In the figure, domains 9a to 9c are connected in series, and trace requests and trace results are exchanged between domains 9a and 9b and between domains 9b and 9c. The domains 9a, 9b, and 9c have IP-TBSs 91a, 91b, and 91c, respectively.

  Input / output of each IP-TBS is shared by DTM (Domain Traceback Manager) 92a, 92b, 92c. Differences in specifications of each IP-TBS are absorbed by the DTM appropriately converting information exchanged with IP-TBSs in other domains. Information exchange between domains is performed by Internet Traceback Manager (ITM) 93a, 93b, 93c in each domain.

  The search for the source of the attack packet is performed as follows, for example. When it is determined by the IP-TBS 91a of the domain 9a that the attack packet has arrived at the domain 9a via the domain 9b, a trace request is generated by the IP-TBS 91a and transmitted to the domain 9b via the DTM 92a and the ITM 93a. The In the domain 9b, the trace request is transferred to the IP-TBS 91b via the ITM 93b and the DTM 92b.

Subsequently, as a result of the IP-TBS 92b tracing based on the trace request, when it is determined that the attack packet has arrived at the domain 9b via the domain 9c, the IP-TBS 91b generates a trace request, and the DTM 92b And transmitted to the domain 9c via the ITM 93b. Thereafter, the source of the attack packet is searched by repeating the same operation as described above.
Yasuhiro Hayakawa, Tatsuya Baba, Katsutoshi Kokubo, Eiyuki Matsuda, “Evaluation of Tracking Time in Unauthorized Access Source Tracking System”, Information 64th University, pp. 389-390, March 2002 Masafumi Oe, Hiroshi Kajiyama, Yuki Kadobayashi, “Proposal of Interconnection Architecture of IP Traceback System”, SCIS2005, 3B4-3, January 2005

  In the prior art described above, since IP-TBSs are connected in series and each IP-TBS performs tracing in order, there is a problem that it takes time to trace. In addition, when the IP-TBS of a domain that has received a trace request from another domain fails to trace, there is also a problem that tracing stops in that domain. In addition, when there are a plurality of attack sources, such as a DDoS (Distributed Denial of Service) attack, each of the attack sources is traced one by one, and there is a problem that the tracing is inefficient.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a packet search management device and a packet search management method capable of efficiently searching for a packet source.

  The present invention has been made to solve the above-described problem, and is a packet search management device that manages a packet search system that searches for a packet source, and is a first device for requesting a search for a packet source. Search request receiving means for receiving one search request from the packet search system of the request source network, and a second search request for requesting the search of the transmission source when the first search request is received. Receiving a search result of the transmission source from a first search request transmission means for transmitting to a packet search system of a network other than the request source network and a packet search system of the network that has received the second search request; A packet search management device comprising search result receiving means.

  In the packet search management device of the present invention, when the first search request is received, the first search request transmitting means sends the packet search system to a plurality of networks other than the request source network. The second search request is transmitted.

  The packet search management apparatus of the present invention further comprises address storage means for storing addresses managed by a plurality of networks for each network, and the first search request including the source address is received. In this case, the first search request transmission means reads out information on the network managing the source address from the address storage means, and sends the second search request to the packet search system of the network. It is characterized by transmitting.

  Further, in the packet search management device of the present invention, when the first search request including the information of the network through which the packet has passed is received, the first search request transmitting means transmits the packet via The second search request is transmitted to the packet search system of the network.

  Further, the packet search management device of the present invention may send a third search request for requesting a search for the transmission source to the request source network when the search result of the transmission source indicates a search failure. It further comprises second search request transmission means for transmitting to a packet search system of another network excluding the search result transmission source network.

  In addition, the packet search management device of the present invention may be configured such that the search result receiving unit causes the originator of the transmission source even if a predetermined time elapses after the second search request transmission unit transmits the second search request. When a search result is not received, a third search request for requesting a search for the transmission source is sent to a network other than the request source network and the destination network of the second search result. A second search request transmission means for transmitting to the packet search system is further provided.

  The present invention also relates to a packet search management method for managing a packet search system for searching for a packet source, wherein a first search request for requesting a packet source search is sent to a packet search of a request source network. When the first search request received from the system and the first search request are received, a second search request for requesting the search of the transmission source is sent to a network other than the request source network. A packet comprising: a second step of transmitting to the packet search system; and a third step of receiving the search result of the transmission source from the packet search system of the network that has received the second search request. This is a search management method.

  In the packet search management method of the present invention, when the first search request is received, in the second step, the second search is made to the packet search system of a plurality of networks other than the request source network. The search request is transmitted.

  In the packet search management method of the present invention, when the first search request including the source address is received, in the second step, addresses managed by a plurality of networks are selected. Information on a network that manages the source address is read from an address storage unit that stores each network, and the second search request is transmitted to the packet search system of the network.

  In the packet search management method of the present invention, when the first search request including the information of the network through which the packet has passed is received, the second step includes: The second search request is transmitted to the packet search system.

  In the packet search management method of the present invention, when the search result of the transmission source indicates a search failure, a third search request for requesting the search of the transmission source is sent to the request source network and the request source network. It is further characterized by further comprising a fourth step of transmitting to a packet search system of another network excluding the search result transmission source network.

  Further, the packet search management method of the present invention is used when the search result of the source is not received even after a predetermined time has elapsed since the second search request was transmitted in the second step. A fourth search request for requesting a search for the transmission source is transmitted to a packet search system of another network excluding the request source network and the transmission destination network of the second search result. Further comprising a step.

  According to the present invention, a packet source search request is received from the packet search system of the request source network, and a search is appropriately requested to the packet search system of another network, so that the packet source is efficiently searched. The effect of being able to be obtained.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of a traceback management system according to an embodiment of the present invention. The traceback management system includes an information management center 1 that manages traces performed by the IP-TBS included in the domains 2a to 2g. In the information management center 1, the shared information management system 11 has functions such as receiving a trace request from a domain, requesting a trace for the domain, receiving a trace result from the domain, and managing a trace status in each domain. ing.

  The traceback information table 12 is a table in which information related to tracing performed in the IP-TBS of each domain is stored. FIG. 2 shows the contents of the traceback information table 12. As shown in FIG. 2, a trace NO is assigned for each trace and identified. Also, information indicating the status of each trace, such as success or failure of the trace, and currently being traced, is recorded. The address (IP address) of the attack source (the source of the attack packet), the address of the attack destination (the destination of the attack packet), the port number of the attack destination, and the like are also recorded. When the path of the domain through which the attack packet has passed is found, the path is recorded as a trace path.

  The domain information table 13 (corresponding to the address storage means of the present invention) is a table in which information related to each domain is stored. FIG. 3 shows the contents of the domain information table 13. As shown in FIG. 3, information (domain information) such as a domain ID, a domain name, and a contact information of a domain administrator is recorded. Information (address information) of addresses (address space) managed in each domain is also recorded. In addition, information (TBS information) related to the IP-TBS specification of each domain is also recorded.

  The shared information management system 11 includes one or more computers, and the above-described functions are mainly realized by a CPU (Central Processing Unit) included in the computer. The traceback information table 12 and the domain information table 13 are constructed in a recording medium such as an SRAM (Static Random Access Memory), an SDRAM (Synchronous Dynamic Random Access Memory), a flash memory, or an HDD (Hard Disk Drive). The traceback information table 12 and the domain information table 13 may be in separate computers or in the same computer. Further, at least one of the traceback information table 12 and the domain information table 13 may be in the computer of the shared information management system 11.

  Although the domains 2a to 2g have IP-TBS, DTM, and ITM, only ITM is shown in FIG. 1, and other illustrations are omitted. The IP-TBS is composed of a plurality of computers. The DTM and ITM are composed of separate computers or the same computer. The functions of IP-TBS, DTM, and ITM are also realized mainly by the CPU of the computer. A system including IP-TBS, DTM, and ITM corresponds to the packet search system of the present invention. However, the configuration of the packet search system is an example, and is not limited to the configuration shown in the present embodiment.

  The attack source terminal 3 is a terminal such as a PC (Personal Computer) that is the source of the attack packet. The victim terminal 4 is a terminal such as a PC that has received the attack packet. The positions of the attack source terminal 3 and the victim terminal 4 are merely examples, and may be arranged other than the positions shown in FIG. In FIG. 1, it is assumed that the attack source terminal 3 is connected to the domain 2d and transmits an attack packet, and the victim terminal 4 is connected to the domain 2a and receives the attack packet. The attack packet transmitted by the attack source terminal 3 is transferred to the victim terminal 4 via the domains 2d, 2b, and 2a.

  Next, the operation of the traceback management system according to the present embodiment will be described. Hereinafter, the first operation example to the third operation example will be described in order with reference to FIGS. In the present embodiment, an attack with a plurality of attack source addresses and a single attack target is defined as a many-to-one attack, and an attack with a single attack source address and a single attack target is defined as an attack. It is defined as a one-to-one attack.

(First operation example)
This operation example can be applied to both a many-to-one attack and a one-to-one attack. The IP-TBS of the request source domain (domain 2a in FIG. 4) generates a trace request (search request) for requesting a trace (search) of the source of the attack packet. This trace request includes packet information necessary for tracing in the IP-TBS of another domain. The packet information is at least one of header information including the source address of the attack packet, a payload that is a data portion obtained by removing the header from the attack packet, and a hash value of the payload. In this operation example, it is assumed that the packet information in the trace request includes the address of the source of the attack packet.

  Time information indicating the reception time of the attack packet may be included in the packet information. Further, attack determination information for determining the type of attack (many-to-one attack and one-to-one attack) may be included in the packet information. For all attack packets received by a specific victim terminal 4 within a predetermined time, the type of attack is determined depending on whether the source address is singular or plural. Further, the entire attack packet may be included in the packet information. The generated trace request is transmitted to the shared information management system 11 of the information management center 1 via DTM and ITM (step S101 in FIG. 4).

  The shared information management system 11 of the information management center 1 receives the trace request from the IP-TBS of the request source domain (corresponding to the function of the search request receiving means of the present invention). The shared information management system 11 refers to the domain information table 13 and searches for an address recorded in the domain information table 13 using the address of the source of the attack packet as a key. As a result of the search, when a domain that manages the source address (assumed to be the final domain) is found, the shared information management system 11 reads the domain information from the domain information table 13 and the IP-TBS of the domain Generate a trace request.

  Further, the shared information management system 11 issues a trace NO and updates the contents of the traceback information table 12. Subsequently, the shared information management system 11 transmits a trace request to the found IP-TBS of the final domain (corresponding to the function of the first search request transmission means of the present invention). In FIG. 4, the trace request is transmitted to the IP-TBS of the domain 2d (step S102 in FIG. 4).

  The IP-TBS in the final domain receives the trace request via ITM and DTM, and traces the source of the attack packet by a known method. Subsequently, the IP-TBS in the final domain transmits the trace result to the shared information management system 11 via the DTM and ITM (step S103 in FIG. 4). If the trace is successful, the source of the attack packet is specified, but if the trace fails, the source of the attack packet is not specified. The trace result includes trace success / failure information. If the trace is successful, the source address of the found attack packet is also included. The shared information management system 11 receives the trace result (corresponding to the function of the search result receiving means of the present invention), and updates the contents of the traceback information table 12 based on the trace result.

  When the success of the trace is notified from the IP-TBS of the final domain, the shared information management system 11 sends information related to the trace (information of the domain through which the attack packet has passed or transmission of the attack packet found in the final domain as necessary). (Original address information) is sent to the requesting domain.

  On the other hand, when the trace failure is notified from the IP-TBS of the final domain, the shared information management system 11 transmits the trace request all at once to the IP-TBSs of other domains excluding the request source domain and the final domain. (Corresponding to the function of the second search request transmission means of the present invention). In FIG. 4, when the IP-TBS of the domain 2d fails to trace, a trace request is transmitted to the IP-TBSs of the domains 2b, 2c, 2e, 2f, and 2g except the domains 2a and 2d (FIG. 4). Step S104). The IP-TBS that has received this trace request performs a trace, and returns the trace result to the shared information management system 11 as described above. The shared information management system 11 updates the contents of the traceback information table 12 based on the trace result, and transmits information about the trace to the request source domain as necessary.

  According to this operation example, it is not necessary to request a trace between the request source domain and the final domain that relayed the attack packet (domain 2b in FIG. 4). Compared with the conventional tracing method in which tracing is performed sequentially through the domain to be executed, the source of the attack packet can be searched efficiently. Even if the requesting domain does not have a system such as IP-TBS having a function of specifying the source of the attack packet, the shared information management system 11 receives a trace request from the requesting domain, The trace can be requested to the IP-TBS of the domain.

(Second operation example)
This operation example can be applied to both a many-to-one attack and a one-to-one attack. The IP-TBS of the request source domain (domain 2a in FIG. 5) generates a trace request (search request) for requesting a trace (search) of the source of the attack packet. It is assumed that the packet information in the trace request includes at least one of the payload of the attack packet and the hash value of the payload. In the same manner as described above, the IP-TBS of the request source domain transmits a trace request to the shared information management system 11 (step S201 in FIG. 5).

  The shared information management system 11 receives the trace request from the IP-TBS of the request source domain (corresponding to the function of the search request receiving means of the present invention). The shared information management system 11 reads information of a plurality of domains excluding the request source domain from the domain information table 13 and generates a trace request for the IP-TBS of those domains. This trace request includes packet information received from the IP-TBS of the request source domain. Further, the shared information management system 11 issues a trace NO and updates the contents of the traceback information table 12. Subsequently, the shared information management system 11 transmits a trace request all at once to the IP-TBS in the above domain (corresponding to the function of the first search request transmission means of the present invention). In FIG. 5, the trace request is transmitted to the IP-TBS of the domains 2b, 2c, 2d, 2e, 2f, and 2g except the domain 2a (step S202 in FIG. 5).

  The IP-TBS that has received this trace request traces the source of the attack packet by a known method and returns the trace result to the shared information management system 11. The shared information management system 11 updates the contents of the traceback information table 12 based on the trace result, and transmits information about the trace to the request source domain as necessary.

  According to this operation example, after receiving the trace request from the IP-TBS of the request source domain, the shared information management system 11 transmits the trace request all at once to the IP-TBSs of a plurality of domains. Compared with the conventional tracing method in which tracing is performed in order through the connected and adjacent domains, the source of the attack packet can be efficiently searched. Even if the requesting domain does not have a system such as IP-TBS having a function of specifying the source of the attack packet, the shared information management system 11 receives a trace request from the requesting domain, The trace can be requested to the IP-TBS of the domain.

  The tracing method described in this operation example is particularly suitable for tracing the source of attack packets of many-to-one attacks. When the IP-TBS of the request source domain receives the same attack from the attack source of multiple addresses, it extracts the common data part between attack packets from the attack packet, and extracts the extracted data or the hash value of the data as packet information. Is sent to the shared information management system 11. The common data portion is the same payload excluding the IP header, which is found in worms and DDoS attacks.

  The shared information management system 11 receives the trace request and transmits the trace request all at once to the IP-TBSs of a plurality of domains excluding the request source domain. The subsequent operation is the same as described above. Instead of the above, the entire attack packet is included in the trace request transmitted from the IP-TBS of the request source domain, and the shared information management system 11 may extract the common data portion from the received attack packet. Good.

  In this way, the shared information management system 11 does not individually send a trace request for a plurality of attack packets, but collectively sends a common trace request to a plurality of attack packets. It is possible to search efficiently.

(Third operation example)
This operation example can be applied to both a many-to-one attack and a one-to-one attack, but is particularly suitable for tracing the source of an attack packet of a one-to-one attack. The IP-TBS of the request source domain (domain 2a in FIG. 6) generates a trace request (search request) for requesting a trace (search) of the source of the attack packet. It is assumed that the packet information in the trace request includes at least one of the payload of the attack packet and the hash value of the payload. Further, it is assumed that the IP-TBS of the request source domain has already been traced and the domain through which the attack packet has passed (referred to as a relay domain) is known, and the packet information in the trace request includes the relay domain information. Is also included. In the same manner as described above, the IP-TBS of the request source domain transmits a trace request to the shared information management system 11 (step S301 in FIG. 6).

  The shared information management system 11 receives the trace request from the IP-TBS of the request source domain (corresponding to the function of the search request receiving means of the present invention). The shared information management system 11 refers to the relay domain information included in the packet information that is being requested for tracing. Then, the shared information management system 11 reads the relay domain information from the domain information table 13 and generates a trace request for the IP-TBS of the relay domain. This trace request includes packet information received from the IP-TBS of the request source domain. Further, the shared information management system 11 issues a trace NO and updates the contents of the traceback information table 12. Subsequently, the shared information management system 11 transmits a trace request to the IP-TBS of the relay domain (corresponding to the function of the first search request transmission unit of the present invention). In FIG. 6, the trace request is transmitted to the IP-TBS of the domain 2b (step S302 in FIG. 6).

  The IP-TBS that has received this trace request traces the source of the attack packet by a known method, and returns the trace result to the shared information management system 11 (step S303 in FIG. 6). The trace result includes trace success or failure or other domain information through which the attack packet has passed. The shared information management system 11 receives this trace result, updates the content of the traceback information table 12 based on the trace result, and then operates as follows according to the content of the information included in the trace result.

  When information on another domain through which the attack packet has passed is included in the trace result, the shared information management system 11 reads the domain information from the domain information table 13 and generates a trace request for the IP-TBS of the domain. Subsequently, the shared information management system 11 transmits a trace request to the IP-TBS of the domain (corresponding to the function of the first search request transmission unit of the present invention). In FIG. 6, when it is determined that the attack packet has passed through the domain 2d in the IP-TBS of the domain 2b, a trace request is transmitted to the IP-TBS of the domain 2d (step S304 in FIG. 6).

  Further, when information indicating that the trace is successful is included in the trace result, the shared information management system 11 transmits information on the trace to the request source domain as necessary.

  If the trace result includes information indicating that the trace has failed, the shared information management system 11 determines the relay domain and the requester domain that have already transmitted the trace result in the same manner as in the second operation example. Information of a plurality of domains other than the domain is read from the domain information table 13 and a trace request for the IP-TBS of those domains is generated. The subsequent operation is the same as in the second operation example. The shared information management system 11 issues a trace NO, updates the contents of the traceback information table 12, and then transmits a trace request to the IP-TBS of the above domain (function of the second search request transmission means of the present invention) Equivalent). In FIG. 6, when tracing fails in the IP-TBS of the domain 2b, a trace request is transmitted to the IP-TBSs of the domains 2c, 2d, 2e, 2f, and 2g (step S305 in FIG. 6).

  According to this operation example, when the shared information management system 11 sequentially requests tracing to the relay domain and the IP-TBS of the relay domain fails to trace, the IP-TBS of another domain requests tracing. Therefore, it is possible to further increase the possibility of success in tracing, and to reduce the possibility of the trace stopping in the intermediate relay domain as in the past.

  The shared information management system 11 may appropriately switch the tracing method according to the three operation examples described above. For example, the shared information management system 11 determines the type of attack based on the attack discrimination information included in the packet information in the trace request from the IP-TBS of the request source domain, and selects the trace method according to the type. You may do it. In addition, since the load of processing for transmitting a trace request to IP-TBSs of a plurality of domains increases as the number of domains increases, the first or third operation example depends on the processing load of the shared information management system 11. The shared information management system 11 may select the tracing method according to the above and the tracing method according to the second operation example.

  Further, according to the tracing method according to the first operation example, the shared information management system 11 refers to the domain information table 13 and searches for the address recorded in the domain information table 13 using the address of the source of the attack packet as a key. As a result, the domain that manages the source address may not be found. In this case, the shared information management system 11 determines that the source address is spoofed, and transmits a trace request to the IP-TBSs of a plurality of domains excluding the request source domain as in the second operation example. You may do it.

  In addition, when a certain domain has an IP-TBS in which the time required for tracing differs depending on the type of IP-TBS possessed by each domain and tracing is successful only during an attack, tracing is performed for that domain. Even if requested, tracing may not succeed. Therefore, in order to improve the success rate of tracing, the following may be performed. When the shared information management system 11 has not received the trace result of the transmission source from the IP-TBS even after a predetermined time has elapsed since the transmission of the trace request to the IP-TBS of a certain domain, the shared information management system 11 And the trace request are transmitted to IP-TBSs in other domains excluding the destination domain of the trace request.

  For example, in the first operation example, when the shared information management system 11 transmits a trace request to the IP-TBS in the final domain (step S102 in FIG. 4), the shared information management system 11 starts a timer and starts timing. When a predetermined time elapses before receiving the trace result from the IP-TBS of the final domain, the shared information management system 11 determines whether the request source domain and the final domain are received regardless of whether or not the trace result is received thereafter. Trace requests are transmitted all at once to IP-TBSs in other domains excluding the domain (corresponding to the function of the second search request transmission means of the present invention).

  For example, in the third operation example, when the shared information management system 11 transmits a trace request to the IP-TBS in the relay domain (step S302 in FIG. 6), the shared information management system 11 starts a timer and starts timing. When a predetermined time elapses before receiving the trace result from the IP-TBS of the relay domain, the shared information management system 11 is the same as described above regardless of whether or not the trace result is received thereafter. The trace request is transmitted all at once to the IP-TBSs of other domains excluding the request source domain and the relay domain that has already transmitted the trace request.

  As described above, according to the present embodiment, the shared information management system 11 receives a trace request from the IP-TBS of the request source domain, and appropriately requests the trace to the IP-TBS of another domain. Can be searched efficiently. For example, according to the first and second operation examples, it is possible to search the source of the attack packet at a higher speed than in the past.

  Further, according to the first and third operation examples, even if the IP-TBS of the domain that has received the trace request from the shared information management system 11 fails to trace, the trace is requested to the IP-TBS of another domain. As a result, the possibility of success in tracing can be further increased, and the possibility of stopping the tracing as in the conventional case can be reduced. Similarly, according to the second operation example, the shared information management system 11 accepts a trace request from the IP-TBS of the request source domain and requests traces to the IP-TBSs of other domains. The possibility of success can be further increased, and the possibility of the trace being stopped as in the conventional case can be reduced.

  Further, according to the second operation example, the shared information management system 11 does not individually transmit a trace request for a plurality of attack packets, but transmits a common trace request for a plurality of attack packets. Thus, it is possible to efficiently search for a source of an attack packet transmitted by an attack having a plurality of attack sources.

  The embodiment of the present invention has been described in detail above with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like without departing from the gist of the present invention.

It is a block diagram which shows the structure of the traceback management system by one Embodiment of this invention. It is a reference figure which shows the content of the traceback information table managed with the traceback management system by one Embodiment of this invention. It is a reference figure which shows the content of the domain information table managed with the traceback management system by one Embodiment of this invention. It is operation | movement explanatory drawing for demonstrating operation | movement of the traceback management system by one Embodiment of this invention. It is operation | movement explanatory drawing for demonstrating operation | movement of the traceback management system by one Embodiment of this invention. It is operation | movement explanatory drawing for demonstrating operation | movement of the traceback management system by one Embodiment of this invention. It is a reference figure which shows the connection system of the conventional IP-TBS.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Information management center, 11 ... Shared information management system, 12 ... Traceback information table, 13 ... Domain information table

Claims (12)

A packet search management device for managing a packet search system for searching for a packet source,
Search request receiving means for receiving from the packet search system of the request source network a first search request for requesting a search for the source of the packet;
When the first search request is received, a first search for transmitting a second search request for requesting a search for the transmission source to a packet search system of another network excluding the request source network A request sending means;
Search result receiving means for receiving the search result of the source from the packet search system of the network that has received the second search request;
A packet search management apparatus comprising:   When the first search request is received, the first search request transmission means transmits the second search request to packet search systems of a plurality of networks other than the request source network. The packet search management device according to claim 1, wherein: An address storage means for storing addresses managed in a plurality of networks for each network;
When the first search request including the source address is received, the first search request transmission unit stores information on a network managing the source address as the address storage unit. The packet search management apparatus according to claim 1, wherein the second search request is transmitted to the packet search system of the network.   When the first search request including the information of the network through which the packet has been received is received, the first search request transmission unit sends the second search request to the network packet search system through which the packet has passed. The packet search management device according to claim 1, wherein a search request is transmitted.   When the search result of the transmission source indicates a search failure, a third search request for requesting the search of the transmission source is other than the request source network and the network of the transmission source of the search result 2. The packet search management device according to claim 1, further comprising second search request transmission means for transmitting to a packet search system of the network.   When the search result receiving means has not received the search result of the transmission source even after a predetermined time has elapsed since the second search request transmission means was transmitted by the second search request transmission means, A second search request for transmitting a third search request for requesting a search for a transmission source to a packet search system of another network excluding the request source network and the destination network of the second search result. The packet search management apparatus according to claim 1, further comprising a transmission unit. A packet search management method for managing a packet search system for searching for a packet source,
Receiving a first search request for requesting a search for a packet source from a packet search system of a request source network;
A second step of transmitting a second search request for requesting a search for the transmission source to a packet search system of another network excluding the request source network when the first search request is received; When,
A third step of receiving the search result of the source from the packet search system of the network that has received the second search request;
A packet search management method comprising:   When the first search request is received, in the second step, the second search request is transmitted to packet search systems of a plurality of networks other than the request source network. The packet search management method according to claim 7.   When the first search request including the source address is received, in the second step, an address storage unit that stores addresses managed by a plurality of networks for each network, 8. The packet search management method according to claim 7, wherein information on a network that manages a source address is read, and the second search request is transmitted to a packet search system of the network.   When the first search request including the information of the network through which the packet has passed is received, the second step sends the second search request to the packet search system of the network through which the packet has passed. The packet search management method according to claim 7, wherein transmission is performed.   When the search result of the transmission source indicates a search failure, a third search request for requesting the search of the transmission source is other than the request source network and the network of the transmission source of the search result The packet search management method according to claim 7, further comprising a fourth step of transmitting to a packet search system of the network. For requesting a search for the transmission source when the search result of the transmission source is not received even after a predetermined time has elapsed since the transmission of the second search request in the second step. The method further comprises a fourth step of transmitting a third search request to a packet search system in another network excluding the request source network and the destination network of the second search result. Item 8. The packet search management method according to Item 7.

Images