JP2017050832A - Network system and dos (denial of service) attack defense method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network system for preventing a DoS attack without affecting normal communication and a method for preventing a DoS attack. In a network system, a first server to which a terminal communicates, a second server connected to the same network as the first server, and communication from the terminal to the first server are received by the second server. The second server has a route control server that controls the communication path in the network so as to receive a request for establishing a connection from the terminal on behalf of the first server, and determines a DoS attack by responding to the request. If it is not a DoS attack, a connection is established to communicate with the terminal, the route control server is requested to change the route so that the communication from the terminal to the first server is received by the first server, and information about the connection is sent. It sends to the first server, the route control server changes the route in response to the request, and the first server takes over the communication from the second server based on the information about the connection. [Selection diagram] Fig. 1

Description

  The present case relates to a network system and a DoS attack protection method.

  With the spread of the network, there is a concern that malicious users will increase the DoS attack on the server. One example of a DoS attack is a SYN flood attack.

  The SYN flood attack is a three-way handshake that establishes a TCP (Transfer Control Protocol) connection, sends a large number of SYNs from the terminal to the server, and does not intentionally return an ACK even if a SYN / ACK is responded from the server. Is. As a result, the load on standby processing increases and the processing capacity is deprived of the server, so that it is impossible to provide a normal service to a bona fide user.

  On the other hand, various defense methods against DoS attacks have been proposed (see, for example, Patent Documents 1 to 3).

JP 2006-345268 A JP 2003-289338 A JP 2013-2014478 A

  However, according to the defense methods of Patent Documents 1 and 2, the DoS attack target device receives not only normal communication but also the DoS attack communication, so the processing load on the DoS attack target device is heavy. In addition, according to the defense method of Patent Document 3, the top switch on the communication path between the transmission source host and the transmission destination host not only transfers normal communication addressed to the transmission destination host but also acts as a proxy TCP with the transmission source host. Since the connection is also performed, the processing load of the head switch is large.

  Therefore, according to the defense methods of Patent Documents 1 to 3, there is a possibility of adversely affecting normal communication.

  Accordingly, the present invention has been made in view of the above problems, and an object thereof is to provide a network system and a DoS attack protection method that prevent a DoS attack without affecting normal communication.

  The network system described in this specification includes a first server as a communication destination of a terminal, a second server connected to the same network as the first server, and communication addressed to the first server from the terminal. A path control server for controlling a communication path in the network so as to be received by the second server, and the second server receives a request for establishing a connection from the terminal instead of the first server, It is determined whether or not the request is a DoS attack by responding to the request, and when it is determined that the request is not a DoS attack, the connection is established and communicated with the terminal. Requesting the change of the communication path so that the communication addressed to the first server from the terminal is received by the first server, and sending the information on the connection to the first server The path control server changes the communication path in response to a request from the second server, and the first server receives the second information based on the information about the connection received from the second server. Take over communication with the terminal from the server.

  In the DoS attack prevention method described in this specification, the route control server is a second server connected to the same network as the first server with which the terminal communicates, and communication from the terminal to the first server is performed. The second server controls a communication path in the network so that the request is received, and the second server receives a request for establishing a connection from the terminal instead of the first server, and responds to the request, whereby the request is changed to DoS. If it is determined whether the request is a DoS attack, the connection is established and communication with the terminal is performed, and the routing server is addressed to the first server from the terminal. Requesting the change of the communication path so that the communication of the first server is received by the first server, and transmitting information related to the connection to the first server. The communication path is changed in response to a request from a second server, and the first server takes over communication with the terminal from the second server based on information on the connection received from the second server. .

  A DoS attack can be protected without affecting normal communication.

It is a block diagram which shows an example of a network system. It is a block diagram which shows an example of a switch apparatus. It is a figure which shows an example of the flow table of an initial state. It is a figure which shows an example of the flow table at the time of a route change. It is a block diagram which shows an example of a route control server. It is a block diagram which shows an example of a proxy server. It is a figure which shows an example of a connection database. It is a block diagram which shows an example of a management server. It is a block diagram which shows an example of a destination server. It is a sequence diagram which shows an example of an initial setting process. It is a sequence diagram which shows an example of the process at the time of receiving a DoS attack. It is the sequence diagram (the 1) which shows an example of the process at the time of receiving normal communication. It is a sequence diagram (the 2) which shows an example of a process at the time of receiving normal communication. It is a flowchart which shows an example of the operation | movement at the time of the packet reception of a proxy server. It is a flowchart which shows an example of the determination process of DoS attack. It is a sequence diagram which shows an example of a process when a communication abnormality is detected. It is a flowchart which shows an example of operation | movement of a destination server.

  FIG. 1 is a configuration diagram illustrating an example of a network system. The network system includes a network A including a plurality of switch (SW) devices 6, 6 a, 6 b, a destination server 1 and a proxy server 2 connected to the network A, and a path control server 3 that controls a communication path in the network A. And a management server 4 that manages the network A.

  The management server 4 is operated from an operation terminal 5 such as a personal computer, and performs monitoring control of the destination server 1, the proxy server 2, and the route control server 3 according to the operation. The path control server 3 sets a communication path for the switch devices 6, 6 a, 6 b in accordance with the setting from the management server 4. The switch devices 6, 6a, and 6b are, for example, layer 2 switches, and include a flow table in which transfer destinations for each packet are registered.

  The network A is an SDN (Software Defined Network), for example, and the communication path is flexibly set by setting the flow tables of the switch devices 6, 6 a, 6 b from the path control server 3. The network A is connected to an external network B, and a terminal 7 such as a personal computer is connected to the external network B. In addition, although only one terminal 7 is illustrated, a plurality of terminals 7 may be provided.

  The terminal 7 transmits a packet destined for the destination server 1 to the network A. That is, the destination server 1 is an example of a first server and is a communication destination of the terminal 7. The destination server 1 provides a service to the (bona fide) user of the terminal 7. In this embodiment, the IP (Internet Protocol) address of the terminal 7 is “192.168.1.6”, and the IP address of the destination server 1 is “10.1.2.3”.

  For example, when the terminal 7 is operated by a malicious user, there is a concern that a DoS attack is performed from the terminal 7 to the destination server 1. When the destination server 1 is subjected to a DoS attack, the processing capability is deprived and the service cannot be provided. In the present embodiment, the Syn flood attack is exemplified as the DoS attack, but the DoS attack is not limited to this.

  Therefore, the network A transmits a request for establishing a TCP connection from the terminal 7 to the proxy server 2 connected to the same network A as the destination server 1 instead of the destination server 1. For this reason, the route control server 3 controls the communication route in the network A so that the communication addressed to the destination server 1 from the terminal 7 is received by the proxy server 2. The communication path at this time is indicated by reference numeral R1. In the present embodiment, the TCP connection is exemplified as the connection with the terminal 7, but the present invention is not limited to this.

  The proxy server 2 is an example of a second server, and receives a request for establishing a TCP connection from the terminal 7 instead of the destination server 1. The proxy server 2 determines whether or not the request is a DoS attack by responding to the request from the terminal 7. In this embodiment, the IP address of the proxy server 2 is “10.1.2.8”.

  The proxy server 2 determines whether or not the request is a DoS attack by responding to the request from the terminal 7. More specifically, the proxy server 2 returns a SYN + ACK response to the SYN received from the terminal 7 based on the TCP three-way handshake. If the proxy server 2 does not receive an ACK (response signal) from the terminal within a predetermined time after the response, the proxy server 2 determines that the request of the terminal 7 is a DoS attack. For this reason, the proxy server 2 can easily determine the DoS attack.

  If the proxy server 2 determines that the request from the terminal 7 is not a DoS attack, the proxy server 2 establishes a TCP connection and communicates with the terminal 7. In this case, the proxy server 2 communicates with the path control server 3 via the management server 4 so that the communication addressed to the destination server 1 from the terminal 7 is received by the destination server 1 via the management server 4 as indicated by the symbol REQ. Request a change.

  The route control server 3 changes the communication route in response to a request from the destination server 1. The communication path at this time is indicated by the symbol R2. That is, when the request of the terminal 7 is not a DoS attack, the path control server 3 changes the communication path from the terminal 7 from the communication path R1 reaching the proxy server 2 to the communication path R2 reaching the destination server 1. For this reason, communication from the terminal 7 is received by the proxy server 2 before the TCP connection is established, and is received by the destination server 1 after the TCP connection is established.

  In addition, when the request of the terminal 7 is not a DoS attack, the proxy server 2 transmits information related to the connection to the destination server 1 via the management server 4 as indicated by reference numeral CN. The destination server 1 takes over communication with the terminal 7 from the proxy server 2 based on the information regarding the connection received from the proxy server 2. For this reason, the destination server 1 can communicate with the terminal 7 using the connection established by the proxy server 2.

  Thus, since the proxy server 2 receives the communication from the terminal 7 and takes over only normal communication that is not a DoS attack to the destination server 1, the destination server 1 receives the communication of the DoS attack from the terminal 7. Only normal communication can be received. Therefore, according to the network system of the present embodiment, it is possible to prevent a DoS attack without affecting normal communication.

  The proxy server 2 is connected to a switch device 6a corresponding to the entrance of the network A to the external network B. That is, the proxy server 2 is connected to the boundary between the external network B and the network A. For this reason, communication from the terminal 7 is transferred to the proxy server 2 through the shortest path in the network A. Thereby, the influence which the communication from the terminal 7 has on other normal communication in the network A is reduced. In addition, the proxy server 2 is not limited to this, For example, as shown with a dotted line, you may connect with the switch apparatus 6b equivalent to the entrance of the network A with respect to the destination server 1. FIG.

  In addition, when the destination server 1 takes over communication with the terminal 7 from the proxy server 2 and the communication from the terminal 7 is not received for a certain period of time, the destination server 1 sends the terminal 7 to the route control server 3 as indicated by reference numeral REQ ′. The proxy server 2 is requested to change the communication path so that the communication addressed to the destination server 1 is received by the proxy server 2. The path control server 3 changes the communication path in response to a request from the proxy server 2.

  For this reason, when an abnormality occurs in communication with the terminal 7, the destination server 1 can prevent the influence on other normal communication by causing the proxy server 2 to receive the communication.

  Next, the configuration of the destination server 1, the proxy server 2, the path control server 3, the management server 4, and the switch devices 6, 6a, 6b will be described.

  FIG. 2 is a configuration diagram illustrating an example of the switch devices 6, 6a, and 6b. The switch devices 6, 6 a, and 6 b include a CPU (Central Processing Unit) 60, a ROM (Read Only Memory) 61, a RAM (Random Access Memory) 62, a nonvolatile memory 63, and a plurality of communication ports 64. The CPU 60 is connected to the ROM 61, the RAM 62, the nonvolatile memory 63, and the plurality of communication ports 64 via the data bus 65 so that signals can be input and output with each other.

  The ROM 61 stores a program that drives the CPU 60. The RAM 62 functions as a working memory for the CPU 60. The communication port 64 is, for example, a PHY (Physical Layer) / MAC (Media Access Control) device, and is connected to the terminal 7, the destination server 1, the proxy server 2, the other switch devices 6, 6 a and 6 b, and the path control server 3. Send and receive packets between them. In this embodiment, an IP packet is exemplified as a packet, but the present invention is not limited to this.

  When the CPU 60 reads a program from the ROM 61, a path setting unit 601 and a transfer processing unit 602 are formed as functions. The non-volatile memory 63 is a flash memory, for example, and stores a flow table 630.

  When receiving the control of the communication path from the path control server 3 via the communication port 64, the path setting unit 601 sets the flow table 630 according to the control. The route setting unit 601 notifies the transfer processing unit 602 that the setting of the flow table 630 has been completed. Upon receiving the setting completion notification from the path setting unit 601, the transfer processing unit 602 receives a packet from the terminal 7, the destination server 1, the proxy server 2, or the other switch devices 6, 6a, 6b via the communication port 64. The transfer destination of the packet is searched from the flow table 630. The transfer processing unit 602 transfers the packet from the communication port 64 corresponding to the transfer destination.

  FIG. 3A shows an example of the flow table 630 in the initial state. The flow table 630 includes a source IP address, a source port number, a destination IP address, a destination port number, and a transfer destination. The source IP address “X.X.X.X” (X: hexadecimal 0-F) indicates all IP addresses.

  The transfer processing unit 602 searches the flow table 630 for a transfer destination corresponding to the source IP address, source port number, destination IP address, and destination port number in the packet. In the initial state, the transfer processing unit 602 transfers all packets having the destination IP address “10.1.2.3” to the transfer destination having the IP address “10.1.2.8”. For this reason, all packets addressed to the destination server 1 are transferred to the proxy server 2. Therefore, the terminal 7 communicates with the proxy server 2 until it is confirmed that the communication from the terminal 7 is not a DoS attack.

  FIG. 3B shows an example of the flow table 630 at the time of route change. More specifically, FIG. 3B shows a flow table 630 when the communication path from the terminal 7 is changed from the communication path R1 to the communication path R2.

  As indicated by the symbol P, the transfer processing unit 602 sends all packets having a source IP address “192.168.10.6” and a destination IP address “10.1.2.3” to an IP address “10.1.2.3”. Transfer to the destination. For this reason, all packets transmitted from the terminal 7 to the destination server 1 are transferred to the destination server 1. Therefore, when it is confirmed that the communication from the terminal 7 is not a DoS attack but a normal communication, the terminal 7 can communicate with the destination server 1.

  FIG. 4 is a configuration diagram illustrating an example of the route control server 3. The path control server 3 includes a CPU 30, a ROM 31, a RAM 32, a nonvolatile memory 33, and a plurality of communication ports 34. The CPU 30 is connected to a ROM 31, a RAM 32, a nonvolatile memory 33, a plurality of communication ports 34, and a data bus 35 so that signals can be input and output with each other.

  The ROM 31 stores a program that drives the CPU 30. The RAM 32 functions as a working memory for the CPU 30. The communication port 34 is, for example, a network interface card, and transmits / receives packets to / from the switch devices 6, 6 a, 6 b and the management server 4.

  When the CPU 30 reads a program from the ROM 31, a path control unit 301 is formed as a function. The nonvolatile memory 33 is a flash memory, for example, and stores a path information database (DB) 331.

  The path control unit 301 receives a communication path change request from the management server 4 via the communication port 34, and sets the flow table 630 of the switch devices 6, 6a, 6b in response to the request, so that the network A Control the communication path inside. The contents of the flow table 630 of each switch device 6, 6a, 6b are registered in the route information database 331 and updated by the route control unit 301 every time a route change is performed.

  FIG. 5 is a configuration diagram illustrating an example of the proxy server 2. The proxy server 2 includes a CPU 20, a ROM 21, a RAM 22, a nonvolatile memory 23, and a plurality of communication ports 24. The CPU 20 is connected to a ROM 21, a RAM 22, a nonvolatile memory 23, a plurality of communication ports 24, and a data bus 25 so that signals can be input and output with each other.

  The ROM 21 stores a program for driving the CPU 20. The RAM 22 functions as a working memory for the CPU 20. The communication port 24 is, for example, a network interface card, and transmits / receives packets to / from the switch devices 6, 6 a, 6 b and the management server 4.

  When the CPU 20 reads the program from the ROM 21, a connection processing unit 201, a route change request unit 202, and a communication takeover request unit 203 are formed as functions. The nonvolatile memory 23 is, for example, a flash memory, and stores a connection database (DB) 230 and destination server information 231.

  The connection processing unit 201 establishes a TCP connection with the terminal 7 according to the three-way handshake. When the connection processing unit 201 receives SYN from the terminal 7 via the communication port 24 in the three-way handshake, the connection processing unit 201 transmits SYN + ACK to the terminal 7 via the communication port 24. When the connection processing unit 201 receives SYN, the connection processing unit 201 registers information related to the TCP connection in the connection database 230.

  FIG. 6 shows an example of the connection database 230. The connection database 230 includes a source IP address, a source port number, a destination IP address, a destination port number, and an ACK number. The transmission source IP address, transmission source port number, destination IP address, destination port number, and ACK number are acquired from the SYN received from the terminal 7. The ACK number is a sequence number in the three-way handshake and is updated as needed. Information regarding these TCP connections is used for communication with the terminal 7 by the destination server 1 when communication from the terminal 7 is normal.

  After transmitting SYN + ACK, the connection processing unit 201 activates a timer, and determines that SYN from the terminal 7 is a DoS attack when ACK is not received from the terminal 7 within a predetermined time. As a result, the connection processing unit 201 easily determines a DoS attack and normal communication.

  On the other hand, if the connection processing unit 201 receives an ACK from the terminal 7 within a predetermined time, the connection processing unit 201 determines that SYN from the terminal 7 is normal communication. In this case, the connection processing unit 201 notifies the determination result to the route change request unit 202 and the communication takeover request unit 203.

  When the route change request unit 202 is notified of the determination result from the connection processing unit 201, the route change request unit 202 reads the destination server information 231 from the nonvolatile memory 13. The destination server information 231 indicates the IP address “10.1.2.3” of the destination server 1. The destination server information 231 is set by the management server 4.

  The route change request unit 202 transmits a packet communication route change request from the terminal 7 to the management server 4 via the communication port 24. The change request is generated based on the destination server information 231. When the management server 4 receives the change request, the management server 4 sets a communication path in the path control server 3 based on the change request. As a result, the communication path of the terminal 7 in the network A is changed from the path R1 reaching the proxy server 2 to the path R2 reaching the destination server 1.

  The communication takeover request unit 203 reads the destination server information 231 from the nonvolatile memory 13 when notified of the determination result from the connection processing unit 201. The communication takeover request unit 203 reads information on the corresponding TCP connection from the connection database 230 and transmits it to the management server 4 as a communication takeover request via the communication port 24. The takeover request is generated based on the destination server information 231. When receiving the takeover request, the management server 4 instructs the destination server 1 to take over. Thereby, the destination server 1 starts communication with the terminal 7 based on the information regarding the TCP connection.

  FIG. 7 is a configuration diagram illustrating an example of the management server 4. The management server 4 includes a CPU 40, a ROM 41, a RAM 42, a nonvolatile memory 43, and a plurality of communication ports 44. The CPU 40 is connected to the ROM 41, RAM 42, nonvolatile memory 43, and a plurality of communication ports 44 via a data bus 45 so that signals can be input and output with each other.

  The ROM 41 stores a program that drives the CPU 40. The RAM 42 functions as a working memory for the CPU 40. The communication port 44 is, for example, a network interface card, and transmits / receives packets to / from the destination server 1, the proxy server 2, and the path control server 3.

  When the CPU 40 reads the program from the ROM 41, a monitoring control unit 401, a path change processing unit 402, a communication takeover processing unit 403, and a setting processing unit 404 are formed as functions. The nonvolatile memory 23 is, for example, a flash memory, and stores a network configuration database (DB) 430 and a path information database (DB) 431.

  In the network configuration database 430, data regarding the configuration of the network A is registered. More specifically, in the network configuration database 430, information on each node in the network A and a link connecting the nodes is registered. In the route information database 431, the same contents as the route information database 331 of the route control server 3 are registered.

  The monitoring control unit 401 performs monitoring control of the destination server 1, the proxy server 2, the path control server 3, and the switch devices 6, 6a, and 6b based on the network configuration database 430 and the path information database 431. The monitoring control unit 401 instructs the route change processing unit 402, the communication takeover processing unit 403, and the setting processing unit 404 to operate.

  When the monitoring control unit 401 receives a communication path change request from the proxy server 2 via the communication port 44, the monitoring control unit 401 instructs the path change processing unit 402 to operate. Upon receiving the instruction, the route change processing unit 402 refers to the route information database 431 based on the change request, generates a packet including communication route setting information, and transmits the packet to the route control server 3 via the communication port 44. The route change processing unit 402 updates the route information database 431 based on the setting information of the communication route when receiving the notification of the completion of the change to the communication route from the route control server 3.

  When the monitoring control unit 401 receives a communication takeover request from the proxy server 2 via the communication port 44, the monitoring control unit 401 instructs the communication takeover processing unit 403 to operate. Upon receiving the instruction, the communication takeover processing unit 403 generates a packet including the takeover instruction based on the takeover request, and transmits the packet to the destination server 1 via the communication port 44. The takeover instruction includes information related to the TCP connection.

  Further, even when the route change processing unit 402 receives a communication route change request from the destination server 1 that has taken over communication with the terminal 7, the route change processing unit 402 refers to the route information database 431 based on the change request, and sets communication route setting information. A packet including the same is generated and transmitted to the route control server 3 via the communication port 44.

  The setting processing unit 404 performs initial setting on the proxy server 2 and the path control server 3 in accordance with an instruction from the monitoring control unit 401 when the network system is activated. More specifically, the setting processing unit 404 sets the destination server information 231 in the proxy server 2 and sets the communication path R1 in the path control server 3.

  FIG. 8 is a configuration diagram illustrating an example of the destination server 1. The destination server 1 includes a CPU 10, a ROM 11, a RAM 12, a nonvolatile memory 13, and a plurality of communication ports 14. The CPU 10 is connected to a ROM 11, a RAM 12, a nonvolatile memory 13, a plurality of communication ports 14, and a data bus 15 so that signals can be input and output with each other.

  The ROM 11 stores a program for driving the CPU 10. The RAM 12 functions as a working memory for the CPU 10. The communication port 14 is, for example, a network interface card, and transmits and receives packets between the management server 4 and the switch devices 6, 6a, and 6b.

  When the CPU 10 reads the program from the ROM 11, a communication takeover processing unit 101, a communication processing unit 102, a communication monitoring unit 103, and a route change request unit 104 are formed as functions. The nonvolatile memory 13 is a flash memory, for example, and stores a connection database (DB) 130.

  When the communication takeover processing unit 101 receives a takeover instruction from the management server 4 via the communication port 14, the communication takeover processing unit 101 acquires information on the TCP connection from the takeover instruction and registers it in the connection database 130. When information other than information related to the TCP connection exists as information necessary for communication with the terminal 7, the communication handover processing unit 101 also acquires the information and registers it in the connection database 130. The communication takeover processing unit 101 notifies the communication processing unit 102 that a new TCP connection has been established.

  The communication processing unit 102 is an application for providing a predetermined service to the terminal 7. When the communication processing unit 102 receives the notification from the communication takeover processing unit 101, the communication processing unit 102 reads out information related to the TCP connection from the connection database 130 and starts communication with the terminal 7. Thereby, communication with the terminal 7 is handed over from the proxy server 2 to the destination server 1.

  The communication monitoring unit 103 monitors communication with the terminal 7 after taking over communication. More specifically, the communication monitoring unit 103 detects from the communication processing unit 102 that communication from the terminal 7 is not received for a certain time by a timer. That is, the communication monitoring unit 103 detects an abnormality in communication with the terminal 7. When the communication monitoring unit 103 detects a communication abnormality, the communication monitoring unit 103 notifies the route change request unit 104 to that effect.

  Upon receiving the notification from the communication monitoring unit 103, the route change request unit 104 requests the management server 4 to change the communication route for communication with the terminal 7 via the communication port 14. The management server 4 sets a communication path in the path control server 3 based on the change request.

  More specifically, the route change request unit 104 requests the change of the communication route so that the communication addressed to the destination server 1 from the terminal 7 is received by the proxy server 2. For this reason, when an abnormality occurs in communication with the terminal 7, the destination server 1 can prevent the influence on other normal communication by causing the proxy server 2 to receive the communication.

  Next, each process in the network system will be described.

  FIG. 9 is a sequence diagram illustrating an example of the initial setting process. The setting processing unit 404 of the management server 4 transmits communication path setting information to the path control server 3. The path control unit 301 of the path control server 3 controls the communication path in the network A based on the setting information so that the communication addressed to the destination server 1 from the terminal 7 is received by the proxy server 2. More specifically, the path control unit 301 sets the flow table 630 of the switch devices 6, 6a, 6b so as to configure the communication path R1 (see S1).

  The setting processing unit 404 of the management server 4 notifies the proxy server 2 of the IP address “10.1.2.3” of the destination server 1. The proxy server 2 sets the destination server information 231 based on the notified IP address (see S2). The destination server information 231 may be set before the communication path is set.

  FIG. 10 is a sequence diagram illustrating an example of processing in the case of receiving a DoS attack. In this example, it is assumed that the terminal 7 is operated by a malicious user.

  The terminal 7 transmits a TCP connection establishment request, that is, SYN, to the destination server 1 via the external network B. Based on the flow table 630, the transfer processing unit 602 of the switch device 6a transfers SYN to the proxy server 2 along the communication path R1.

  The connection processing unit 201 of the proxy server 2 acquires information related to the TCP connection from the SYN and registers it in the connection database 230 (see S3). The connection processing unit 201 transmits SYN + ACK to the terminal 7 as a response to SYN. The transfer processing unit 602 of the switch device 6 a transfers SYN + ACK to the terminal 7 based on the flow table 630.

  However, the terminal 7 does not transmit ACK of the response signal for SYN + ACK. For this reason, the connection processing unit 201 of the proxy server 2 times out a timer for monitoring the ACK from the terminal 7 (see S4). As a result, the connection processing unit 201 detects a DoS attack (see S5).

  In this way, the proxy server 2 receives a request for establishing a connection from the terminal 7 instead of the destination server 1, and determines whether the request is a DoS attack by responding to the request.

  11 and 2 are sequence diagrams showing an example of processing when normal communication is received. In this example, it is assumed that the terminal 7 is operated by a bona fide user.

  Referring to FIG. 11, when the connection processing unit 201 of the proxy server 2 receives SYN from the terminal 7, the connection processing unit 201 acquires information on the TCP connection from the SYN and registers it in the connection database 230 (see S <b> 7). The connection processing unit 201 transmits SYN + ACK to the terminal 7 as a response to SYN.

  When receiving the SYN + ACK, the terminal 7 transmits ACK to the proxy server 2 via the switch device 6a. When the connection processing unit 201 of the proxy server 2 receives the ACK from the terminal 7, it determines that the SYN from the terminal is not a DoS attack, establishes a TCP connection (see S <b> 8), and communicates with the terminal 7. However, if the connection processing unit 201 receives from the terminal 7 a communication that can only be answered by the destination server 1, the connection processing unit 201 suspends the response.

  Referring to FIG. 12, the route change request unit 202 of the proxy server 2 reads the destination server information (see S <b> 9), so that the communication addressed to the destination server 1 from the terminal 7 is received by the destination server 1. The management server 4 is requested to change the communication path. The route change processing unit 402 of the management server 4 instructs the route control server 3 to set a communication route based on the change request.

  The route control server 3 changes the communication route from the route R1 to the route R2 in accordance with the instruction. In other words, the route control server 3 changes the communication route in response to a request from the proxy server 2. The switch devices 6, 6a, and 6b change the setting of the flow table 630 according to the control from the path control server 3 (see S10). When the setting change of the flow table 630 is completed, the switch devices 6, 6 a, and 6 b transmit a change completion notification to the management server 4 via the path control server 3.

  Further, the communication takeover request unit 203 of the proxy server 2 reads information on the TCP connection from the connection database 230 (see S11), and transmits the information to the management server 4 in a communication takeover request. The communication takeover processing unit 403 of the management server 4 instructs the destination server 1 to take over communication based on the takeover request. The communication takeover processing unit 101 of the proxy server 2 takes over the communication with the terminal 7 from the proxy server 2 based on the information regarding the TCP connection included in the takeover instruction (see S12).

  As described above, when the communication from the terminal 7 is normal, the proxy server 2 changes the communication path so that the communication from the terminal 7 is received by the destination server 1, and the information regarding the TCP connection is transmitted to the destination server 1. Take over communication by sending. Therefore, since the destination server 1 only needs to process normal communication, the DoS attack is protected without affecting normal communication. The communication takeover request may be made at the same time as the communication path change request or before the communication path change request.

  FIG. 13 is a flowchart illustrating an example of the operation of the proxy server 2 when receiving a packet. The connection processing unit 201 determines whether the packet is addressed to the destination server 1 by comparing the destination IP address of the received packet with the destination server information 231 (step St1). If the packet is not addressed to the destination server 1 (No in step St1), the connection processing unit 201 discards the packet (PKT) (step St6) and ends the process.

  When the packet is addressed to the destination server 1 (Yes in step St1), the connection processing unit 201 determines whether the packet is SYN (step St2). When the packet is SYN (Yes in step St2), the connection processing unit 201 registers information related to the TCP connection in the connection database 130 (step St3).

  Next, the connection processing unit 201 transmits SYN + ACK to the terminal 7 (step St4). Next, the connection processing unit 201 executes an attack determination process for determining whether SYN from the terminal 7 is a DoS attack (Step St5). The attack determination process will be described later.

  If the packet is not SYN (No in step St2), the connection processing unit 201 determines whether the packet is ACK (step St7). If the packet is not an ACK (No in step St7), the connection processing unit 201 performs an appropriate communication process (step St11). At this time, as described above, the connection processing unit 201 suspends the response when receiving communication from the terminal 7 that can only be responded to by the destination server 1.

  If the packet is ACK (Yes in step St7), the connection processing unit 201 determines that SYN is not a DoS attack and establishes a TCP connection (step St8). Next, the route change request unit 202 requests the route control server 3 to change the communication route via the management server 4 (step St9).

  Next, the communication takeover request unit 203 requests the destination server 1 to take over communication via the management server 4 (step St10). As a result, information regarding the TCP connection is transmitted to the destination server 1. In this way, the proxy server 2 operates.

  FIG. 14 is a flowchart illustrating an example of DoS attack determination processing (step St5 in FIG. 13). This process is performed concurrently with the operation shown in FIG.

  First, the connection processing unit 201 starts a timer for monitoring ACK from the terminal 7 (step St21). Next, the connection processing unit 201 determines whether or not an ACK has been received from the terminal 7 (step St22). When the connection processing unit 201 receives an ACK (Yes in step St22), the connection processing unit 201 stops the timer (step St25) and ends the process.

  If the ACK is not received (No in Step St22), the connection processing unit 201 determines whether the timer has timed out (Step St23). That is, the connection processing unit 201 determines whether or not a predetermined time has elapsed after responding to SYN from the terminal 7.

  If the timer has not timed out (No in step St23), the connection processing unit 201 performs the determination process in step St22 again. Further, when the timer times out (Yes in step St23), the connection processing unit 201 detects a DoS attack (step St24) and ends the process. In this way, the DoS attack determination process is performed.

  FIG. 15 is a sequence diagram illustrating an example of processing when a communication abnormality is detected. The communication monitoring unit 103 of the destination server 1 detects a communication error when the communication from the terminal 7 is not received for a certain period of time after taking over the communication from the proxy server 2 (see S21).

  The route change request unit 104 of the destination server 1 requests the management server 4 to change the communication route so that the proxy server 2 receives communication addressed to the destination server 1 from the terminal 7. The route change processing unit 402 of the management server 4 instructs the route control server 3 to set a communication route based on the change request.

  The route control server 3 changes the communication route from the route R2 to the route R1 in accordance with the instruction. In other words, the route control server 3 changes the communication route in response to a request from the destination server 1. The switch devices 6, 6a, and 6b change the setting of the flow table 630 according to the control from the path control server 3 (see S22). When the setting change of the flow table 630 is completed, the switch devices 6, 6 a, and 6 b transmit a change completion notification to the management server 4 via the path control server 3.

  FIG. 16 is a flowchart illustrating an example of the operation of the destination server 1. The communication processing unit 102 of the destination server 1 determines whether or not communication from the terminal 7 has ended (step St31). The communication processing unit 102 determines the end of communication by detecting the FIN flag of the received packet.

  When the communication is completed (Yes in step St31), the communication processing unit 102 releases the TCP connection (step St35). If communication has not ended (No in step St31), the communication monitoring unit 103 determines whether communication has not been received from the terminal 7 for a certain period of time (step St32). The communication monitoring unit 103 monitors the presence / absence of communication from the terminal 7 using, for example, a timer.

  When communication is received from the terminal 7 (No in step St32), the communication processing unit 102 performs the determination process in step St31 again. If the communication is not received from the terminal 7 for a certain time (Yes in step St32), the communication monitoring unit 103 detects an abnormality in communication with the terminal 7 (step St33).

  Next, the route change request unit 104 requests the route control server 3 to change the communication route (step St34). In this way, the destination server 1 operates.

  As described above, the network system according to the embodiment includes the destination server 1 that is the communication destination of the terminal 7, the proxy server 2 connected to the same network A as the destination server 1, and the path control server 3. . The route control server 3 controls the communication route in the network A so that the communication addressed to the destination server 1 from the terminal 7 is received by the proxy server 2.

  The proxy server 2 receives a request for establishing a TCP connection from the terminal 7 instead of the destination server 1, and determines whether the request is a DoS attack by responding to the request. If the proxy server 2 determines that the request is not a DoS attack, the proxy server 2 establishes a TCP connection and communicates with the terminal 7, and the destination server 1 receives the communication addressed to the destination server 1 from the terminal 7. As described above, the communication path is requested to be changed, and information related to the TCP connection is transmitted to the destination server 1.

  The path control server 3 changes the communication path in response to a request from the proxy server 2, and the destination server 1 takes over communication with the terminal 7 from the proxy server 2 based on the information regarding the TCP connection received from the proxy server 2.

  According to the above configuration, when the request of the terminal 7 is not a DoS attack, the path control server 3 changes the communication path from the terminal 7 to the communication path R2 from the communication path R1 reaching the proxy server 2 to the destination server 1. Change to For this reason, communication from the terminal 7 is received by the proxy server 2 before the TCP connection is established, and is received by the destination server 1 after the TCP connection is established.

  Further, when the request from the terminal 7 is not a DoS attack, the proxy server 2 transmits information related to the connection to the destination server 1. The destination server 1 takes over communication with the terminal 7 from the proxy server 2 based on the information regarding the connection received from the proxy server 2. For this reason, the destination server 1 can communicate with the terminal 7 using the connection established by the proxy server 2.

  Since the proxy server 2 receives communication from the terminal 7 and takes over only normal communication that is not a DoS attack to the destination server 1, the destination server 1 does not receive a DoS attack communication from the terminal 7 and is normal. Only communication can be received. Therefore, the network system according to the embodiment can prevent a DoS attack without affecting normal communication.

  In the DoS attack defense method according to the embodiment, the route control server 3 is the proxy server 2 connected to the same network A as the destination server 1 of the communication destination of the terminal 7 and is addressed to the destination server 1 from the terminal 7. The communication path in the network A is controlled so that the communication is received.

  The proxy server 2 receives a request for establishing a TCP connection from the terminal 7 instead of the destination server 1, and determines whether the request is a DoS attack by responding to the request. If the proxy server 2 determines that the request is not a DoS attack, the proxy server 2 establishes a TCP connection and communicates with the terminal 7, and the destination server 1 receives the communication addressed to the destination server 1 from the terminal 7. As described above, the communication path is requested to be changed, and information related to the TCP connection is transmitted to the destination server 1.

  The path control server 3 changes the communication path in response to a request from the proxy server 2, and the destination server 1 takes over communication with the terminal 7 from the proxy server 2 based on the information regarding the TCP connection received from the proxy server 2.

  Since the DoS attack defense method according to the embodiment includes the same configuration as the network system described above, the same effects as those described above can be obtained.

  The above-described embodiment is an example of a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.

In addition, the following additional notes are disclosed regarding the above description.
(Supplementary note 1) a first server that is a communication destination of the terminal;
A second server connected to the same network as the first server;
A path control server for controlling a communication path in the network so that communication addressed to the first server from the terminal is received by the second server;
The second server is
In place of the first server, a request for establishing a connection is received from the terminal,
Determining whether the request is a DoS attack by responding to the request;
If it is determined that the request is not a DoS attack,
Establish the connection and communicate with the terminal;
Requesting the route control server to change the communication route so that communication addressed to the first server from the terminal is received by the first server;
Sending information about the connection to the first server;
The path control server changes the communication path in response to a request from the second server,
The network system, wherein the first server takes over communication with the terminal from the second server based on the information related to the connection received from the second server.
(Supplementary note 2) The network system according to supplementary note 1, wherein the second server is connected to a boundary between the external network to which the terminal is connected and the network.
(Supplementary note 3) If the second server does not receive a response signal from the terminal within a predetermined time after responding to the request, the second server determines that the request is a DoS attack. The network system described in 1.
(Supplementary Note 4) After the first server takes over the communication with the terminal from the second server, when the communication from the terminal is not received for a certain period of time, the first server receives the first from the terminal. Requesting the change of the communication path so that the communication addressed to the server is received by the second server;
The network system according to any one of appendices 1 to 3, wherein the path control server changes the communication path in response to a request from the first server.
(Supplementary Note 5) The route control server is a second server connected to the same network as the first server with which the terminal communicates, so that the communication addressed to the first server is received from the terminal. Control the communication path,
The second server is
In place of the first server, a request for establishing a connection is received from the terminal,
Determining whether the request is a DoS attack by responding to the request;
If it is determined that the request is not a DoS attack,
Communicating with the terminal by establishing the connection;
Requesting the route control server to change the communication route so that communication addressed to the first server from the terminal is received by the first server;
Sending information about the connection to the first server;
The path control server changes the communication path in response to a request from the second server,
The DoS attack defense method, wherein the first server takes over communication with the terminal from the second server based on information on the connection received from the second server.
(Supplementary note 6) The DoS attack protection method according to supplementary note 5, wherein the second server is connected to a boundary between the external network to which the terminal is connected and the network.
(Supplementary note 7) If the second server does not receive a response signal from the terminal within a predetermined time after responding to the request, the second server determines that the request is a DoS attack. 2. A DoS attack protection method according to 1.
(Supplementary Note 8) After the first server takes over communication with the terminal from the second server, if the communication from the terminal is not received for a certain period of time, the first server receives the first from the terminal. Requesting the change of the communication path so that the communication addressed to the server is received by the second server;
The DoS attack protection method according to any one of appendices 5 to 7, wherein the path control server changes the communication path in response to a request from the first server.

DESCRIPTION OF SYMBOLS 1 Destination server 2 Proxy server 3 Path control server 4 Management server 6, 6a, 6b Switch apparatus 7 Terminal A Network B External network

It is a block diagram which shows an example of a network system. It is a block diagram which shows an example of a switch apparatus. It is a figure which shows an example of a flow table. (A) is a figure which shows an example of the flow table of an initial state. (B) is a figure which shows an example of the flow table at the time of a route change. It is a block diagram which shows an example of a route control server. It is a block diagram which shows an example of a proxy server. It is a figure which shows an example of a connection database. It is a block diagram which shows an example of a management server. It is a block diagram which shows an example of a destination server. It is a sequence diagram which shows an example of an initial setting process. It is a sequence diagram which shows an example of the process at the time of receiving a DoS attack. It is the sequence diagram (the 1) which shows an example of the process at the time of receiving normal communication. It is a sequence diagram (the 2) which shows an example of a process at the time of receiving normal communication. It is a flowchart which shows an example of the operation | movement at the time of the packet reception of a proxy server. It is a flowchart which shows an example of the determination process of DoS attack. It is a sequence diagram which shows an example of a process when a communication abnormality is detected. It is a flowchart which shows an example of operation | movement of a destination server.

Claims (5)

A first server that is a communication destination of the terminal;
A second server connected to the same network as the first server;
A path control server for controlling a communication path in the network so that communication addressed to the first server from the terminal is received by the second server;
The second server is
In place of the first server, a request for establishing a connection is received from the terminal,
Determining whether the request is a DoS attack by responding to the request;
If it is determined that the request is not a DoS attack,
Establish the connection and communicate with the terminal;
Requesting the route control server to change the communication route so that communication addressed to the first server from the terminal is received by the first server;
Sending information about the connection to the first server;
The path control server changes the communication path in response to a request from the second server,
The network system, wherein the first server takes over communication with the terminal from the second server based on the information related to the connection received from the second server.   The network system according to claim 1, wherein the second server is connected to a boundary between the external network to which the terminal is connected and the network.   The said 2nd server determines with the said request | requirement being a DoS attack, when not receiving a response signal from the said terminal within a predetermined time after responding to the said request | requirement. Network system. When the first server takes over communication with the terminal from the second server and communication from the terminal is not received for a certain period of time, the first server sends communication to the first server from the terminal. Requesting the change of the communication path so that the second server receives it,
The network system according to claim 1, wherein the path control server changes the communication path in response to a request from the first server. The path control server controls the communication path in the network so that the communication addressed to the first server from the terminal is received by the second server connected to the same network as the first server with which the terminal communicates And
The second server is
In place of the first server, a request for establishing a connection is received from the terminal,
Determining whether the request is a DoS attack by responding to the request;
If it is determined that the request is not a DoS attack,
Communicating with the terminal by establishing the connection;
Requesting the route control server to change the communication route so that communication addressed to the first server from the terminal is received by the first server;
Sending information about the connection to the first server;
The path control server changes the communication path in response to a request from the second server,
The DoS attack defense method, wherein the first server takes over communication with the terminal from the second server based on information on the connection received from the second server.

Images