JP3581345B2 - Packet transfer device and packet transfer method - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a packet transfer device and a packet transfer method for controlling transfer of a packet between a plurality of network segments.
[0002]
[Prior art]
2. Description of the Related Art In recent years, a filter type IDS device (IDS: intrusion detection system intrusion detection system) has attracted attention as a packet transfer device for controlling packet transfer between a plurality of network segments.
[0003]
This filter-type IDS device analyzes data carried by a received packet and determines whether or not the packet is related to unauthorized access. In the packet data analysis processing, a database in which known patterns relating to unauthorized access are registered is referred to, and it is determined whether or not a received packet corresponds thereto. A received packet determined to be a packet related to an unauthorized access by this analysis processing is discarded without being transferred. Thereby, intrusion of an illegal packet can be prevented beforehand, and a certain level of security can be ensured.
[0004]
In the conventional filter type IDS device, the above-described analysis processing is performed on all the received packets, and it is determined whether or not the received packet is a packet related to an unauthorized access.
[0005]
[Problems to be solved by the invention]
By the way, in general, in a communication system that performs communication via a packet switching network, a response confirmation is transmitted when a packet is received on a receiving side, and the packet arrives at a receiving side by a response confirmation from the receiving side. If this cannot be confirmed, the reliability of communication is ensured by, for example, transmitting (retransmitting) the packet again. When the above-described filter-type IDS device is used in such a communication system, the filter-type IDS device determines that the received packet is a packet related to unauthorized access and discards the received packet. Therefore, the same packet is transmitted again by retransmission.
[0006]
In the conventional filter-type IDS device, the content of the data transmitted from the retransmission packet is analyzed in the same manner as the packet transmitted first. However, the same data as the data carried by the retransmission packet has already been analyzed, and re-analyzing the data content consumes CPU resources of a system used as a filter type IDS device. Therefore, when unauthorized access occurs frequently, a large number of retransmission packets are sent, and there is a problem that the performance of packet transfer is reduced.
[0007]
The present invention has been made in view of the above circumstances, and has as its object to provide a packet transfer device and a packet transfer method capable of efficiently prohibiting transfer of a packet related to an unauthorized access.
[0008]
[Means for Solving the Problems]
In order to solve the above-mentioned problem, a packet transfer device of the present invention is a packet transfer device for controlling transfer of a packet between a plurality of network segments, wherein the packet reception device receives a packet on a network segment; Packet holding means for temporarily holding the received packet received in step 1, connection identification information storage means for registering connection identification information of a packet determined to be a packet related to unauthorized access, and a received packet received by the packet receiving means. First determining means for determining whether or not the connection identification information of the received packet is registered in the connection identification information storage means, and determining whether or not the packet is related to unauthorized access; and connection identification information of the received packet. Is the connection identification information If it is determined not to be registered in the unit analyzes the data of the received packet, a second determination means for determining whether the received packet is a packet related to unauthorized access or normal packets, A past packet holding unit that holds the analyzed packet analyzed by the second determination unit as a past packet; and a past packet holding unit that holds the received packet and the same connection identification information as the received packet. Connection data reconstructing means for reconstructing a series of data which is divided into a plurality of packets and carried by the past packet, A packet analysis unit having a unit that registers connection identification information of the received packet in the connection identification information storage unit when it is determined that the packet is related to unauthorized access by data analysis of the received packet; and A packet sending unit that discards a packet related to the unauthorized access among the received packets temporarily held in the packet holding unit based on the determination result, and sends only a normal received packet to a destination network segment; Equipped with The second determining means includes means for analyzing data reconstructed by the connection data reconstructing means for data analysis of the received packet. It is characterized by the following.
[0009]
Further, the packet transfer device of the present invention is a packet transfer device for controlling transfer of a packet between a plurality of network segments, wherein the packet transfer device receives a packet on the network segment, and temporarily stores the packet received by the packet reception device. Packet holding means for holding, connection identification information storage means for registering connection identification information of a packet determined to be a packet related to unauthorized access, and connection identification information of a received packet received by the packet receiving means, Analysis result holding means having first determination means for determining whether or not the packet is related to unauthorized access by determining whether or not the packet is registered in the identification information storage means; Packets related to unauthorized access When receiving the determination result of whether or not the connection identification information of the received packet is not registered in the connection identification information storage means, analyze the data of the received packet using an unauthorized access database, Second determining means for determining whether the received packet is a packet relating to a normal packet or a packet relating to an unauthorized access; and, when data analysis of the received packet determines that the received packet is a packet relating to an unauthorized access, connection identification of the received packet. Packet data analysis means having means for registering information in the connection identification information storage means, past packet holding means for holding the analyzed packets analyzed by the packet data analysis means as past packets, and the past packet holding means Obtained by referring to the above From the past packet having the same connection identification information as the transmitted packet, a series of data divided into a plurality of packets and carried is reconstructed, and the reconstructed data is used as analysis data by the second determination means. Based on the determination result of the provided connection data reconstructing means and the packet data analyzing means, of the received packets temporarily held in the packet holding means, a packet related to the unauthorized access is discarded and normal reception is performed. Packet transmitting means for transmitting only a packet to a destination network segment.
[0010]
In this packet transfer device, for a received packet determined by the packet analysis unit to be a packet related to unauthorized access, the connection identification information of the received packet is stored in the connection identification information storage unit as the analysis result of the packet data analysis. be registered. Thereafter, the received packet having the same connection identification information as the connection identification information is discarded without determining whether or not the packet is related to an unauthorized access by data analysis. Therefore, even if a large number of retransmission packets related to the unauthorized access are sent, it is possible to prohibit the transfer of the packet related to the unauthorized access without lowering the performance of the packet transfer.
[0011]
Here, the connection identification information is not merely address information but means identification information commonly assigned to each of a plurality of packets carrying a series of data in each session for each session. If a configuration in which only address information in a packet such as a source address and a destination address is registered is used, packet filtering is performed on a physical network node basis such as a terminal or a server. Packet transmission from a terminal determined to have transmitted the packet or from all terminals under NAT (Network Address Translation) will be prohibited at any time thereafter. On the other hand, when the connection identification information is used, packet filtering can be realized for each session between a user who has requested a certain service and a server which provides the service.
[0012]
For example, in TCP, a combination of a source address and port number and a destination address and port number included in a packet is the connection identification information.
[0013]
In addition, a past packet holding unit that holds a packet whose data has been analyzed as a past packet and a past packet that has the same connection identification information as the received packet obtained from the past packet holding unit and the received packet is used. Accordingly, it is preferable to further provide a connection data reconstructing means for reconstructing a series of data that is divided and carried in a plurality of packets.
[0014]
As a result, based on the data content of a plurality of packets carrying a series of data having the same connection identification information, including not only individual data of the received packet but also analyzed past packets, the received packet is a packet related to unauthorized access. , It is possible to further improve the accuracy of packet data analysis, and to improve security performance.
[0015]
In this case, if the packet analysis unit exchanges the packet analysis unit for the purpose of responding to an increase in the types of unauthorized access to be determined if the packet analysis unit holds the analyzed packet inside, the packet is processed before the exchange. The data content of the analyzed past packet is lost. If an attack is performed by using data divided into a plurality of packets straddling before and after the exchange, the attack cannot be detected, and as a result, unauthorized access cannot be prevented. Therefore, as described above, it is preferable that the analyzed past packet holding unit and the connection data reconstructing unit are provided separately from the packet data analyzing unit. As a result, even when the packet data analysis means is exchanged, the analyzed packet processed before the exchange can be held, and the data can be reconstructed based on the analyzed packet. Specifically, the packet analysis means may be configured as a module independent of the past packet holding means and the connection data restructuring means so that the packet data analysis means can be exchanged alone.
[0016]
Further, since the connection data restructuring means reconstructs data using the connection identification information, the connection data restructuring means has determined by analysis of the packet data that the packet is related to an unauthorized access. Means for storing connection identification information of the received packet, and before reconstructing the data, determine whether the received packet has connection identification information held in the connection identification information storage means, By providing a means for notifying the determination result to the packet data analysis means, the connection management function of the connection data restructuring means can be more effectively utilized.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows a packet transfer device according to one embodiment of the present invention. The packet transfer device 11 controls the transfer of packets between a plurality of network segments, and is used, for example, as a network connection device such as a bridge, router, gateway, NAT (Network Address Translation), or the like. The packet transfer device 11 has a security function using a filter type IDS, and analyzes data carried by the received packet to determine whether or not the packet is related to unauthorized access. Hereinafter, the configuration of the packet transfer apparatus 11 will be described by exemplifying a case in which packet filtering for permitting or prohibiting packet transfer from the network segment A to the network segment B is performed.
[0018]
As shown, the packet transfer device 11 includes a packet receiving unit 101, a packet identifier adding mechanism 102, a packet holding queue 103, a packet analyzing mechanism 104, and a packet sending unit 105.
[0019]
The packet receiving unit 101 receives a packet transmitted on the network segment A. The packet identifier adding unit 102 adds an identifier to the received packet received by the packet receiving unit 101, and outputs the packet to the packet holding queue 103 and the packet analyzing unit 104. The packet holding queue 103 temporarily holds the received packet to which the identifier has been added until the packet analysis mechanism 104 determines that the packet is not a packet related to unauthorized access.
[0020]
The packet analysis mechanism 104 analyzes the data carried in the received packet by the built-in packet data analysis unit 111 and checks whether or not the data corresponds to a known pattern related to unauthorized access. It is determined whether the packet is related to the unauthorized access, and the identifier of the packet determined not to be the packet related to the unauthorized access is transmitted to the packet transmitting unit 105. The packet data analysis unit 111 analyzes the contents of the header and the payload included in the data carried by the received packet, and reconstructs the data carried by being divided by a plurality of packets having the same connection identification information. For example, protocol processing for shaping the data into a form convenient for analysis is performed as needed, and it is determined whether or not the reconstructed data includes a pattern related to unauthorized access.
[0021]
When the packet analyzing unit 104 receives again a packet having the same connection identification information as the received packet once determined to be a packet related to an unauthorized access, the packet analyzing unit 104 analyzes the received packet without performing data analysis. It has a function to determine that the packet is related to access. To realize this function, the packet analysis mechanism 104 is provided with an unauthorized connection table 112.
[0022]
In the unauthorized connection table 112, as a result of the packet data analysis by the packet data analysis unit 111, the connection identification information of the received packet determined to be the packet related to the unauthorized access is registered. Upon receiving a packet from the packet identifier adding mechanism 102, the packet analyzing mechanism 104 first checks whether or not the connection identification information of the received packet has already been registered in the unauthorized connection table 112. The packet is determined to be a packet related to unauthorized access at that time. In this case, the analysis process by the packet data analysis unit 111 is not performed.
[0023]
Here, the connection identification information registered as a packet data analysis result in the unauthorized connection table 112 means identification information commonly assigned to each of a plurality of packets carrying a series of data in each session. . If only address information such as a source address and a destination address is used, packet filtering is performed on a physical network node basis such as a terminal or a server, so, for example, from a terminal once determined to have transmitted an invalid packet, Will be banned after that. In particular, once a packet transferred via NAT is once determined to be a packet related to unauthorized access, access from all terminals connected to the network via NAT is prohibited. On the other hand, when the connection identification information is used, packet filtering can be realized for each session between a user who has requested a certain service and a server that provides the service, and the above-described problem does not occur. .
[0024]
For example, in TCP, a combination of a source address and port number and a destination address and port number included in a packet is connection identification information. The port number is, for example, a pair between the application program in the terminal requesting the service and the server program in the server providing the service between the terminal specified by the source address and the server specified by the destination address. It is used to tie together. The port number assigned to the application program in the terminal is changed every time the network is connected, and is dynamically assigned when the application program connects to the server. Therefore, for example, assuming that a certain terminal accesses a server by starting a specific program and receives a specific service provided by the server, a series of data is transferred from the terminal to the server during the access period. , A common connection identifier is assigned to each of the plurality of packets, and a common connection identifier is assigned to a plurality of packets for carrying a series of data from the server to the terminal. Therefore, by using such identification information for connection identification, access prohibition control is not performed for a physical network node such as a terminal or a server, but for a user who has requested a service and a server that provides the service. , Access prohibition control can be realized in session units.
[0025]
Even when using a connectionless transfer protocol such as UDP, a common connection identification information is added to each packet carrying data from a source to a destination by a higher-level protocol for each session. Access prohibition control.
[0026]
When the packet transmitting unit 105 receives the identifier of the received packet determined to be the packet related to the unauthorized access from the packet analyzing unit 104, the packet transmitting unit 105 discards the received packet from the packet holding queue 103, When the received packet identifier is determined not to be a packet related to unauthorized access, the received packet is taken out from the packet holding queue 103 and sent out onto the network segment B.
[0027]
FIG. 2 shows an example of a specific configuration of the packet analysis mechanism 104.
[0028]
The packet analysis mechanism 104 includes an unauthorized connection determination mechanism 113, an unauthorized connection table 112, and a packet data analysis unit 111. The unauthorized connection determination unit 113 receives the packet input to the packet analysis unit 104, refers to the unauthorized connection table 112, and if the input packet is registered in the unauthorized connection table 112, the packet data analysis unit 111 , The input packet is determined to be a packet related to an unauthorized access, and the packet is output to the packet analysis mechanism 104.
[0029]
The packet data analysis unit 111 includes a protocol processing unit 201 and an unauthorized access database 202. The unauthorized access database 202 is a database that stores information on known unauthorized access, and stores various patterns related to unauthorized access. While searching the unauthorized access database 202, the protocol processing unit 201 determines whether the packet received by the packet receiving unit 101 is a packet related to an unauthorized access.
[0030]
Next, the operation of the packet transfer device 11 of FIGS. 1 and 2 will be described with reference to the flowchart of FIG.
[0031]
First, the packet transmitted on the network segment A is received by the packet receiving unit 101 of the packet transfer device 11 (Step S101). A unique identifier is added to this received packet in the packet transfer apparatus 11 by the packet identifier adding mechanism 102, and the received packet with the identifier is stored in the packet holding queue 103 and passed to the packet analyzing mechanism 104. It is.
[0032]
First, the packet analysis mechanism 104 determines the connection identification information of the received packet (step S102). That is, the unauthorized connection table 112 is searched by the unauthorized connection determination mechanism 113 based on the connection identification information of the received packet, and it is determined whether or not the received packet is a packet having the connection identification information registered in the unauthorized connection table 112. It is determined (steps S103 and S104).
[0033]
If the received packet has the connection identification information registered in the unauthorized connection table 112, the unauthorized connection determination unit 113 does not pass the packet to the packet data analysis unit 111 and determines that the packet is related to an unauthorized access. It is determined that there is a packet, and an identifier that is an unauthorized access packet is transmitted to the packet sending unit 105. As a result, the packet stored in the packet holding queue 103 is discarded without being sent (step S109).
[0034]
On the other hand, when the unauthorized connection determination mechanism 113 determines that the connection identification information of the received packet is not registered in the unauthorized connection table 112, the packet is passed to the packet data analysis unit 111. The packet data analysis unit 111 analyzes the data in the packet and performs a packet data analysis process to determine whether the packet is a normal packet or a packet related to an unauthorized access (step S105). If the packet data analysis processing does not detect that the packet is related to unauthorized access, the packet analysis mechanism 104 determines that the packet is a normal packet and transmits the identifier of the packet to the packet transmission unit 105. The packet transmitting unit 105 to which the identifier has been transmitted extracts the received packet having the identifier from the packet holding queue 103 and places it on a network segment (here, network segment B) of a destination different from the network segment that received the packet. It is sent (step S107).
[0035]
On the other hand, if it is determined that the packet is related to unauthorized access, the packet data analysis unit 111 registers the connection identification information of the packet in the unauthorized connection table 112 (step S108). Then, the identifier of the packet determined to be related to the unauthorized access is transmitted from the packet analysis unit 104 to the packet transmission unit 105, and the packet stored in the packet holding queue 103 is discarded without being transmitted. (Step S109). The packet may be discarded not only by an explicit instruction but also by implicit means such as overflow from the packet holding queue 103.
[0036]
By performing this series of operations each time a packet is received, even if a large number of retransmission packets are sent due to frequent unauthorized access, the packet transfer related to the unauthorized access can be performed without lowering the packet transfer performance. Transfer can be prohibited.
[0037]
Next, a specific example of the packet data analysis processing performed in step S105 will be described with reference to the flowcharts of FIGS.
[0038]
In the packet data analysis process, it is first determined whether or not the combination of the header field option and the parameter satisfies a known condition set in advance as causing a malfunction in a packet transmission destination server for a received packet. (Step S11). That is, a process is performed to discriminate that the packet is transmitted from a suspicious partner or a suspicious packet of a different format from the header of the received packet. Here, if the above condition is satisfied, the received packet is determined to be a packet related to unauthorized access, and an instruction is given to discard the received packet (step S15).
[0039]
On the other hand, if the above condition is not satisfied, it is next determined whether or not information of another packet such as a fragmented packet or a packet transferred by the TCP protocol is necessary for the determination (step S12). . If no other packet is required, the length of the data carried next by the packet, or the combination of parameters specified by the data, is set in advance as causing a malfunction to the application or the like that processes the data. It is determined whether the known condition is satisfied (step S13). Here, if the above condition is satisfied, the received packet is determined to be a packet related to unauthorized access, and an instruction is given to discard the received packet (step S15).
[0040]
On the other hand, if the above condition is not satisfied, the packet transmission unit 105 is instructed to forward the received packet with the received packet as a packet to be transmitted (step S14).
[0041]
When it is determined in step S12 that information of another packet is also necessary, the received packet is a fragmented packet and is held in the packet analysis mechanism 104 as an analyzed packet. It is determined whether or not a known condition preset as causing a malfunction to the server is satisfied, such as whether or not the data area overlaps with another fragmented packet that has been transmitted (FIG. 5 step S21). Here, if the above condition is satisfied, the received packet is determined to be a packet related to unauthorized access.
[0042]
On the other hand, if the above condition is not satisfied, then, the received packet is a TCP packet and is held in the packet analysis mechanism 104 as an analyzed packet. It is determined whether or not a known condition preset as causing a malfunction in the server, such as whether or not the packet overlaps the data area, is satisfied (step S22). Here, if the above condition is satisfied, the received packet is determined to be a packet related to unauthorized access.
[0043]
On the other hand, if the above-mentioned condition is not satisfied, next, as many as necessary past transmitted packets having the same connection identification information as the received packet, which are held as packets already analyzed in the packet analysis mechanism 104. Is used to reconstruct stream data having a length sufficient for analysis (step S23). Then, it is determined whether the length of the data carried by the reconstructed data stream or whether the parameter specified by the data satisfies a known condition preset as causing a malfunction ( Step S24). Here, if the above condition is satisfied, the received packet is determined to be a packet related to unauthorized access, and if not, it is determined not to be a packet related to unauthorized access.
[0044]
As described above, in the packet analysis processing by the packet data analysis unit 111, the data carried by the received packet is analyzed from various viewpoints, and thus the packet data analysis unit 111 determines that the packet is related to unauthorized access. Received connection packet, the connection identification information of the received packet is registered in the unauthorized connection table 112, and thereafter, the received packet having the same connection identification information as the connection identification information is immediately illegal without performing packet analysis processing. By determining that the packet is related to access, it becomes possible to efficiently detect a packet related to unauthorized access with a small load.
[0045]
When the function of reconstructing data using the analyzed past packet is provided in the packet data analysis unit 111, the packet data is analyzed for the purpose of responding to an increase in the types of unauthorized access to be determined. When the analysis unit 111 is replaced with a new version, the contents of past packets are lost. Therefore, it is preferable that the function relating to data reconstruction and the packet data analysis function be realized as modules independent of each other. . FIG. 6 shows a configuration example in this case.
[0046]
As shown in FIG. 6, the packet analysis mechanism 104 includes a packet data analysis unit 111, a connection data restructuring unit 203, and a past packet storage unit 204. The packet data analysis unit 111 has a protocol processing unit 201 and an unauthorized access database 202, and divides the packet into a plurality of packets having the same connection identification information reconstructed by the connection data reconstruction unit 203 as necessary. It has a function of searching the unauthorized access database 202 while referring to data that has been corrupted, analyzing data carried by the packet, and determining whether or not the packet is a packet related to unauthorized access.
[0047]
The connection data reconstructing unit 203 has a function of reconstructing data carried by being divided into a plurality of packets having the same connection identification information and passing the data to the packet data analyzing unit 111. The past packet storage unit 204 is for storing past packets that have already been analyzed by the packet data analysis unit 111 and have been sent to the destination network segment. Data of past packets that have been received before the received packet and that have been analyzed are accumulated. The past packet storage unit 204 has a function of providing a past analyzed packet having designated connection identification information to the connection data reconstructing unit 203 in response to a request from the connection data restructuring unit 203.
[0048]
In the packet analysis mechanism 104 shown in FIG. 6, for a packet passed to the packet data analysis unit 111, a combination of options and parameters of a header part of the packet, a combination of a length of data carried by the packet and a parameter designated by data. Is determined whether or not the condition of the known unauthorized access registered in the unauthorized access database 202 is satisfied. At this time, the protocol processing unit 201 performs protocol processing according to the type of data carried by the packet as needed. If the data carried by the packet is a part of the data divided and carried in a plurality of packets having the same connection identification information, the protocol processing unit 201 A packet having the same connection identification information is extracted from the analyzed packets stored in the packet storage unit 204 and received before receiving the packet, and reconstructed.
[0049]
At this time, if all the packets carrying the divided data have not been received yet, only the packet stored in the past packet storage unit 204 and the portion that can be constructed from the received packet are reconstructed. The protocol processing unit 201 determines whether the combination of the length of the data reconstructed in this way and the designated parameter satisfies the condition of the known unauthorized access registered in the unauthorized access database 202.
[0050]
Here, a case is considered where the packet data analysis unit 111 is exchanged for the purpose of responding to an increase in the types of unauthorized access to be determined while not receiving all the packets carrying the divided data.
[0051]
After the exchange of the packet data analysis unit 111, if a packet having the same connection identification information is subsequently received and passed to the packet data analysis unit 111, the protocol processing unit 201 A packet having the same connection identification information is extracted from packets received in the storage unit 204 and received before receiving the packet, and reconstructed. Since the packets received before the exchange of the packet data analysis unit 111 are also stored in the past packet storage unit 204, the determination is made in a state where all the packets carrying the divided data have not been received. Even if the packet data analysis unit 111 is exchanged for the purpose of responding to an increase in the types of unauthorized access to be performed, the connection data restructuring unit 203 can correctly reconstruct the data.
[0052]
The data reconstructed halfway by the connection data reconstructing unit 203 is retained in the connection data reconstructing unit 203 in the form of a cache. If the retained reconstructed data exists in the connection data reconstructing unit 203, It is also possible to use it instead of packet data stored in the past packet storage unit 204. In this way, even if an attack is performed by data divided into a plurality of packets straddling before and after the exchange, it is possible to detect the attack and discard the packet.
[0053]
FIG. 7 is a configuration example when the configuration in FIG. 6 is applied to the packet analysis mechanism 104 in FIG.
[0054]
In the packet analysis mechanism 104 shown in FIG. 7, the function of the unauthorized connection determination mechanism 113 shown in FIG. That is, the analysis result holding unit 205 having the unauthorized connection table 112 is provided, and the protocol processing unit 201 of the packet data analysis unit 111 notifies the analysis result holding unit 205 that the connection identification information of the received packet is already invalid. An inquiry is made as to whether or not the packet has the same identification information as the packet determined to be a packet. Based on the inquiry result, it is determined whether or not it is necessary to perform packet data analysis processing.
[0055]
The analysis result holding unit 205 has a function of registering, in response to a request from the packet data analysis unit 111, connection identification information of a received packet determined to be a packet related to an unauthorized access in the unauthorized connection table 112. In response to the inquiry from the analysis unit 111, it is determined whether the same connection identification information as the requested connection identification information is registered with reference to the unauthorized connection table 112, and the determination result is compared with the packet data analysis unit 111. Has a function to notify.
[0056]
Next, the operation of the packet transfer apparatus 11 when the packet analysis mechanism 104 of FIG. 7 is used will be described with reference to the flowchart of FIG. Note that the configuration of the basic unit is shown in FIG.
[0057]
First, the packet on the network segment A is received by the packet receiving unit 101 of the packet transfer device 11 (Step S201). The received packet is added with a unique identifier in the packet transfer device 11 by the packet identifier adding mechanism 102, and the received packet with the identifier is stored in the packet holding queue 103 and is also sent to the packet analyzing mechanism 104. Passed. In the packet analysis mechanism 104, first, the protocol processing unit 201 determines the connection identification information of the received packet (step S202), and determines whether the connection identification information has already been registered as the connection identification information of the packet related to the unauthorized access. An inquiry is made to the analysis result holding unit 205 (step S203).
[0058]
The analysis result holding unit 205 searches the unauthorized connection table 112 according to the inquiry from the protocol processing unit 201, and notifies the protocol processing unit 201 of the search result. Based on this notification, the protocol processing unit 201 determines whether or not the received packet is a packet having connection identification information registered in the unauthorized connection table 112 (Step S204).
[0059]
If the received packet has the connection identification information registered in the unauthorized connection table 112 (Yes in step S204), the protocol processing unit 201 performs the unauthorized access on the packet without performing the packet data analysis process on the packet. This fact is transmitted to the packet transmitting unit 105 using the identifier of the packet as an analysis output of the packet analysis mechanism 104. As a result, the packet stored in the packet holding queue 103 is discarded without being sent (step S210).
[0060]
On the other hand, if the received packet does not have the connection identification information registered in the unauthorized connection table, the protocol processing unit 201 analyzes the data of the packet and determines whether or not the packet is related to an unauthorized access. A packet data analysis process for determination is performed (step S205). In this packet data analysis processing, if necessary, the connection data restructuring unit 203 is requested to reconstruct data, and a received packet to be analyzed and a past analyzed packet having the same identification information as the received packet are used. Data is reconstructed. Then, the unauthorized access database 202 is referred to based on the reconstructed data.
[0061]
If the packet data analysis processing determines that the packet is not related to unauthorized access, the packet analysis unit 104 stores the analyzed received packet in the past packet storage unit 204. (Step S207) Then, the identifier added to the packet is transmitted to the packet transmitting unit 105. The packet transmitting unit 105 to which the identifier has been transmitted extracts the packet having the identifier from the packet holding queue 103 and transmits the packet to the network segment B (step S208).
[0062]
On the other hand, if the packet data analysis processing determines that the packet is related to unauthorized access, the connection identification information of the packet is sent to the analysis result holding unit 205 and registered in the unauthorized connection table 112 ( Step S209). Then, the packet analysis mechanism 104 transmits the identifier of the packet determined to be an unauthorized access to the packet sending unit 105. As a result, the packet stored in the packet hold queue 103 is discarded without being transmitted from the packet transmission unit 105 (step S210).
[0063]
FIG. 9 is a configuration example of the packet analysis mechanism 104 when the analysis result holding unit 205 is included in the connection data restructuring unit 203.
[0064]
The packet data analysis unit 111 requests the connection data reconstructing unit 203 to reconstruct data that is divided and carried into a plurality of packets having the same connection identification information as the received packet to be analyzed. A function of acquiring from the connection data restructuring unit 203 whether or not a packet having the same connection identification information as the connection identification information of the received packet has been determined in the past to be related to unauthorized access; If the connection identification information of the received packet has not been determined to be related to unauthorized access in the past, refer to the reconstructed data divided into multiple packets with the same connection identification information and carried. , Search the unauthorized access database 202 and retrieve the data carried by the received packet. It analyzes, with function of determining whether the packet or not related to unauthorized access.
[0065]
The connection data restructuring unit 203 determines whether the packet having the same connection identification information as the connection identification information of the received packet to be analyzed, which is stored in the analysis result holding unit 205, is related to an unauthorized access in the past. It has a function of referring to the information on whether or not unauthorized access has been determined, and notifying the packet data analysis unit 111 of the fact that unauthorized access has been determined. It has a function of reconstructing data that is divided into a plurality of packets having the same connection identification information and carried while referring to past packets having the same connection identification information stored in the storage unit 204.
[0066]
Next, the operation of the connection data restructuring unit 203 executed when a data restructuring request is received from the packet data analyzing unit 111 illustrated in FIG. 9 will be described with reference to the flowchart in FIG.
[0067]
When the connection data reconstructing unit 203 receives from the packet data analyzing unit 111 a request to reconstruct data that is divided into a plurality of packets having the same connection identification information as the received packet and is carried, first, the received packet is reassembled. Is obtained (step S301). Before performing the data restructuring process, referring to the connection identification information of the packet, which is held in the analysis result holding unit 205 in the past and has been determined to be a packet related to unauthorized access, and matches the connection identification information specified by the packet. It is determined whether or not the connection identification information is stored in the analysis result storage unit 205 (step S302). If the same connection identification information as the connection identification information of the received packet is held, the connection data restructuring unit 203 immediately notifies the packet data analyzing unit 111 that the received packet is a packet related to an unauthorized access. (Step S303).
[0068]
On the other hand, if the same connection identification information as the acquired connection identification information is not held, the connection data restructuring unit 203 stores the past analyzed packet having the same connection identification information as the received packet in the past packet storage unit. It reconstructs the data taken out of the packet 204 and divided into a plurality of packets having the same connection identification information as the received packet, and notifies the packet data analyzing unit 111 of the reconstructed data (steps S304 and S305).
[0069]
As described above, the analysis result holding unit 205 is provided in the connection data restructuring unit 203, and has the same connection identification information as that of the packet that has already been determined to be a packet related to unauthorized access as well as the data restructuring process. The determination as to whether or not is also performed in the connection data restructuring unit 203 enables efficient processing with a small number of components.
[0070]
Each component of the packet transfer device 11 described above can be realized by dedicated hardware, a DSP, or the like, and can also be realized as a program executed on a computer. In this case, for example, by executing a program having the function of the above-described packet transfer device 11 on a specific computer connected between network segments, the same effect as that realized as a dedicated device can be easily realized. I can do it. Even when the functions of the packet transfer device 11 are realized by a computer program, the packet data analysis unit 111 should be realized as a program module independent of the connection data restructuring unit 203 and the past packet storage unit 204. Is preferred. Further, the function of the packet transfer device 11 can be realized as a computer program for detecting and preventing intrusion of an unauthorized packet from a network to a program in the computer in the computer connected to the network.
[0071]
Further, the present invention is not limited to the above-described embodiment, and can be variously modified in an implementation stage without departing from the gist thereof. Further, the embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, even if some components are deleted from all the components shown in the embodiment, the problem described in the column of the problem to be solved by the invention can be solved, and the effects described in the column of the effect of the invention can be solved. Is obtained, a configuration from which this configuration requirement is deleted can be extracted as an invention.
[0072]
【The invention's effect】
As described above, according to the present invention, when a packet having connection identification information stored as a packet related to unauthorized access in the connection identification information storage unit is received, unauthorized access is immediately performed without performing data analysis. Therefore, it is possible to efficiently prohibit unauthorized access.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a packet transfer device according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration example of a packet analysis mechanism provided in the packet transfer device of FIG. 1;
FIG. 3 is a flowchart illustrating the operation of the packet transfer device of FIG. 1;
FIG. 4 is a flowchart showing a part of a procedure of a packet data analysis process in the packet transfer device of FIG. 1;
FIG. 5 is a flowchart showing the remaining part of the procedure of the packet data analysis process in the packet transfer device of FIG. 1;
FIG. 6 is a block diagram showing another example of the configuration of the packet analysis mechanism provided in the packet transfer device of FIG. 1;
FIG. 7 is a block diagram showing still another configuration example of the packet analysis mechanism provided in the packet transfer device of FIG. 1;
FIG. 8 is a flowchart illustrating the operation of the packet transfer device using the packet analysis mechanism of FIG. 7;
FIG. 9 is a block diagram showing another configuration example of the packet analysis mechanism provided in the packet transfer device of FIG. 1;
FIG. 10 is a flowchart illustrating a process of a connection data restructuring unit provided in the packet analysis mechanism of FIG. 9;
[Explanation of symbols]
11 ... Packet transfer device
101: Packet receiving unit
102: Packet identifier adding mechanism
103: Packet hold queue
104: Packet analysis mechanism
105: Packet sending unit
111: Packet data analysis unit
112 ... Illegal connection table
113 ... Unauthorized connection determination mechanism
201: Protocol processing unit
202: Unauthorized access database
203: Connection data restructuring unit
204: Past packet storage unit
205: Analysis result holding unit

Claims (15)

In a packet transfer device that controls transfer of a packet between a plurality of network segments,
Packet receiving means for receiving packets on the network segment;
Packet holding means for temporarily holding the received packet received by the packet receiving means,
A connection identification information storage unit in which connection identification information of a packet determined to be a packet related to an unauthorized access is registered, and a connection identification information of a received packet received by the packet receiving unit is registered in the connection identification information storage unit. First determining means for determining whether the packet is related to unauthorized access, and determining that connection identification information of the received packet is not registered in the connection identification information storage means. In this case, a second determining unit that analyzes data of the received packet to determine whether the received packet is a normal packet or a packet related to an unauthorized access, and an analysis analyzed by the second determining unit. Past packet holding means for holding completed packets as past packets A connection for reconstructing a series of data divided into a plurality of packets and carried by the received packet and the past packet held in the past packet holding means having the same connection identification information as the received packet. Packet analysis means having data restructuring means and means for registering connection identification information of the received packet in the connection identification information storage means when it is determined by the data analysis of the received packet that the packet is related to unauthorized access; ,
Based on the result of the determination by the packet analysis unit, of the received packets temporarily held in the packet holding unit, the packet related to the unauthorized access is discarded, and only the normal received packet is sent to the destination network segment. ; and a packet sending means for,
The packet transfer device according to claim 2, wherein said second determining means includes means for analyzing data reconstructed by said connection data reconstructing means for data analysis of said received packet . The packet transfer device according to claim 1, wherein the connection identification information is identification information commonly assigned to each of a plurality of packets carrying a series of data in the session for each session. 2. The packet transfer device according to claim 1, wherein the connection identification information includes a combination of a source address and a port number and a destination address and a port number included in the packet. 2. The packet transfer device according to claim 1, wherein the connection identification information storage unit and the first determination unit of the packet analysis unit are configured as independent analysis result holding units. The second determination means has an unauthorized access database in which known unauthorized access conditions are registered in order to perform data analysis, and the packet data analysis means is independent of the unauthorized access database and the second determination means. The packet transfer device according to claim 1, wherein 2. The packet transfer device according to claim 1, wherein the past packet holding unit and the connection data restructuring unit are configured as independent modules. 2. The packet transfer device according to claim 1, wherein said connection data restructuring means includes said connection identification information storage means and said first determination means. In a packet transfer device that controls transfer of a packet between a plurality of network segments,
Packet receiving means for receiving packets on the network segment;
Packet holding means for temporarily holding the packet received by the packet receiving means,
Connection identification information storage means for registering connection identification information of a packet determined to be a packet related to unauthorized access, and reception received by the packet reception means Analysis result holding means having first determination means for determining whether or not connection identification information of a packet is registered in the connection identification information storage means and determining whether or not the packet is related to unauthorized access; ,
When a determination result as to whether or not the packet is related to an unauthorized access is received from the analysis result holding unit, and it is determined that the connection identification information of the received packet is not registered in the connection identification information storage unit, an unauthorized Second determining means for analyzing the data of the received packet using an access database to determine whether the received packet is a normal packet or a packet related to an unauthorized access; Packet data analysis means having means for registering the connection identification information of the received packet in the connection identification information storage means,
Past packet holding means for holding the analyzed packet analyzed by the packet data analyzing means as a past packet,
From a past packet obtained by referring to the past packet holding means and having the same connection identification information as the received packet, a series of data divided into a plurality of packets and carried is reconstructed, and the reconstructed Connection data restructuring means for providing data as analysis data to the second determination means;
Based on the result of the determination by the packet data analysis unit, of the received packets temporarily held in the packet holding unit, the packet related to the unauthorized access is discarded, and only the normal received packet is sent to the destination network segment. Packet sending means to send
A packet transfer device comprising: 9. The packet transfer device according to claim 8, wherein said analysis result holding means is provided in said connection data restructuring means. In a packet transfer method for controlling transfer of a packet between a plurality of network segments,
A packet receiving step of receiving a packet on the network segment;
A packet holding step of temporarily holding the received packet received in the packet receiving step in a packet holding unit;
It is determined whether or not the connection identification information of the received packet received in the packet receiving step is already registered in the connection identification information storage unit in which the connection identification information of the packet determined to be a packet related to unauthorized access is registered. And determining whether the packet is related to unauthorized access,
If it is determined that the connection identification information of the received packet is not registered in the connection identification information storage means, the data of the received packet is analyzed and the received packet is determined to be a normal packet or a packet related to an unauthorized access. A packet data analysis step of determining whether there is
Holding the analyzed packet analyzed by the packet data analysis step as a past packet;
A connection data reconstructing step of reconstructing a series of data that is divided into a plurality of packets and carried by the received packet and the past packet having the same connection identification information as the received packet;
Registering the connection identification information of the received packet in the connection identification information storage means, when the data analysis by the packet data analysis step determines that the packet is related to unauthorized access;
Of receiving packets temporarily held in the packet holding unit, discarding a received packet determined to be a packet related to the illegal packet, and transmitting only a packet determined to be a normal packet to a destination network segment;
With
The packet data analyzing step includes a step of analyzing data reconstructed by the connection data reconstructing step for data analysis of the received packet. A packet transfer method, characterized in that: 11. The packet transfer method according to claim 10, wherein the connection identification information is identification information commonly assigned to each of a plurality of packets carrying a series of data in the session for each session. 11. The packet transfer method according to claim 10, wherein the connection identification information includes a combination of a source address and port number and a destination address and port number included in the packet. In a packet transfer method for controlling transfer of a packet between a plurality of network segments,
A packet receiving step of receiving a packet on the network segment;
Temporarily holding the packet received by the packet receiving step in packet holding means,
It is determined whether or not the connection identification information of the received packet received in the packet receiving step is already registered in the connection identification information storage unit in which the connection identification information of the packet determined to be a packet related to unauthorized access is registered. A first determining step of determining whether the packet is related to an unauthorized access;
Receiving the result of the determination as to whether or not the packet is related to unauthorized access in the first determining step, and determining that the connection identification information of the received packet is not registered in the connection identification information storage means, A second determining step of analyzing data of the received packet using an access database and determining whether the received packet is a normal packet or a packet related to an unauthorized access;
Registering the connection identification information of the received packet in the connection identification information storage means, when it is determined by the data analysis of the received packet is a packet related to unauthorized access,
Holding the analyzed packet analyzed in the second determination step in a past packet holding unit;
From a past packet obtained by referring to the past packet holding means and having the same connection identification information as the received packet, a series of data divided into a plurality of packets and carried is reconstructed, and the reconstructed Providing data to the second determination step as data for analysis;
Discarding a packet related to the unauthorized access among the received packets temporarily held in the packet holding unit, and sending only a normal received packet to a destination network segment;
A packet transfer method comprising: A program for causing a computer to control transfer of packets between a plurality of network segments,
A packet receiving procedure for receiving packets on the network segment;
Temporarily holding the received packet received in the packet receiving step in a packet holding means,
It is determined whether or not the connection identification information of the received packet received by the packet reception procedure is already registered in the connection identification information storage unit in which the connection identification information of the packet determined to be a packet related to unauthorized access is registered. And determining whether the packet is related to unauthorized access,
If it is determined that the connection identification information of the received packet is not registered in the connection identification information storage means, the data of the received packet is analyzed and the received packet is determined to be a normal packet or a packet related to an unauthorized access. Packet data analysis procedure for determining whether there is
A procedure for holding the analyzed packet analyzed by the packet data analysis procedure as a past packet,
The received packet and the past packet having the same connection identification information as the received packet. A connection data reconstructing procedure for reconstructing a series of data that is divided into a plurality of packets and carried by the packet,
A step of registering the connection identification information of the received packet in the connection identification information storage unit when it is determined by the data analysis by the packet data analysis procedure that the packet is related to unauthorized access;
A step of discarding, among the received packets temporarily held in the packet holding unit, a received packet determined to be a packet related to the illegal packet, and transmitting only the packet determined to be a normal packet to a destination network segment. And let the computer execute
The program, wherein the packet data analysis procedure includes a procedure of analyzing data reconstructed by the connection data reconstruction procedure for analyzing data of the received packet. A program for causing a computer to control transfer of packets between a plurality of network segments,
A packet receiving procedure for receiving packets on the network segment,
A procedure for temporarily holding packets received by the packet receiving procedure in a packet holding unit,
It is determined whether or not the connection identification information of the received packet received by the packet reception procedure is already registered in the connection identification information storage unit in which the connection identification information of the packet determined to be a packet related to unauthorized access is registered. A first determination procedure for determining whether the packet is related to unauthorized access,
When receiving the determination result of whether or not the packet is related to unauthorized access in the first determination procedure and determining that the connection identification information of the received packet is not registered in the connection identification information storage means, A second determination procedure for analyzing data of the received packet using an access database and determining whether the received packet is a normal packet or a packet related to an unauthorized access;
A step of registering the connection identification information of the received packet in the connection identification information storage means when it is determined by the data analysis of the received packet that the packet is related to unauthorized access;
Holding the analyzed packet analyzed in the second determination procedure in a past packet holding unit;
From a past packet obtained by referring to the past packet holding means and having the same connection identification information as the received packet, a series of data divided into a plurality of packets and carried is reconstructed, and the reconstructed Providing data to the second determination procedure as data for analysis;
A step of discarding a packet related to the unauthorized access among the received packets temporarily held in the packet holding unit, and transmitting only the normal received packet to a destination network segment.
A program that causes a computer to execute.

Images