CN112291378B

CN112291378B - Address management device and address management method

Info

Publication number: CN112291378B
Application number: CN202010649367.1A
Authority: CN
Inventors: 太田贵彦
Original assignee: Azbil Corp
Current assignee: Azbil Corp
Priority date: 2019-07-25
Filing date: 2020-07-08
Publication date: 2023-05-19
Anticipated expiration: 2040-07-08
Also published as: JP2021022774A; CN112291378A; JP7359586B2; KR20210012947A; KR102394674B1

Abstract

The present invention is to more easily grasp the setting status of an IPv6 address of a terminal device connected to a network. The address management device (1) is provided with: a transmission unit (10) that performs all-node multicast transmission of an RA packet via a Network (NW), and performs all-node multicast transmission of an MLQ packet as an inquiry packet regarding a joining status to a multicast group via the Network (NW); a receiving unit (13) that receives an MLR packet as a response packet to the MLQ packet; and a first determination unit (14) that determines whether or not an IPv6 address is set in the terminal devices (2, 3) on the basis of the multicast address of the requesting node of the multicast group to which the terminal devices (2, 3) that are included in the MLR packet and that identify the source of the MLR packet have joined in response to the reception of the RA packet.

Description

Address management device and address management method

Technical Field

The present invention relates to an address management device and an address management method, and more particularly, to an address management technique in an IPv6 environment.

Background

In recent years, with the popularity of IoT, various devices are connected to the internet. With this, the number of devices connected to the internet has also been increasing explosively, and is migrating from IPv4, which has been used as an internet protocol in the past, to IPv6, which is a new protocol having an address length of 128 bits. Among various network security products such as network monitoring devices, products supporting IPv6 are also rapidly demanded.

For example, patent document 1 discloses a technique for preventing illegal connection to a network in an IPv6 environment. In the technique described in patent document 1, a monitoring device is provided in a network, monitors NS (Neighbor Solicitation, neighbor solicitation message) packets flowing in the network, and determines whether or not the network is a terminal device permitted to connect to the network based on a source address and a MAC address of the NS packets.

[ Prior Art literature ]

[ patent literature ]

Patent document 1: japanese patent laid-open No. 2007-104396

Disclosure of Invention

Problems to be solved by the invention

However, in the technique described in patent document 1, even if a survey packet is transmitted to a terminal device connected to a network and not set an IPv6 address, the terminal device is not returned because the IPv6 address is not set. Therefore, it is difficult to grasp a terminal device not having an IPv6 address set, for example, for illegal access to a network for the purpose of interception. In particular, if the terminal device is a terminal device for eavesdropping or the like, the terminal device does not transmit the data packet itself, and therefore it is more difficult to detect the data packet.

The present invention has been made to solve the above-described problems, and an object of the present invention is to more easily grasp the setting status of an IPv6 address of a terminal apparatus connected to a network.

Means for solving the problems

In order to solve the above problems, an address management device of the present invention includes: a first transmission unit configured to multicast all nodes of the router advertisement packet via the communication network; a second transmission unit configured to multicast all nodes via the communication network with respect to an inquiry packet regarding a joining status to a multicast group; a receiving unit configured to receive a response packet to the inquiry packet; and a first determination unit configured to determine whether or not an IPv6 address is set in the terminal device, based on a first address of a first multicast group that the terminal device, which is included in the response packet and identifies a transmission source of the response packet, joins based on reception of the router advertisement packet.

The address management device according to the present invention may further include a determination unit configured to determine the number of IPv6 addresses set in the terminal device based on the response packet.

In the address management device according to the present invention, the determination unit may determine the number of IPv6 addresses set in the terminal device based on the first address included in the response packet and the second address identifying the second multicast group that is another multicast group to which the terminal device is added.

In the address management device according to the present invention, the second address may be a multicast address of the requesting node.

In the address management apparatus according to the present invention, the terminal apparatus may further include a second determination unit configured to determine that the terminal apparatus for which the first determination unit determines that the IPv6 address is not set is not permitted to connect to the communication network.

In the address management device according to the present invention, the first address may be a multicast address of the requesting node.

In the address management device according to the present invention, the address management device may further include a display device configured to display the determination result of the first determination unit on a display screen.

In order to solve the above problems, an address management method of the present invention includes: the first step, multicast transmission of all nodes is carried out on the router advertisement data packet through a communication network; a second step of multicast-transmitting all nodes of an inquiry packet concerning a joining status to a multicast group via the communication network after the first step; a third step of receiving a response packet to the inquiry packet; and a fourth step of determining whether or not an IPv6 address is set in the terminal device, based on a first address of a first multicast group to which the terminal device, which is included in the response packet and identifies a source of the response packet, joins based on the router advertising reception of the packet.

ADVANTAGEOUS EFFECTS OF INVENTION

According to the present invention, it is determined whether or not the IPv6 address is set in the terminal device based on the first address of the first multicast group, which identifies the terminal device to join with the router advertisement packet transmitted by multicast by all the nodes, and therefore, the setting status of the IPv6 address can be grasped more easily.

Drawings

Fig. 1 is a block diagram showing the configuration of a network system including an address management device according to an embodiment of the present invention.

Fig. 2 is a block diagram showing the configuration of the address management device according to the embodiment.

Fig. 3 is a block diagram showing a hardware configuration of the address management device according to the embodiment.

Fig. 4 is a flowchart for explaining an address management method of the embodiment.

Fig. 5 is a sequence diagram showing the operation of the network system according to the embodiment.

Fig. 6 is a block diagram showing the configuration of an address management device according to modification 1 of the present embodiment.

Fig. 7 is a block diagram showing the configuration of an address management device according to modification 2 of the present embodiment.

Detailed Description

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to fig. 1 to 7.

[ construction of network System ]

First, an outline of the address management device 1 according to the embodiment of the present invention will be described.

The address management device 1 according to the embodiment of the present invention grasps the setting status of the IPv6 addresses of the

terminal devices

2, 3 connected via the network NW such as LAN. The address management device 1 is provided in a network system shown in fig. 1, for example.

As shown in fig. 1, the network system includes an address management device 1 and

terminal devices

2 and 3 that are communicably connected to each other via a network NW. In the present embodiment, it is assumed that the IPv6 address is automatically set in the network NW without any status.

The

terminal apparatuses

2 and 3 are terminals such as IPv 6-running PCs. It is assumed that the plurality of terminal apparatuses 2 shown in fig. 1 are terminals permitted to connect to the network NW, and IPv6 addresses are set in advance. On the other hand, it is assumed that the terminal device 3 is a terminal to which connection of the network NW is not permitted, and the IPv6 address is not set.

In the present embodiment, the address management device 1 detects that an IPv6 address is set in the terminal device 2 and that an IPv6 address is not set in the terminal device 3 on the same network segment local to the link.

Specifically, the address management device 1 multicasts all nodes with a router advertisement (Router Advertisement:ra) packet of ICMPv6 via the network NW. The Router Advertisement (RA) is a structure in which a router notifies a device of a network to which the router belongs of address information, network settings, and the like through an IPv6 network. The RA packet is used as part of a stateless auto-setup function for the IPv6 router to auto-setup IPv6 addresses.

The

terminal devices

2 and 3 that have received the RA packet calculate the respective IPv6 addresses based on the information of the RA packet, and transmit other Neighbor Solicitation (NS) packets that do not use the same address to the network NW. If there is no reply to the NS packet transmitted by the

terminal device

2, 3, the IPv6 address is newly set in the

terminal device

2, 3.

Furthermore, the address management apparatus 1 multicast-transmits all nodes based on the General Query in Multicast Listener Query (MLQ) of the ICMPv6 Multicast Listener Discorvery (MLD) message type 130. The MLQ is a message for querying the listener by the router whether there is a multicast group that it wants to receive. In addition, general Query is a Query for investigating which multicast group is involved for all listeners existing within the link local scope.

The

terminal devices

2 and 3 that have received the MLQ packet transmit a response packet for reporting a multicast address identifying the multicast group to which the

terminal devices

2 and 3 each have joined to the address management device 1 of the transmission source. The reply packet is Multicast Lietener Report (MLR) based on the MLD message type 131 of ICMPv 6.

The MLR packets received by the address management device 1 from the

terminal devices

2 and 3 contain the multicast address of the requesting node. The requesting node multicast address is a multicast address that is added to the destination address within the IPv6 header at the time of sending the NS. Further, the requesting node multicast address is calculated from the unicast address, anycast address assigned to the interface.

That is, the

terminal apparatuses

2 and 3 become members of at least one multicast address of the requesting node based on the IPv6 address set in response to the reception of the RA packet multicast-transmitted by all the nodes of the address management apparatus 1.

The request node multicast address is composed of a unicast address, a lower 24 bits of any broadcast address, and a terminal device having the same lower 24 bits must join the same multicast address. In addition, when a unicast address or an anycast address is given to the

terminal devices

2 and 3 in addition to a unicast or anycast address given based on RA packets multicast-transmitted by all nodes of the address management device 1, there is a request node multicast address corresponding to the unicast or anycast address.

The multicast address can also be easily distinguished from the requesting node by having an address range of [ FF02::1FF00:0000] to [ FF02::1FFFF: FFFF ]. One of the features of the address management device 1 of the present embodiment is to determine whether or not the IPv6 address is set in the

terminal devices

2 and 3 based on at least one request node multicast address included in the MLR packet received from the

terminal devices

2 and 3 as a response to the MLQ packet.

[ functional Block of Address management device ]

As shown in fig. 2, the address management device 1 includes, for example, a transmitting unit (first transmitting unit, second transmitting unit) 10, a generating unit 11, a storing unit 12, a receiving unit 13, and a first determining unit 14.

The transmitting unit 10 performs multicast transmission of all nodes to the RA packet via the network NW. Specifically, the transmitting unit 10 can transmit RA packets having [ FF 02:1 ] as a transmission destination at a predetermined period. For example, the transmitting unit 10 can perform multicast transmission of all nodes on an RA packet including the prefix information generated by the generating unit 11 and destined for [ FF 02:1 ].

The transmitting unit 10 multicast-transmits all nodes via the network NW with the MLQ packet of the General Query as an inquiry packet concerning the joining status to the multicast group. Specifically, the transmitting unit 10 can transmit an MLQ packet having [ FF 02:1 ] as a transmission destination at a predetermined period. For example, the transmitting unit 10 can perform multicast transmission of all nodes on the MLQ packet generated by the generating unit 11 and destined for [ FF 02:1 ].

The generating unit 11 generates a multicast packet including an RA packet and an MLQ packet multicast-transmitted from all nodes of the transmitting unit 10.

The storage unit 12 stores information included in the MLR packets received from the

terminal devices

2 and 3. The storage unit 12 stores the determination result of the first determination unit 14.

The receiving unit 13 receives an MLR packet as a response packet to the MLQ packet. In the present embodiment, as shown in fig. 1, the reception unit 13 receives the MLR packets from the

terminal devices

2 and 3.

The first determination unit 14 determines whether or not the IPv6 address is set in the

terminal devices

2, 3 based on the request node multicast address (first address) included in the MLR packet, which is the request node multicast address of the multicast group (first multicast group) to which the

terminal devices

2, 3 that are the transmission sources of the MLR packet join in response to receiving the RA packet.

Here, the multicast addresses identifying all the multicast groups to which the

terminal devices

2, 3 join are reported in the MLR packet. When the multicast addresses of the requesting nodes included in the MLR packet are 1, the first determination unit 14 determines that the IPv6 addresses are not set in the

terminal devices

2 and 3 that are the transmission sources of the MLR packet. On the other hand, when the multicast addresses of the requesting nodes included in the MLR packet are not less than 1, that is, not less than 2, it is determined that the IPv6 addresses are set in the

terminal devices

2 and 3 that are the transmission sources of the MLR packet.

Further, as described above, the requesting node multicast address is generated by adding the lower 24 bits (lower 3 bytes) of the IPv6 address to the prefix local to the link. Based on this, the first determination unit 14 can determine the multicast address of the requesting node included in the MLR packet.

[ hardware configuration of Address management device ]

Next, an example of the hardware configuration of the address management device 1 having the above-described function will be described with reference to fig. 3.

As shown in fig. 3, the address management device 1 can be realized by a computer including a processor 102, a main storage device 103, a communication interface 104, a secondary storage device 105, and an input/output I/O106 connected via a bus 101, and a program for controlling these hardware resources, for example.

The main memory 103 stores therein programs for the processor 102 to perform various controls and operations. The functions of the address management device 1 such as the generation unit 11 and the first determination unit 14 shown in fig. 2 are realized by the processor 102 and the main storage device 103.

The communication interface 104 is an interface circuit for connecting the address management device 1 to the

terminal devices

2 and 3 and various external electronic devices via a network.

The auxiliary storage device 105 is configured by a readable and writable storage medium and a drive device for reading and writing various information such as programs and data from and to the storage medium. The secondary storage device 105 may use a semiconductor memory such as a hard disk or a flash memory as a storage medium.

The auxiliary storage device 105 has a program storage area in which the address management device 1 determines whether or not a program for an IPv6 address is set in the

terminal devices

2 and 3. The storage unit 12 described in fig. 2 is realized by the auxiliary storage device 105. Further, for example, a backup area for backing up the data, programs, and the like may be provided.

The input/output I/O106 is constituted by an I/O terminal to which a signal from an external device is input or to which a signal is output.

The display device 107 is constituted by a liquid crystal display or the like. The display device 107 can display the determination result of the first determination unit 14 on the display screen.

[ Address management method ]

Next, the operation of the address management device 1 having the above-described configuration will be described with reference to the flowchart of fig. 4.

First, the transmitting unit 10 performs all-node multicast transmission of the RA packet via the network NW (step S1). More specifically, the transmitting unit 10 performs all-node multicast transmission of the RA packet, thereby dynamically setting a new IPv6 address for all the

terminal devices

2 and 3 in the network system.

Next, the transmitting unit 10 performs multicast transmission of all nodes to the MLQ packet via the network NW (step S2). Thereafter, the receiving unit 13 receives the MLR packet as a response packet from the

terminal devices

2 and 3 that received the MLQ packet (step S3).

Next, when the multicast address of the requesting node included in the MLR packet is 1 (yes in step S4), the first determination unit 14 determines that the IPv6 address is not set in the

terminal devices

2 and 3 that are the transmission sources of the MLR packet (step S5).

On the other hand, when the multicast addresses of the requesting nodes included in the MLR packet are not less than 1, that is, not less than 2, it is determined that the IPv6 addresses are set in the

terminal devices

2 and 3 that are the transmission sources of the MLR packet (step S6).

[ action of network System ]

Next, the operation of the network system having the above configuration will be described with reference to the sequence diagram of fig. 5.

First, the address management device 1 multicast-transmits all nodes an RA packet addressed to [ FF 02:1 ] (step S100). The terminal device 2 receives the RA packet, acquires prefix information included in the RA packet, and sets an IPv6 address by stateless setting (step S101). On the other hand, the terminal device 3 sets the IPv6 address by the stateless setting as well (step S102).

Then, the address management device 1 multicasts all nodes with the MLQ packet of the General Query destined to [ FF 02:1 ] (step S103). The terminal device 2 that has received the MLQ packet transmits the MLR packet including the multicast addresses of all the multicast groups to which the terminal device 2 has joined to the address management device 1 (step S104). For example, the terminal device 2 transmits an MLR packet including a request node multicast address corresponding to an IPv6 address set based on the RA packet from the address management device 1, for example, including 3 request node multicast addresses.

On the other hand, the terminal apparatus 3 transmits an MLR packet including only one request node multicast address corresponding to the IPv6 address set based on the RA packet from the address management apparatus 1 to the address management apparatus 1 (step S106).

Since there are a plurality of request node multicast addresses in the MLR packet received from the terminal device 2, the address management device 1 determines that the IPv6 address is set in the terminal device 2 (step S105). On the other hand, since only one request node multicast address exists in the MLR packet received from the terminal apparatus 3, the address management apparatus 1 determines that the IPv6 address is not set in the terminal apparatus 3 (step S107).

As described above, according to the address management device 1 of the first embodiment, all nodes multicast transmission is performed on RA packets in advance, and a new IPv6 address is set in the

terminal devices

2 and 3 on the network NW. Further, all nodes multicast transmission is performed on the MLQ packets of all multicast groups to which each

terminal device

2, 3 on the inquiry network NW has joined. Since the address management device 1 determines the request node multicast address included in the MLR packet, which is a response packet received from the

terminal devices

2 and 3 on the network NW, it is possible to more easily grasp whether or not the IPv6 address is set in the

terminal devices

2 and 3.

In addition, according to the address management device 1 of the first embodiment, it is not necessary to provide new software in the

terminal devices

2 and 3 on the network NW, and the setting state of the IPv6 address in the

terminal devices

2 and 3 on the network NW can be grasped with a simpler configuration.

The setting status of the IPv6 address in the

terminal devices

2 and 3 on the network NW grasped by the address management device 1 of the first embodiment can be used for various security measures in the IPv6 environment.

Modification 1

Next, modification 1 of the above embodiment will be described. In the following description, the same components as those of the above embodiment are denoted by the same reference numerals, and the description thereof is omitted.

In the embodiment described above, the first determination unit 14 determines whether or not the IPv6 address is set in the

terminal devices

2 and 3 on the network NW. In contrast, the address management device 1A according to modification 1 determines whether or not the

terminal devices

2 and 3 are permitted to connect to the network NW, based on the determination result of the first determination unit 14.

As shown in fig. 6, the address management device 1A includes a transmitting unit 10, a generating unit 11, a storage unit 12, a receiving unit 13, a first determining unit 14, and a second determining unit 15. The configuration other than the second determination unit 15 is the same as that of the first embodiment.

The second determination unit 15 determines the terminal device 3 for which the first determination unit 14 determines that the IPv6 address is not set as an illegal terminal device for which connection to the network NW is not permitted. The second determination unit 15 can determine that the terminal device 2 determined by the first determination unit 14 as having the IPv6 address set is a legitimate terminal device permitted to connect to the network NW.

As described above, according to the address management device 1A of modification 1, the terminal device 3 for which the IPv6 address is not set is determined to be the terminal device 3 for which connection to the network NW is not permitted, using the determination result of the first determination unit 14 indicating the presence or absence of the setting of the IPv6 address. Therefore, for example, a terminal device that has not set an IPv6 address for eavesdropping purposes or the like can be easily detected.

Modification 2

Next, modification 2 of the above embodiment will be described. In the following description, the same components as those of the above embodiment are denoted by the same reference numerals, and the description thereof is omitted.

As shown in fig. 7, the address management device 1B according to modification 2 includes a transmitting unit 10, a generating unit 11, a storing unit 12, a receiving unit 13, a first determining unit 14, and a determining unit 16. The configuration other than the determination unit 16 is the same as that of the embodiment described above.

The determination unit 16 determines the number of IPv6 addresses set in the

terminal devices

2 and 3 based on the MLR packet received by the reception unit 13. As described above, the transmitting unit 10 performs multicast transmission of all nodes on the RA packet in advance. Thus, the IPv6 address is newly set in the

terminal apparatuses

2 and 3 that have received the RA packet.

The MLR packet, which is a response packet from the

terminal devices

2 and 3 to the MLQ packet transmitted by the transmitting unit 10 to multicast all the nodes to the

terminal devices

2 and 3, includes at least one request node multicast address including a request node multicast address corresponding to the newly set IPv6 address.

The determination unit 16 determines the number of IPv6 addresses set in the

terminal devices

2 and 3 using the new IPv6 address set in the

terminal devices

2 and 3 and a multicast address (second address) identifying another multicast group (second multicast group) to which the

terminal devices

2 and 3 are added.

For example, the determination unit 16 counts the number of the request node multicast addresses included in the MLR packet, and obtains the number of IPv6 addresses set in the

terminal devices

2 and 3 by [ (the number of the request node multicast addresses) -1 ]. If the example of fig. 5 is used, the number of IPv6 addresses set in the terminal apparatus 2 is determined to be 2 (3-1=2) since the number of multicast addresses of the requesting node is 3 in the terminal apparatus 2. In addition, in the terminal apparatus 3, since the number of multicast addresses of the requesting node is 1, the number of IPv6 addresses set is determined to be 0.

As described above, according to modification 2, since the number of IPv6 addresses set in the

terminal devices

2 and 3 on the network NW can be specified, for example, the IPv6 address set in the RA packet transmitted by the malicious terminal can be detected.

While the embodiments of the address management device and the address management method according to the present invention have been described above, the present invention is not limited to the described embodiments, and various modifications that can be conceived by those skilled in the art can be made within the scope of the invention described in the claims.

Symbol description

1. 1A, 1B … address management device, 2, 3 … terminal device, 10 … transmitting unit, 11 … generating unit, 12 … storing unit, 13 … receiving unit, 14 … first determining unit, 15 … second determining unit, 16 … determining unit, 101 … bus, 102 … processor, 103 … main memory device, 104 … communication interface, 105 … auxiliary memory device, 106 … input/output I/O,107 … display device, NW … network.

Claims

1. An address management device is characterized by comprising:

a first transmission unit configured to multicast all nodes of the router advertisement packet via the communication network;

a second transmission unit configured to multicast all nodes via the communication network with respect to an inquiry packet regarding a joining status to a multicast group;

a receiving unit configured to receive a response packet to the inquiry packet; and

a first determination unit configured to determine whether or not an IPv6 address is set in the terminal device, based on a first address included in the response packet and identifying a first multicast group to which the terminal device that has transmitted the response packet has joined based on the reception of the router advertisement packet,

the first determination unit determines that an IPv6 address is not set in the terminal device when the first addresses included in the response packet are 1, and determines that an IPv6 address is set in the terminal device when the first addresses included in the response packet are 2 or more.

2. The address management apparatus according to claim 1, wherein,

the terminal device further includes a determination unit configured to determine the number of IPv6 addresses set in the terminal device based on the response packet.

3. The address management apparatus according to claim 2, wherein,

the determination unit determines the number of IPv6 addresses set in the terminal device based on the first address included in the response packet and a second address identifying a second multicast group that is another multicast group to which the terminal device has joined.

4. The address management apparatus of claim 3, wherein,

the second address is a requesting node multicast address.

5. The address management apparatus according to claim 1, wherein,

the terminal device is further provided with a second determination unit configured to determine that the terminal device for which the first determination unit has determined that the IPv6 address is not set is a terminal device for which connection to the communication network is not permitted.

6. The address management apparatus according to claim 1, wherein,

the first address is a requesting node multicast address.

7. The address management apparatus according to any one of claims 1 to 6, wherein,

the display device is configured to display the determination result of the first determination unit on a display screen.

8. An address management method is characterized by comprising:

the first step, multicast transmission of all nodes is carried out on the router advertisement data packet through a communication network;

a second step of multicast-transmitting all nodes of an inquiry packet concerning a joining status to a multicast group via the communication network after the first step;

a third step of receiving a response packet to the inquiry packet; and

a fourth step of determining whether or not an IPv6 address is set in the terminal device based on a first address included in the response packet, the first address identifying a first multicast group to which the terminal device of the transmission source of the response packet has joined, the first address being included in the router to notify reception of the packet, the terminal device being determined not to set the IPv6 address when the first address included in the response packet is 1, and the terminal device being determined to set the IPv6 address when the first address included in the response packet is 2 or more.