JP2001244996A - Method for protecting network - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the illegal intrusion into an internal network system. SOLUTION: In a network system where an external network 1 is connected to the internal networks 2 and 3, a communication access path (ID list of repeating installations) is previously set on a receiving table 40 to cover a transmitting terminal 5 through a receiving terminal 6. In an actual data transmission mode, each of repeating installations A-F adds its own ID to the data relayed by itself and then transfers them. On the network 3, an access grant/ rejection processor 4 compares the ID list added to the data with the ID list of the table 40 and rejects the reception of data transferred via the repeating installations which are not set on the table 40.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network security protection method for rejecting unauthorized third party access to a network in a wide area network system for interconnecting networks.

[0002]

2. Description of the Related Art When connecting an external network to an internal network such as an in-house system, an unauthorized access prevention mechanism such as a firewall is installed at a contact point between the external network and the internal network. The security protection has been implemented by restricting data (packets) that can access the internal network on the condition of terminal-specific information such as an address, a destination IP address, and a port number. However, with the enlargement of the communication network system and the rapid increase in the number of communication network users, so-called "crackers" for performing unauthorized access have been increasing, and terminals such as source IP address, destination IP address, port number, etc. A situation has arisen in which sufficient and efficient security cannot be implemented only by a security protection method using unique information. For example, a cracker copies the source IP address of an authenticated user, adds it to a fake message and sends the packet, so that the receiving firewall can send the message from the "cracker" as if the authenticated transmission There is an example in which an operation is performed that is mistaken for the original one.

In order to prevent such unauthorized access,
In the “network security method” described in JP-A-11-122322, a transmission-side relay device attaches access detection information and an access detection program for referencing the same in advance to a communication to be security-transmitted. A method is disclosed in which a program is executed by a relay device on the receiving side to collate access detection information, thereby preventing access from a terminal that is not relaying a relay device that has been properly registered.

[0004]

However, according to the "network security method" described in JP-A-11-122322, it is determined whether data (packets) on the network is transmitted from an authorized source. , Or whether a legitimate recipient is receiving data (packets), and is a security protection method at the "point to point" of the source and destination. Therefore, in data communication on a wide area network system that connects networks to each other, malicious and unauthorized third parties (crackers) intercept data (packets) of authenticated transmission sources on the internal network, By transmitting the data (packet) by adding the information to a fake message, the so-called "spoofing" operation is performed in which the receiving side misrecognizes a message from an unauthorized third party as authenticated information. Was difficult to adapt.

[0005] An object of the present invention is that data (packets) passing through a network is intercepted by an unauthorized third party,
It is an object of the present invention to provide a network security protection method capable of detecting an unauthorized access from a global network such as the Internet with high sensitivity even when an "impersonation" operation is performed.

[0006]

SUMMARY OF THE INVENTION According to the present invention, an unauthorized access when data is transmitted from a terminal in one internal network connected to an external network to a terminal in another internal network connected to the external network is provided. In the method for preventing network security, the ID of a relay device on an external network that is permitted to pass through for each set of a source terminal and a destination terminal is set in the internal network on the destination terminal side, and the relay device Each adds the ID of its own device to the transfer data at the time of data transfer, and in the internal network of the destination terminal side, the ID of the relay device added to the received data and the preset ID of the relay device A network characterized in that a comparison is made to determine whether or not to permit reception of the received data. It discloses a security protection method.

[0007]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 shows an example of a network provided with the security protection method of the present invention,
The Internet 1 as an external network is composed of relay devices A to H and a relay line connecting them. The internal network 2 is connected to the relay device A, and the internal network 3 is connected to the relay device E. The Internet 1 is actually a very large number of relay devices (eg, routers)
FIG. 1 shows this in a simplified manner. The internal network 3 is provided with an access permission / denial processing device 4 for controlling access permission / denial for data (packets) from the external network. This access permission / denial processing device 4
For example, it may be provided in a server of the internal network 3.

The access permission / denial processing device 4 includes:
An access path information table 40 is provided in which a source address of a data source terminal, a destination address of a data destination terminal, and access path information corresponding to both terminals are set. FIG. 2 is an example of the access route information table 40. The access route information of the access with the terminal 5 having the address X of the internal network 2 as the transmission source and the terminal 6 having the address Z of the internal network 3 as the reception destination is as follows. The relay devices E, A, D, and B are also not shown in FIG.
Access path information for access to the relay device B,
A, D, and C. However, the information stored in the actual table 40 is identification information (ID) for identifying each relay device. This access route information
It indicates that only accesses that have passed through them are permitted, regardless of the order of the descriptions. Note that the access route information may be a plurality of routes for one set of source / destination terminal addresses. The terminal address may be an IP address or a physical address, or may be other information that can identify the terminal.

On the other hand, the transmission data (packet) includes the device I
When a data (packet) is relayed, each relay device adds a device ID indicating its own relay device to the device ID list. FIG. 3 is a flowchart showing the operation, which is provided in each relay device. First, when data (packet) is received from the external network 1 (YES in step 301), the device ID list that has passed from the received data (packet) is read (step 302), and the device ID of the own relay device is stored therein.
Is added (step 303). Then, the device ID list is written to data (packet) (step 30).
4), transfer to the next relay device or server in the internal network (step 305).

FIG. 4 shows the data transferred to the internal network where the receiving terminal is located as described above.
Access permission / denial processing device 4 for determining whether or not reception is possible
6 is a flowchart showing the processing of FIG. The access permission / denial processing device 4 is installed between the external network 1 and the internal network 3 as shown in FIG. 1, and receives data (packet) addressed to the internal network 3 (YES in step 401). The device ID list added to the data (packet) is obtained (step 40).
2). Then, the obtained device ID list is compared with the access route information of FIG. 2 set in advance in the access route information table 40 (step 403), and if the information matches, the access is permitted (step 4).
04), if they do not match, the access is rejected (step 405).

In the above configuration, for example, in FIG. 1, an unauthorized third party “cracker” on another network connected to the relay device F illegally obtains data (packet) from the relay device D. Then, it is assumed that the authenticated information is obtained from the data (packet) content. In the case of correct access from the terminal 5, the device ID list set in the data (packet) is the ID of the relay devices A, B, D, and E, and is set in the access route information table 40 in FIG. Since they match the access route information (E, A, D, B) (irrespective of the order), the terminal 6 can be accessed. However, as described above, when the “cracker” illegally acquires data (packet) and makes it appear to be a legitimate access, the relay devices A, B, and
Since the IDs of D, F, and E are included and do not match (E, A, D, B) on the access route information table, unauthorized access to the terminal 17 from the “cracker” can be blocked. . That is, by passing through the relay device F,
It is determined that the vehicle has passed an unauthorized route that is not a legitimate route.

[0012] If data (packets) are encrypted including access path information, security is further improved.

[0013]

As described above, according to the present invention,
The effect of improving the security of the network system connected to the external network by setting the regular access route information at the entrance of the internal network and comparing this with the actual route in the system connecting the networks There is.

[Brief description of the drawings]

FIG. 1 is a schematic diagram of a network system configuration provided with a network security protection method of the present invention.

FIG. 2 is an example of an access route information table.

FIG. 3 is a flowchart illustrating a device ID adding process of the relay device.

FIG. 4 is a flowchart illustrating processing of an access permission / denial processing device.

[Explanation of symbols]

 2, 3 internal network A to F relay device 1 external network 40 access route information table 4 access permission / denial processing device 5, 6 terminal

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Hiroyuki Shinozaki 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture Inside Hitachi Process Computer Engineering Co., Ltd. (72) Inventor Yasushi Sugiyama 5-chome Omikamachi, Hitachi City, Ibaraki Prefecture No. 1 Hitachi Process Computer Engineering Co., Ltd. (72) Inventor Masahiko Hasegawa 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture F-term in Omika Works, Hitachi, Ltd. F-term (reference) 5B017 AA01 BA05 BA07 BB09 CA16 5B089 GA21 GA31 GB03 KA17 KC47 5J104 AA07 KA02 NA05 PA07 5K030 GA15 HD06 JA11 9A001 BB04 CC02 CC06 EE01 JJ18 JJ25 LL03

Claims (1)

[Claims] 1. A network security protection method for preventing unauthorized access when data is transmitted from a terminal in one internal network connected to an external network to a terminal in another internal network connected to the external network. In the internal network of the destination terminal, the ID of the relay device on the external network that is permitted to pass through for each set of the source and destination terminals is set in advance, and each of the relay devices automatically sets the ID when transferring data. By adding the device ID to the transfer data and comparing the relay device ID added to the received data with the preset relay device ID in the internal network on the receiving terminal side, A network security protection method, wherein permission / non-permission of a network is determined.