JP2002064543A - Packet processing method and its system, and recording medium with packet processing program recorded thereon - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a packet processing technique that can add novel functions as firewall to a packet processing system without the need for replacing the entire system including hardware units and software programs. SOLUTION: This invention provides the packet processing method in a firewall in a packet communication network. In the packet processing method, first a packet processing code is received and when packets are received from a network interface, the packet are stored and a packet group is reconfigured as required, and the reconfigured packets are processed and outputted according to the packet processing code.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a technology for a firewall device in a packet communication network.

[0002]

2. Description of the Related Art FIG. 1 shows an example of a packet communication network having a firewall device. As shown in the figure, your organization's network (including intranet)
In general, when connecting to a wide area network such as the Internet, a firewall is generally installed at a boundary point to prevent various attacks from the outside.
The firewall performs access control on a packet basis or on a connection basis, and can make use of a predetermined access control function by setting in advance the access control function built in the firewall device.

In the prior art, there are the following typical functions used in a firewall.

[0004] Packet filtering: Refers to packet information (IP, UDP, TCP header) and determines whether to pass or discard the packet in a stateless (packet unit) manner.

[0005] NAT (Network Address)
Translation): Converts an IPv4 address (which may include a port) used by an end host on the intranet side into one or more shared global IPv4 addresses, and converts address information used internally. Conceal.

Stateful Inspection: Stateful packet inspection is carried out by holding part of received packet information, obtaining connection information and traffic patterns therefrom, and comparing the obtained information with information on an attack method which is already provided. I do. Based on the result, measures such as passing / discarding of the packet are performed.

[0007] Circuit level proxy: A received packet is inspected based on information (such as session information) of a transport layer (TCP), and relaying / discarding is performed.

[0008] Application proxy: A received packet is inspected based on information of an application layer (information based on a protocol defined by an application), and various processes are performed.

[0009] These functions are complementary to each other, and are used in combination to improve the security level and maintain the convenience. For example,
A firewall product combining a packet filtering function and a NAT function and a firewall product combining a stateful inspection function and a NAT function are provided. In addition, it is common practice to combine stateful inspection firewall products with circuit-level proxy products and application gateway products.

In a packet communication network,
Not only firewalls, but always the latest information and functions must be added to maintain the security level. For example, new cracking methods and DoS (Den
When an ial of service attack is found or a new service is provided, it is necessary to add a function corresponding to the attack. Currently, the functions of firewalls are provided by individual hardware and software. To add new functions, hardware replacement and software version upgrades are required. At that time, replacing hardware and software each time a new attack is dealt with would increase the cost.

[0011]

As described above, as described above,
When adding functions in a firewall, hardware and software must be replaced, so a new security hole will occur or the entire system will have to be replaced every time a service is added. And it takes time and effort.

SUMMARY OF THE INVENTION The present invention has been made in view of the above points, and provides a packet processing technique which enables addition of a new function as a firewall without replacing the entire system including hardware and software. With the goal.

[0013]

In order to achieve the above object, the present invention can be configured as follows.

The present invention is a method of processing a packet in a firewall in a packet communication network, comprising the steps of receiving a packet processing code, receiving a packet from a network interface,
The method includes a step of accumulating packets, a step of reconstructing a packet group as necessary, and a step of processing and outputting the reconstructed packets according to the packet processing code.

According to the present invention, a packet is processed according to a packet processing code. Therefore, when a function is added, the packet processing code may be changed or added, and the entire system including hardware and software may be added. A new function as a firewall can be added without replacement.

The present invention can also be configured as follows.

That is, the present invention relates to a packet processing method in a firewall in a packet communication network, in which a packet processing code is installed in advance, a packet is received from a network interface, and the packet is stored. And reconstructing the packet group as necessary, mapping the packet to the virtual address space, interpreting the packet processing code with an interpreter, processing the reconstructed packet according to the interpretation, and processing the packet. Outputting the packet from an appropriate network interface.

According to the present invention, the same effects as described above can be obtained.

Further, the above configuration may further comprise a step of holding the contents related to the processing and a step of using the held contents for processing a newly input packet.

According to the present invention, stateful packet processing can be performed.

[0021]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a firewall (packet processing device) according to an embodiment of the present invention will be described in detail with reference to the drawings.

First, the outline of the present invention will be described. The network configuration in one embodiment of the present invention is the same as that shown in FIG. As will be described later with reference to FIG. 2, the firewall according to the present invention has a plurality of network interfaces and a virtual machine, and the virtual machine interprets and executes a packet processing code for processing a packet received from the network interface. The virtual machine has an interface for receiving a packet from the network interface, an interface for receiving a packet processing code, an interpreter which is an engine unit for interpreting and executing the packet processing code, and a virtual address space for holding data. . The packet processing code is described by a pseudo machine language instruction that can be interpreted by the virtual computer.

When the virtual machine receives the packet from the network interface, it maps the contents of the packet to the virtual address space held by the virtual machine. If the packet is divided, the packet is reconstructed and then mapped to the virtual address space. The interpreter in the virtual machine interprets the packet processing code and performs packet processing by operating data in the virtual address space according to the contents. In order to realize stateful processing, the virtual machine prepares an area for holding a value in a non-volatile manner in a virtual address space, and can refer to the value held in that area at the time of subsequent packet processing. When users add new features to the firewall,
This can be realized by implementing the packet processing code that can be processed by the virtual machine, and there is no need to replace the entire system including hardware and software.

FIG. 2 shows a configuration of system software 101 in a firewall 100 according to one embodiment of the present invention. The system software 101 includes network interfaces NI1 and N
I2, a virtual machine 10 that is an execution environment for packet processing. The virtual machine 10 includes an interpreter 11, a virtual address space 12, and a code 13 for packet processing, and is included in the system software 101. The interpreter 11 interprets and executes the packet processing code 13. The virtual address space 12 holds packets and data. The packet processing code 13 describes the contents of the packet processing.

The above-described system software operates on a router, a switch, a computer, and the like, and a router, a switch, a computer, and the like having the system software function as a firewall. The functions of the above-described virtual machine are realized using a CPU, a memory, a disk, and the like of a router, a switch, a computer, and the like.

Network interfaces NI1, N
The I2 and the interpreter 11 can be realized by a CPU and a memory (not shown). The virtual address space 12 can be realized by a memory or the like (not shown). Packet processing code 1
Reference numeral 3 denotes a bit string, which is stored in a memory or a disk (not shown). That is, the firewall 100 constitutes an extended stateful packet processing device.

FIG. 3 is a flowchart showing the operation of the firewall 100. The operation will be described with reference to FIG.

First, it is checked whether there is a packet processing code to be installed (S11). If there is a packet processing code to be installed, the code is installed in the virtual machine 10 (S12). Note that the processes of S11 and S12 may be performed in advance by a system administrator or the like.

Next, the network interface NI
1 or NI2 receives the packet (S1
3), the system software 101 passes the packet to the interpreter 11 of the virtual machine 10 (S1)
4). The interpreter 11 checks whether or not the received packet is fragmented (S15). If the packet is fragmented, the interpreter 11 accumulates the packet until all the divided packets are collected, and reconstructs the packet as soon as it is prepared (S16). . Thereafter, the interpreter 11 maps the packet to an appropriate area of the virtual address space 12 in the virtual machine 10 (S17), interprets the held packet processing code 13, and converts the data in the virtual address space 12 according to the contents. The operation is performed (S18). When the processing is completed, the interpreter 11 takes out the packet mapped in the virtual address space 12, and sends it out to the appropriate network interface NI1 or NI2 (S19). Thereafter, the system software 101 in the firewall 100 can perform normal processing (S20).

As described above, the virtual machine prepares an area for holding the value in the virtual address space in a nonvolatile manner, and can refer to the value held in the area at the time of subsequent packet processing. Also, when a user adds a new function to the firewall, it is sufficient to implement a packet processing code that can be processed by the virtual machine, and it is not necessary to replace the entire system including hardware and software as in the related art.

As an example of the operation by the packet processing code 13, there is a data operation or the like when performing the processing of the NAT with added functions. Further, for example, when a stateful packet inspection is performed, a packet processing code that describes necessary processing including processing such as referring to the value held in the non-volatile area is used.

FIG. 4 shows a time table of the above embodiment. The operation will be described in the order of time shown in FIG.

First, the packet processing code 13 is installed in the interpreter 11 in the system software 101 in the firewall 100. Upon receiving the packet, the network interface NI1 or NI2 passes the received packet to the interpreter 11. When the interpreter 11 receives the packet, it reconstructs the packet if the packet is divided, and immediately maps the packet to an appropriate area in the virtual address space 12 if the packet is not divided, and thereafter, The interpreter 11 interprets the packet processing code 13 and operates data held in the virtual address space 12 according to the contents. When the processing is completed, the packet in the virtual address space 12 is taken out and sent to the appropriate network interface NI1 or NI2.

The system software 101 may be installed in a router, a switch, a computer, or the like in advance, or may be stored in a recording medium such as a CD-ROM or a floppy (registered trademark) disk. You may make it install in a router, a switch, a computer, etc. System software 101
A router, a switch, a computer, or the like in which is installed can be used as the firewall 100. Further, the system software 101 can be distributed via a network.

The present invention is not limited to the above embodiments, but can be variously modified and applied within the scope of the claims.

[0036]

According to the present invention, in a firewall in a packet communication network, processing contents for processing a group of packets passing therethrough are described as packet processing codes, and the contents of the description are interpreted. Since the group is to be processed, it is possible to process the packet group passing through the firewall in a data unit and in a stateful manner by describing as a packet processing code that the packet group is to be processed in a data unit and in a stateful manner. .

Also, a code for packet processing is appropriately created,
If added, functions can be added, and it is not necessary to replace hardware and software for adding functions as in the related art.

Further, according to the present invention, not only the processing of passing or discarding a packet as in the related art, but also the contents of the packet can be manipulated, so that various processing according to the security level is performed. It becomes possible.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an example of a packet communication network having a firewall device.

FIG. 2 shows a firewall 1 according to an embodiment of the present invention.
It is a block diagram in 00.

FIG. 3 is a firewall 1 according to an embodiment of the present invention.
9 is a flowchart showing the operation of the 00.

FIG. 4 is a firewall 1 according to an embodiment of the present invention.
9 is a time table showing the operation of 00.

[Explanation of symbols]

 Reference Signs List 10 virtual computer 11 interpreter 12 virtual address space 13 packet processing code 100 firewall 101 system software NI1, NI2 network interface

Claims (9)

[Claims] 1. A packet processing method in a firewall in a packet communication network, comprising: receiving a packet processing code; receiving a packet from a network interface; storing the packet; A packet processing method comprising: reconstructing a group; and processing and outputting the reconstructed packet according to the packet processing code. 2. A method for processing a packet in a firewall in a packet communication network, comprising the steps of: installing a packet processing code in advance; receiving a packet from a network interface; Reconstructing a packet group accordingly; mapping the packet to a virtual address space; interpreting the packet processing code by an interpreter; processing the reconstructed packet according to the interpretation; Outputting from a network interface. 3. The packet processing method according to claim 1, further comprising: a step of holding the contents related to the processing; and a step of using the held contents for processing of a newly input packet. 4. A packet processing device constituting a firewall in a packet communication network, comprising: means for receiving a packet processing code; means for receiving a packet from a network interface; means for storing a packet; A packet processing apparatus comprising: means for reconstructing a group of packets by means of the packet processing means; and means for processing and outputting the reconstructed packets according to the packet processing code. 5. A packet processing device constituting a firewall in a packet communication network, comprising: means for installing a packet processing code; a network interface for receiving a packet; Means for reconstructing a packet, means for mapping a packet to a virtual address space, means for interpreting the packet processing code, processing the reconstructed packet according to the interpretation, and outputting the processed packet from an appropriate network interface. A packet processing device comprising: 6. The packet processing apparatus according to claim 4, further comprising: means for holding the contents related to the processing; and means for using the held contents for processing a newly input packet. 7. A computer-readable recording medium having recorded thereon a program for causing a device constituting a firewall in a packet communication network to execute a packet process, comprising: a step of receiving a packet processing code; A program for causing the apparatus to execute a receiving procedure, a procedure for accumulating packets, a procedure for reconstructing a packet group as necessary, and a procedure for processing and outputting the reconstructed packets according to the packet processing code. A computer-readable recording medium that has been recorded. 8. A computer-readable recording medium storing a program for causing a device constituting a firewall in a packet-type communication network to execute packet processing, comprising: a step of installing a packet processing code; Receiving packets from the server, storing packets and reconstructing a group of packets as necessary, mapping the packets to a virtual address space, interpreting the packet processing code, and interpreting the reconstructed packets. And a procedure for outputting the processed packet from an appropriate network interface. 9. The computer recording the program according to claim 7, further comprising: a procedure for storing the content related to the processing; and a procedure for using the stored content for processing a newly input packet. A readable recording medium.