JP2002158660A - Protection system against unauthorized access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a realistic protection means for coping with DDoS attacks, which impair the quality of service to be offered by performing large quantity of access to a specific host server. SOLUTION: When footstool hosts 300 to 400 execute the DDoS attack as a large quantity of access to an attacking object host 1 by an instruction of an attack performance host 10, attack-detecting equipment 2 detects the attack by monitoring a state of a network 5 on the protecting side and communication control equipment 3 instruct communication control to attack shielding devices 100 to 200 by the instruction of a manager of the network on the protecting side 5, when the DDoS attack is detected by the attack detecting equipment 2. The footstool hosts 300 to 400 control communication, by receiving the instruction of communication control. In addition, certificate-issuing equipment 4 transmits information to assure the contents of the instruction of the communication control to the attack shielding devices 100 to 200.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an unauthorized access protection system for protecting against unauthorized access to a specific host server.

[0002]

2. Description of the Related Art Distributed denial-of-service attacks (DDoS attacks) that impair the quality of service provided by a target host by making a large amount of access to the target host and increasing the load in response to denial of service on the Internet.
l of Service attack).

[0003] A feature of the DDoS attack is that, instead of directly attacking the target network or host from the attacking side, an agent program for performing the attack is set on a number of servers on the Internet, It is an indirect method of attacking the target network by giving an attack instruction to the target, and even if each access is legitimate access, the access amount of the target network or host is The problem is that a very large number of accesses exceed the limit, making it difficult to respond after the attack begins.

[0004] The DDoS attack method can be said to be a method created to distribute and use a large number of hosts that actually perform attacks in order to realize access beyond the performance limit of the network environment of the executer.

Conventionally, there is no technology corresponding to this type of “invention on a method of actively protecting a distributed denial-of-service attack on the Internet by a router network”, and it is necessary to enhance network security so as not to be used as a stepping stone for a DDoS attack The only method to increase security on the side that is used as a stepping stone, such as setting to not allow a certain amount of packets to pass through, is "2000".
Published by the Information Processing Promotion Agency of Japan in December, 1999, Research on Advanced Computer Application Technology in 1999-Research on Advanced Internet Application Technology, and "March 2000, Nikkei Open System, March 2000, Open Report" , 100 pages ".

[0006] Once the DDoS attack has started,
There is no alternative but to wait until the end of the attack or to ask individual administrators of many networks used for the platform to block access.

[0007]

However, the above-mentioned prior art has the following problems.

First, at present, there is no defensive means from the attacked side. The only way to respond to a DDoS attack is to increase security so that it cannot be used as a springboard. However, unless all networks increase security and keep it up-to-date, the network that can be used as a springboard is on the Internet. There are many. Attackers can randomly search for unsecured networks and simply ignore those networks.

Second, it is virtually impossible to respond after the attack has started. After the administrator detects that the attack has started, there is no way to respond except to individually request the host that was the stepping stone from the attacked network administrator, It is virtually impossible to make a request to all the administrators of the above-mentioned hosts.

[0010] It is an object of the present invention to efficiently provide a method for reducing the influence of a DDoS attack after the DDoS attack has started, with the responsibility of the side receiving the DDoS attack.

[0011]

According to the present invention, there is provided an attack detection device for monitoring the status of a defending network to detect unauthorized access to an attack target host, and comprising the steps of: A communication control device that issues a communication control instruction from an administrator of the defending network;
An attack blocking device that belongs to a host that executes the unauthorized access that is physically distant, and that receives the communication control instruction and controls communication.

[0012] The information processing apparatus may further include a certificate issuing device that transmits information to the attack blocking device to assure that the responsibility of controlling the communication of the attack blocking device belongs to the administrator of the defending network. .

[0013]

Next, embodiments of the present invention will be described with reference to the drawings.

[0014] The present invention relates to a DDo on the Internet.
For S attack, control the communication path on the network,
It is intended to provide a configuration in which the responsibility and operation from the victim side of the DDoS attack are performed without being affected by the occurrence of a new DDoS attack.

FIG. 1 is a block diagram showing an embodiment of an unauthorized access protection system according to the present invention. The unauthorized access protection system shown in FIG. 1 includes an attack target host 1, an attack detection device 2, a communication control device 3, a certificate issuing device 4, a defending network 5, an attack execution host 10, and the Internet 5.
0, attack blocking devices 100 to 200, step platform host 300
And a platform 400.

The attack target host 1 is an information processing device such as a workstation server. Target host 1
Functions as a device that provides services on the Internet such as WWW services.

The attack detection device 2 is a network load monitoring device. The administrator of the defending network 5 monitors the network usage status by using the present apparatus, examines the cause of the network load increase, assuming a case where a DDoS attack occurs when the network load increases rapidly, It is determined whether the load is due to a DDoS attack.

If it is determined that the attack is caused by the occurrence of the DDoS attack, the attack detection device 2 instructs the communication control device 3 to respond to the DDoS attack.

The communication control device 3 includes a defending network 5
It is an information processing device such as a workstation server installed above. On the communication control device 3, application software for issuing a communication control instruction is operating. In accordance with the instruction from the attack detection device 2, the attack execution host 10 further attacks the attack cutoff devices 100 to 200 from the attack cutoff device 100. And at the same time, requests the certificate issuing device 4 to guarantee the validity of the instruction.

The certificate issuing device 4 is an information processing device such as a workstation server installed on the defense network 5. On the certificate issuing device 4, it is guaranteed that the communication cutoff instruction from the communication control device 3 has been issued by the administrator of the defending network 5 and that the instruction has not been falsified. Is transmitted to the attack blocking devices 100 to 200.

Attack blocking device 100 to attack blocking device 200
Is an information processing device such as a router. Attack blocking device 1
On the attack blocking device 200, application software for receiving an instruction from the communication control device 3 and communication from the certificate issuing device 4 and application software for blocking communication from an arbitrary host in accordance with the specified contents. Is working.

Step ladder host 300 to step ladder host 400
Is an information processing device such as a workstation, a server, and a personal computer. Springboard host 300 ~
The springboard host 400 is a device that cannot be used originally by a DDoS attacker, but can be operated by a DDoS attacker by DDoS attack software installed by the DDoS attacker.

The attack execution host 10 is an information processing device such as a workstation, a server, and a personal computer, and is always available to a DDoS attacker.

Next, the operation of the embodiment shown in FIG. 1 will be described.

In FIG. 1, the performer of the DDoS attack is:
A DDoS attack is performed through the following two steps. The first step is preparation in advance, and using the attack execution host 10 via the Internet 50, the springboard host 300
-Install DDoS attack software on the springboard host 400.

In the next step, the executor of the DDoS attack issues an attack execution instruction from the attack execution host 10 to the springboard host 300 to the springboard host 400. The springboard host 300 to the springboard host 400 simultaneously perform a large amount of access to the attack target host 1 according to the instruction, and perform a DDoS attack.

On the other hand, in the present invention, the attack detection device 2
DDoS for the attack blocking devices 100 to 200 according to the configuration of the communication control device 3 and the certificate issuing device 4
An instruction for defense against an attack is issued, and protection from a DDoS attack is performed.

Next, the operation of each component shown in FIG. 1 will be described with reference to FIGS. FIG. 2 is a flowchart illustrating the operation of each component device.

The attack detection device 2 detects the occurrence of a DDoS attack by monitoring the network status from the administrator.
The means for detection is realized by using existing and widely used network / server management techniques, such as monitoring changes in network usage rates and monitoring changes in CPU, memory, and HDD usage rates of servers.

The attacking host 1 and the bastion host 3
A description will be given assuming a case where a DDoS attack using hosts from 00 to the platform host 400 is used as a platform.

Occurrence of DDoS Attack The attacker of the DDoS attack uses the attack execution host 10 to send the DDoS attack software to the springboard host 300 to the springboard host 400 in advance.
Attack instructions to the attack target host 1 are issued all at once.

Attack Detection Device 2 The attack detection device 2 monitors the status of the defending network 5 (step 100). If the administrator of the defending network 5 discovers that the network load has increased sharply, it investigates the communication that caused the network load. Is detected (step 101). The administrator instructs the communication control device 3 to cut off the communication from the springboard host 300 to the springboard host 400 to the communication control device 3 (step 1).
02).

Communication control device 3 The communication control device 3 instructs the attack blocking device 100 to the attack blocking device 200 to cut off the communication with the springboard host 300 to the springboard host 400 in accordance with the instruction of the attack detection device 2. (Step 106). Further, it requests the certificate issuing device 4 to guarantee the contents of the communication cutoff instruction (step 103).

The certificate issuing device 4 certifies that the communication content from the communication control block is legitimate and has not been tampered with by using an existing authentication technique such as the RSA public key encryption method, and the certification result is obtained. The information is transmitted to the attack blocking devices 100 to 200 (step 104).

Attack blocking devices 100 to 200 After confirming the validity of the contents of the instruction from communication control device 3 in the network including the attack blocking device among the individual networks to which stepping host 300 to stepping host 400 belong ( In step 105), the communication from the springboard host 300 to the springboard host 400 is interrupted according to the instruction (step 107).

For example, in the case where 80% of the individual networks to which the springboard host 300 to the springboard host 400 belongs, the attack blocking devices 100 to 200 mount an attack blocking device corresponding to the present invention. The impact on the attack target host 1 is reduced to 20% of that before, and the attack target host 1 can return to within an allowable range in which the service can operate compared to before the occurrence of the DDoS attack.

After a certain period of time has elapsed (step 108), the communication cutoff for the springboard host 300 to the springboard host 400 is released (step 109).

The feature of the present invention is that, as a defense method against a DDoS attack, the ladder host 300 to the ladder host 400 responds to the fact that the ladder host 300 to the ladder host 400 does not install the attacking software. Even if the attack software is installed, it is to reduce the influence of the DDoS attack in the attack blocking devices 100 to 200 to a negligible range.

The present invention forcibly suspends a sabotage action based on a judgment and a responsibility of a party receiving the sabotage action against a service sabotage via a network. Therefore,
As an application other than DDoS, the present system can be applied to all unauthorized access. Next, a case where the present system is applied to a port scan will be described as an application example.

Attack detection device 2 By detecting a port scan by the network monitoring from the administrator, an instruction corresponding to the port scan is issued to other blocks.

Communication control device 3 In accordance with the instruction from the attack detection device 2, an instruction is given to the attack blocking devices 100 to 200 to cut off the communication from the host in which the unauthorized access has occurred.

Certificate issuance device 4 The communication control device 3 guarantees that the communication is legitimate, and is responsible for executing communication control is the attack blocking device 1
00-It is guaranteed that the administrator of the defense network 5 is not the administrator of the attack blocking device 200.

Attack blocking device 100 to attack blocking device 20
0 In accordance with an instruction from the communication control device 3, the communication path from the host in which the unauthorized access has occurred is cut off.

In the above application example, port scanning has been described. By replacing this first detection of unauthorized access with another unauthorized access detection method, it is possible to actively cut off all detectable unauthorized access from the standpoint of suffering from unauthorized access. .

However, the determination as to whether the communication from the host deemed to be an unauthorized access is really an unauthorized access or a legitimate access for any reason is made by the determination and responsibility of the party receiving the unauthorized access. Therefore, it is necessary to take care not to damage the communication partner by blocking the necessary access.

[0046]

As described above, according to the present invention,
DD that was said to be unable to respond if targeted
Provides realistic means of responding to oS attacks. Basically, it is desirable that all networks that make up the Internet support this system, but by applying this system to networks that are the core of communication on the Internet, such as large-scale line operators,
It is possible to suppress an enormous amount of communication, which is the greatest feature of the DDoS attack, to an allowable amount of communication.

Further, in the present invention, the subject in dealing with the DDoS attack is the victim. Conventional methods of responding to DDoS attacks require that all networks that make up the Internet respond, and even if the responsibility lies with another company that did not use the latest security technology, the parties could take measures against it. An accountability system has not been established.

In the present invention, whether or not the latest DDoS attack can be dealt with can be performed at the responsibility of the party as to whether or not the party targeted for unauthorized access can detect it.

In the present invention, it is basically unnecessary to update the technology. In general, even if the network or the host unit responds to the unauthorized access, new unauthorized access occurs one after another, and it is necessary to always apply the latest security technology to the network or the host unit. In the present invention, since it is possible to instruct the blocking of the unauthorized access at the responsibility of the parties, it is possible to continuously use the present technology.

Whether or not the latest security technology is introduced to all the network devices constituting the Internet is left to the discretion of the company that operates the security device. It is possible to provide a realistic response method to access.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an embodiment of an unauthorized access protection system of the present invention.

FIG. 2 is a flowchart illustrating the operation of each component device shown in FIG.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Attack target host 2 Attack detection device 3 Communication control device 4 Certificate issuing device 5 Defending network 10 Attack execution host 50 Internet 100-200 Attack breaker 300-400 Stepping host

Claims (6)

[Claims] An attack detection device that monitors the status of a defending network to detect unauthorized access to an attack target host, and communicates by an administrator of the defending network when the attack detector detects an unauthorized access. An unauthorized access, comprising: a communication control device that issues a control instruction; and an attack blocking device that belongs to a physically distant host that performs the unauthorized access and that receives the communication control instruction and controls communication. Defense system. 2. The unauthorized access protection system according to claim 1, wherein the unauthorized access is an access that increases rapidly. 3. The apparatus according to claim 2, further comprising: a certificate issuing device that transmits information to the defending network to assure that the responsibility of controlling communication of the attack blocking device belongs to an administrator of the defending network. The unauthorized access protection system according to claim 1. 4. When an unauthorized access to an attack target host is detected by monitoring the status of the defending network, it belongs to a host that executes the unauthorized access physically separated by an instruction of an administrator of the defending network. An unauthorized access protection method characterized by controlling communication of an attack blocking device that performs the attack. 5. The unauthorized access protection method according to claim 4, wherein the unauthorized access is an access that increases rapidly. 6. The information processing apparatus according to claim 4, wherein information for guaranteeing that the responsibility of controlling communication of the attack blocking device belongs to an administrator of the defending network is transmitted to the attack blocking device. Unauthorized access protection method.