JP2003348113A - Switch and lan - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent illegal packets (computer virus or the like) from being spread and expanded by detecting transmission of the illegal packets from an inside of a LAN to a WAN or delivery of them between computers in the LAN. <P>SOLUTION: A switch of this invention includes: (1) an illegal pattern detection means (error packet/virus detection means 1305) for detecting illegal packets from packets transmitted from computers in the LAN 100 to a WAN access apparatus and/or packets delivered among in-LAN computers; and (2) at least one of ((1)) a port shut-off means (1306) for shutting off a port, ((2)) an illegal packet abort means (1307) for aborting illegal packets, and ((3)) an illegal packet detection notice means (1308) for informing at least either of a management computer sender computer and a destination computer about detection of the illegal packets, when the illegal pattern detection means detects the illegal packets. <P>COPYRIGHT: (C)2004,JPO

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a local network (LA) for illegal packets (such as computer viruses)
N) Transmission from inside to wide area network (WAN), L
The present invention relates to a switch and a local network which can prevent the spread and the like of an illegal packet by detecting the transfer between computers in an AN.

[0002]

2. Description of the Related Art By introducing so-called vaccine software to a terminal computer or a proxy server (hereinafter referred to as "terminal computer, etc.") in a LAN connected to the Internet, a terminal computer in the LAN is infected with a virus. And can repair infected files.

[0003] However, anti-virus measures as described above,
In the case of performing individually on terminal computers, etc., vaccine software must be introduced into all terminal computers, etc. In addition, for new viruses, vaccine software must be upgraded frequently.

[0004] In particular, when monitoring a virus on the terminal computer side, complete updating of the pattern of new viruses and time setting of the virus check are left to the user of the terminal computer, so that a complete virus countermeasure in the LAN is realized. It is not easy to do.

[0005] For this purpose, a virus check server is arranged in a connection path with the Internet on the LAN side to prevent the invasion of viruses. This type of virus check server captures data of passing packets into a buffer, compares the data with a virus pattern set in a register or the like in advance, and performs a virus check. Thereby, in principle, each terminal computer can be prevented from being infected by a virus.

[0006]

However, in practice, when traffic concentrates on the virus check server, the virus check may be missed. Further, the virus check server cannot prevent virus infection between computers in the LAN.

An object of the present invention is to send an illegal packet such as a computer virus from a LAN to a WAN,
An object of the present invention is to provide a switch and a LAN capable of detecting the transfer of an illegal packet between computers in an AN and preventing the illegal packet from spreading.

[0008]

According to the present invention, there is provided a switch comprising:
At least one computer in the AN is connected to a WAN connection device, or predetermined computers in the LAN are connected to each other.
A fraudulent pattern detecting means for detecting a fraudulent packet related to a computer virus from a packet transmitted to the N connection device and / or a packet passed between the computers, and when the fraudulent pattern detecting means detects the fraudulent packet A port blocking unit for blocking a port (including a process of blocking a computer from a port and a process of disabling a port itself), a fraudulent packet discarding unit for discarding the fraudulent packet, a management computer for detecting the fraudulent packet, It is characterized by comprising at least one means of an unauthorized packet detection notifying means for notifying at least one of a transmission source computer and a destination computer.

In the present invention, since the switch detects an illegal pattern included in a packet transferred via the switch, for example, a virus check by a virus check server or a virus check software installed in a terminal computer may fail to detect a virus. Even in such a case, the accuracy of virus detection can be increased as much as possible. When transmitting to the management computer, the transmission source computer, or the destination computer, the unauthorized packet detection notifying means may transmit, for example, an I
Each computer can be notified based on the P address. In this case, a communication application corresponding to the notification destination computer is provided.

Further, in the switch according to the present invention, the fraudulent pattern detecting means compares fraudulent pattern storing means for storing a plurality of fraudulent patterns with each fraudulent pattern stored in the fraudulent pattern storing means. Comparison means.

Further, the LAN according to the present invention obtains and stores a plurality of fraudulent patterns such as computer viruses from a fraudulent packet database host connected via a WAN, and accumulates in the fraudulent pattern database. A switch for setting a plurality of unauthorized patterns.

[0012] The LAN of the present invention can be connected to the WAN via a fraudulent packet detection server in which a plurality of fraudulent patterns stored in a fraudulent pattern database are set. In this case, the illegal packet detection server and the switch of the present invention can check the same illegal data pattern or can check non-identical (different) illegal data patterns. The illegal packet detection server and the switch of the present invention check non-identical or partially non-identical (partially identical) illegal patterns to optimize the illegal pattern check operation of the entire LAN system.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows that the LAN of the present invention is a WAN.
It is an explanatory view of a system connected to (Internet).

In FIG. 1, the Internet 200 includes:
LAN 100 is connected via gateway GW1,
The virus pattern database server 300 is connected via the gateway GW2. LAN 100 is
A virus check server 11, a core switch 12,
A plurality of switches (two indicated by reference numerals 131 and 132 in FIG. 1) are provided.

In FIG. 1, the virus check server 11
The virus pattern is downloaded from the virus pattern database server 300 at regular time intervals, and a predetermined virus can be detected from the passing packets.

In the LAN 100 shown in FIG. 1, switches 131 and 132 are branched and connected to the core switch 12, and terminal computers and hubs can be connected to the respective switches 131 and 132. In FIG. 1, for convenience of explanation, the terminal computers 1411, 1412 and the hub 1413 connected to the switch 131 are connected to the switch 1
Terminal computers 1421 and 1422 connected to
And hub 1423, respectively.

The switches 131 and 132 are connected to virus databases 151 and 152, respectively. In FIG. 1, the switches 131 and 132 download virus patterns from the virus pattern database server 300 to the virus databases 151 and 152 at regular time intervals.

FIG. 2 is a functional block diagram of switches 131 and 132 (indicated by reference numeral 130 in FIG. 2), and includes a packet receiving unit 1301, a packet buffer 1302,
Packet transfer means 1303 and destination port determination means 1
304 and error packet / virus detection means (which also functions as an unauthorized pattern detection means of the present invention) 1305
, A port blocking unit 1306, a packet discarding unit (which also functions as an unauthorized packet discarding unit of the present invention) 130
7, a virus detection notification unit (illegal packet detection notification unit of the present invention) 1308, and a MAC address table 13
09 and a pattern storage unit 1310.

The destination port determining means 1304 includes a port number storing means, and the virus detection notifying means 13
08 can include means for storing the mail address of the management computer, and the packet discarding means 1307
May have a reset flag transmitting means for transmitting a reset flag (a signal indicating that the packet has been discarded) when the packet is discarded. Further, as shown in FIGS. 3C and 3D, the MAC address table 1309 records a port number and a MAC address of a terminal computer or the like connected to each port. And a MAC address table as shown in FIG. 3B).

The destination port determining means 1304 includes a MAC
The destination port can be determined with reference to the address table 1309. Destination port determination means 1304
Is the destination MAC in the MAC address table 1309.
When the address is not written, the packet is transmitted to all terminal computers connected to the port (that is, flooding is performed). The destination port determination unit 1304 includes a destination storage unit, and the determined destination is temporarily stored in the storage unit.

The operation of the switch 130 shown in FIG.
This will be described with reference to FIG. 3 and partly in FIG. Note that all of the processing of the switch 130 can be performed by software, and all or part of the processing can be performed by hardware (ASI
C) can also be performed.

FIG. 3A shows a packet format. When the packet receiving unit 1301 receives a packet, the packet is stored in the packet buffer 1302.

When a packet is fetched into the packet buffer 1302 (S101 in FIG. 4), the error packet / virus detection means 1305 sets the pattern storage means 13
The error pattern of the received packet is checked with reference to the error pattern stored in S20 (S10).
2). If the received packet is an error packet ("YES" in S103), the packet is discarded (S104). If the received packet is not an error packet ("NO" in S103), the error packet / virus detection means 1 is used.
305 checks the virus pattern of the received packet with reference to the virus pattern stored in the pattern storage unit 1320 (S105). If no virus pattern is detected (“NO” in S106), the packet transfer unit 1303 sets the destination port determination unit 130
The packet is transmitted to the port corresponding to the destination MAC address (the port corresponding to the port number stored in the destination storage unit) in accordance with the determination of S4 (S107).

If a virus pattern is detected in step S105 ("NO" in S106), a blocking script for a port to which the source computer is connected, a packet discarding script, and a notification of virus detection to a management computer in the LAN 100 are sent. (Warning) A process by at least one script of the script is selected (S108), and the selected process is executed (S10).
9). In addition, the script of FIG.
At 306, the script is the packet discarding means 1 of FIG.
The script 307 corresponds to the virus detection notification unit 108 in FIG. Which of these scripts to select can be set in advance by, for example, a switch administrator (or a system administrator) or the like. Further, it is preferable that the administrator or the like can appropriately change the definition of the script and the like (setting of whether or not to immediately shut down the port, definition of the content of the warning, etc.).

When discarding a packet, the packet discarding means 1307 can send a reset flag to the terminal computer of the packet transmission source by the reset flag sending means.

The management computer in the LAN 100
LAN1 by receiving notification of virus detection
00, it is possible to know which terminal computer has been infected by the virus by referring to the MAC address included in the notification.
It is possible to grasp the route of virus infection and the status of infection within 00. Normally, no packet is transmitted before the error packet / virus detection unit 1305 detects a virus. However, due to the concentration of traffic on the switch 130, virus detection by the error packet / virus detection unit 1305 may not be in time for transmission of a packet from a port, and a virus may be detected after packet transmission. In this case, the port is immediately shut off, or the virus detection
Port notification can be promptly performed after the notification by the server.

In the above example, the virus detection notification means 10
8, the virus detection is notified to the management computer, but the virus detection can also be notified to the transmission source computer or the destination computer based on the IP address included in the packet. In this case,
It is necessary to install a communication application corresponding to the computer in the source computer or the destination computer.

In the system shown in FIG. 1, when the traffic concentrates on the gateway GW1, the virus check by the virus check server 11 may be missed. By making the virus pattern referred to by the error packet / virus detection unit 1305 at the time of virus check and the virus pattern referred to by the virus check server 11 at the time of virus check the same, the virus infection due to the above-mentioned missing can be avoided. Of course, by making the virus pattern referred to by the error packet / virus detecting means 1305 at the time of virus check and the virus pattern referenced by the virus check server 11 at the time of virus check non-identical or partially non-identical, virus detection of the entire system can be performed. (Which prevents the transfer speed from being reduced). In the above embodiment, the core switch 12 does not have a virus detection function, but the core switch 13 may have a virus detection function.

[0029]

According to the switch of the present invention, transmission of an illegal packet such as a computer virus from the LAN to the WAN,
Alternatively, since the transfer of an illegal packet between the computers in the LAN is detected, and when the illegal packet is detected, the port is shut off and the notification to the management computer is immediately performed, so that the spread of the illegal packet can be prevented efficiently. it can.

In the LAN system of the present invention, a virus check can be performed by the virus check server and a virus can be checked by the switch of the present invention, so that the virus check can be performed more completely. In addition, since virus check is performed on packets exchanged between terminal computers in the LAN, the spread of infection in the LAN can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram showing a network system according to an embodiment of the present invention.

FIG. 2 is a functional block diagram showing an embodiment of the switch of the present invention.

FIG. 3A is a format diagram of a packet, and FIGS.
(D) is a diagram showing a MAC address table of the switch.

FIG. 4 is a flowchart illustrating a process of the switch in FIG. 2;

[Explanation of symbols]

100 LAN 200 Internet 300 Virus pattern database server 100 LAN 11 Virus check server 12 Core switches 131, 132 (130) Switches 1411, 1412, 1421, 1422 Terminal computers 1413, 1423 Hubs 151, 152 Virus database 1301 Packet receiving means 1302 Packet buffer 1303 Packet transfer means 1304 Destination port determination means 1305 Error packet / virus detection means 1306 Port blocking means 1307 Packet discarding means 1308 Virus detection notification means 1309 MAC address table 1310 Pattern storage means GW1, GW2 Gateway

Claims (5)

[Claims] 1. A switch for connecting at least one computer in a local network to a wide area network connection device or connecting predetermined computers in the local network, and transmitted from the computer to the wide area network connection device. Pattern detecting means for detecting an illegal packet from a packet received and / or a packet transferred between the computers, and a port blocking means for blocking a port when the illegal pattern detecting means detects the illegal packet. An illegal packet discarding unit that discards the illegal packet; and an illegal packet detection notifying unit that notifies at least one of a management computer, a transmission source computer, and a destination computer of the detection of the illegal packet. Switch, wherein the door. 2. The fraudulent pattern detecting means includes fraudulent pattern storage means for storing a plurality of fraudulent patterns, and comparing means for comparing each fraudulent pattern stored in the fraudulent pattern storage means with packet data. The switch according to claim 1, wherein: 3. A fraudulent pattern database for acquiring and accumulating a plurality of fraudulent patterns from a fraudulent packet database host device connected via a wide area network, and a plurality of fraudulent patterns stored in the fraudulent pattern database are set. 3. A local network, comprising: the switch according to item 1 or 2. 4. The local network according to claim 3, wherein the local network is connected to the wide area network via a fraudulent packet detection server in which a plurality of fraud patterns stored in the fraud pattern database are set. 5. A plurality of fraudulent patterns set in the switch and a plurality of fraudulent patterns set in the fraudulent packet check server are selected so as to be at least partially different. Item 5. The local network according to item 3 or 4.