JP2004153343A - Transfer apparatus and transfer method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a transfer apparatus and a transfer method for appropriately transferring communication packets. <P>SOLUTION: The transfer apparatus for transferring communication packets in communication between an internal communication apparatus provided inside a predetermined network and an external communication apparatus provided outside the network is provided with: a state storing section for storing a communication state indicating a communication state in the internal communication apparatus; a state updating section for updating the communication state on the basis of the header of a packet addressed to the outside, the packet being a communication packet to be transmitted from the internal communication apparatus to the external communication apparatus; a transfer deciding section for deciding whether or not to permit the transfer of the packet addressed to the outside, the packet being a communication packet to be transmitted from the external communication apparatus to the internal communication apparatus, on the basis of the communication state; and a transfer processing section for transferring the packet addressed to the inside to the internal communication apparatus, when the transfer deciding section decides to permit the transfer of the packet addressed to the internal communication apparatus. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a transfer device and a transfer method. In particular, the present invention relates to a transfer device for transferring a communication packet.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, there has been known a transfer device that restricts transfer of a packet from a device other than a permitted IP address by designating, for example, an IP address to which communication is permitted. In such a transfer device, an IP address that permits communication is set in advance by a user of the transfer device. In addition, conventionally, a transfer device that determines whether or not a setting condition is satisfied when a session is set up is known (for example, refer to Patent Literature 1).
[0003]
[Patent Document 1]
JP-A-2000-349851 (pages 3 to 12, FIGS. 1 to 12)
[0004]
[Problems to be solved by the invention]
However, in the conventional transfer device, an illegal packet may be transferred, for example, when a third party impersonates the IP address. Also, after a session has been properly established, unauthorized access may have occurred. Therefore, conventionally, it has been difficult to appropriately transfer a packet.
[0005]
Therefore, an object of the present invention is to provide a transfer device and a transfer method that can solve the above-described problems. This object is achieved by a combination of features described in the independent claims. The dependent claims define further advantageous embodiments of the present invention.
[0006]
[Means for Solving the Problems]
That is, according to the first embodiment of the present invention, a transfer device for transferring a communication packet in communication between an internal communication device provided in a predetermined network and an external communication device provided outside the network And a state storage unit for storing a communication state indicating a state of communication in the internal communication device, and a communication state based on a header of an externally addressed packet which is a communication packet transmitted from the internal communication device to the external communication device. A state updating unit for updating, a transfer determining unit for determining whether to permit transfer of an internally addressed packet, which is a communication packet transmitted from the external communication device to the internal communication device, based on a communication state; A transfer processing unit configured to transfer the internally addressed packet to the internal communication device when the unit determines that the transfer of the internally addressed packet is permitted.
[0007]
Further, the internal communication device, further includes a session management information storage unit that stores session management information that specifies a session between the external communication device, the state storage unit stores a communication state corresponding to the session management information, The transfer determination unit manages the session management information, and, based on the session management information, a session management unit that identifies a session corresponding to the internally addressed packet, and a communication state corresponding to the session identified by the session management unit, A determination processing unit that determines whether to permit the transfer of the internally addressed packet.
[0008]
Further, the session management information storage unit is an associative storage device that stores a pointer to a communication state corresponding to the session as at least a part of the session management information. Based on the header information, by giving a search key including at least part of the IP address and port number of the internal communication device and the IP address and port number of the external communication device, a pointer to the communication state is obtained, and the determination process is performed. The unit may acquire a communication state corresponding to the internally addressed packet from the state storage unit based on the pointer received from the session management unit.
[0009]
If the session management information corresponding to the packet addressed to the outside is not stored in the session management information storage unit, and the packet addressed to the outside is a packet for requesting the establishment of a session with the external communication device, the session The management unit may newly store the session management information corresponding to the packet addressed to the outside in the session management information storage unit. If the session management information corresponding to the packet destined for the inside is not stored in the session management information storage unit, the determination processing unit does not have to permit the transfer of the packet destined for the inside.
[0010]
Further, the transfer processing unit further transfers the externally-addressed packet to the external communication device, and when the transfer processing unit does not transfer the externally-addressed packet or the internal-addressed packet corresponding to the session management information for a predetermined period, the session management unit. May delete the session management information. Further, the session management information storage unit stores, as at least a part of the session management information, erasure flag information indicating whether or not the session management information can be erased, and transfers an externally addressed packet or an internally addressed packet corresponding to the session management information. When the processing unit does not perform the transfer for a predetermined period and the erasure flag information corresponding to the session management information indicates that erasure is possible, the session management unit may erase the session management information.
[0011]
The packet processing unit further includes a packet processing unit that processes the packet addressed to the outside or the packet addressed to the inside, and the state storage unit performs a process to be performed by the packet processing unit on the packet addressed to the outside or the packet addressed to the inside as at least a part of the communication state. The transfer determination unit may store the processing information indicated by the packet and process the externally-addressed packet or the internally-addressed packet according to the processing information by the packet processing unit, and the transfer determination unit may determine whether to permit the transfer of the internally-addressed packet.
[0012]
Further, the transfer device transfers a TCP packet based on TCP (Transport Control Protocol) as an internal-addressed packet and an external-addressed packet, and the status storage unit stores a TCP status indicating a status of a TCP session in the internal communication device as a communication status. The status update unit updates the TCP status based on the TCP flag in the header of the externally-addressed packet, and the transfer determination unit updates the TCP status based on the TCP flag and the TCP status in the header of the internal-addressed packet. It may be determined whether or not the transfer of the packet addressed to the inside is permitted.
[0013]
The status storage unit stores acknowledgment number information indicating the value of the acknowledgment number field in the header of the packet addressed to the outside as at least a part of the communication state, and the transfer judgment unit determines the sequence number in the header of the packet addressed to the inside. Based on the value of the field and the acknowledgment number information, it may be determined whether to permit the transfer of the packet addressed to the inside. The state storage unit further stores window information indicating a value of a window field in a header of the packet destined to the outside as at least a part of the communication state, and the transfer determination unit determines a value of the sequence number field in the header of the packet destined to the inside. It may be determined based on the acknowledgment number information and the window information whether to permit the transfer of the packet addressed to the inside.
[0014]
The state storage unit stores information based on the header of the internal packet as at least a part of the communication state, and the state update unit further updates the communication state based on the header of the internal packet, and determines the transfer. The unit may determine, based on the communication state, whether to permit the transfer of the internally addressed packet. The state storage unit stores, as the TCP state, information further indicating the state of the TCP session in the external communication device, and the state update unit further updates the TCP state based on the TCP flag in the header of the packet addressed to the inside. The transfer determination unit may determine whether to permit the transfer of the packet addressed to the inside based on the TCP state.
[0015]
Further, the state storage unit stores, as at least a part of the communication state, sequence number information indicating a value of a sequence number field in a header of the internal packet, and when the transfer of the internal packet is permitted, the state update unit The sequence number information is updated to information indicating the value of the sequence number field in the header of the packet destined for the internal packet, and the transfer determination unit determines whether to permit the transfer of the packet destined for the internal packet based on the sequence number information. May be. Further, the state storage unit further stores the same sequence number count information indicating the number of times the transfer device has transferred the internal destination packet having the same value of the sequence number information and the value of the sequence number field as the communication state. If the value of the sequence number field in the packet addressed to the internal is equal to the value indicated by the sequence number information after the number of times indicated by the same sequence number frequency information reaches the predetermined number, It is not necessary to permit the transfer of packets addressed to the inside.
[0016]
According to a first aspect of the present invention, there is provided a transfer method for transferring a communication packet in communication between an internal communication device provided in a predetermined network and an external communication device provided outside the network. The communication state is updated based on a state storing step of storing a communication state indicating a state of communication in the internal communication apparatus and a header of an externally addressed packet which is a communication packet transmitted from the internal communication apparatus to the external communication apparatus. A state update step, a transfer determination step of determining whether to permit transfer of an internal destination packet, which is a communication packet transmitted from the external communication device to the internal communication device, based on the communication state; and A transfer processing step of transferring the packet destined for the inside to the internal communication device when it is determined that the transfer of the packet destined for the inside is permitted.
[0017]
Note that the above summary of the present invention does not list all of the necessary features of the present invention, and a sub-combination of these features may also be an invention.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described through embodiments of the invention. However, the embodiments do not limit the invention according to the claims, and all combinations of the features described in the embodiments are solutions of the invention. It is not always necessary for the means.
[0019]
FIG. 1 shows a communication system 100 according to the present embodiment. The communication system 100 includes a wide area network (WAN) having servers 120a-b, an external network 140, and an ISP relay device 130, and a local network (LAN) having a relay device 150 and terminals 160a-b. The relay device 150 is an example of an information processing device according to the present invention, and provides a gateway function and a router function for connecting, for example, terminals 160a and 160b in a LAN such as a company or home to a WAN while ensuring security. The purpose is to do.
[0020]
The servers 120a and 120b are communication devices that provide services such as an HTTP service and an FTP service. The ISP relay device 130 is provided by an ISP (Internet Service Provider), and relays communication between the relay device 150 and the external network 140. The external network 140 connects the servers 120a and 120b and the ISP relay device 130. Here, the external network 140 may include a wireless communication network or a wired communication network, and may include a LAN other than the LAN by the relay device 150 and the terminals 160a and 160b on at least a part of the path.
[0021]
The relay device 150 includes a plurality of communication ports, for example, communication ports 0 to 3, and connects the terminals 160a and 160b in the LAN to the ISP relay device 130. In the present embodiment, the relay device 150 is connected to the ISP relay device 130 via the communication port 0, to the terminal 160a via the communication port 1, and to the terminal 160b via the communication port 3, respectively.
[0022]
The relay device 150 converts a communication packet transmitted by a source communication device such as the server 120a-b into a network connected to one communication port corresponding to a destination communication device such as the terminal 160a-b, which is the destination of the communication packet. To transfer the communication packet to the destination communication device. Similarly, the relay device 150 transmits the communication packet transmitted by the source communication device such as the terminal 160a-b to the ISP relay device 130 corresponding to the destination communication device such as the server 120a-b, which is the destination of the communication packet. By transferring the communication packet to the connected network, the communication packet is transferred to the destination communication device.
[0023]
Here, the relay device 150 determines whether the received communication packet is a valid communication packet that satisfies a predetermined condition, and transfers only the valid communication packet. Thereby, the relay device 150 can ensure the security of communication between the servers 120a-b and the terminals 160a-b.
[0024]
The terminals 160a and 160b are communication devices such as a personal computer, a PDA, an IP (Internet Protocol) telephone, and a home appliance connectable to a network. Here, the terminals 160a and 160b may be connected to the relay device 150 via a relay device such as a hub, a switch, or a router different from the relay device 150.
[0025]
In the present embodiment, the terminals 160a and 160b are examples of an internal communication device provided in a LAN. The servers 120a and 120b are an example of an external communication device provided on the WAN side outside the LAN. The relay device 150 transfers a communication packet in communication between the terminal 160 as an internal communication device and the server 120 as an external communication device.
[0026]
FIG. 2 shows a configuration of the relay device 150 according to the present embodiment. The relay device 150 is connected to the CPU 200, the ROM 210, the RAM 220, the communication processing device 230, the hard disk drive 240, the flexible disk drive 250, the CD-ROM drive 260, and the bridge 270 which are mutually connected by the CPU bus 280. The physical layer interfaces 232a to 232d connected, the associative memory 234, and the session state memory 236, and the wireless LAN interface 272, serial interface 274, and parallel interface 276 connected to the bridge 270 via the I / O bus 282 Is provided.
[0027]
The CPU 200 operates based on programs stored in the ROM 210 and the RAM 220, and controls each unit. The ROM 210 stores a boot program executed by the CPU 200 when the relay device 150 is activated, a program depending on hardware of the relay device 150, and the like. The RAM 220 stores a relay program executed by the relay device 150 to relay a communication packet, data used for executing the relay program, and the like. The hard disk drive 240 stores programs and data used by the relay device 150. The flexible disk drive 250 and the CD-ROM drive 260 read programs or data from the corresponding flexible disk 290 and CD-ROM 295, respectively, and provide the programs or data to the RAM 220, the hard disk drive 240, and / or the communication processing device 230 via the CPU bus 280. I do.
[0028]
A program such as a relay program provided to the relay device 150 or the communication processing device 230 is stored in a recording medium such as the flexible disk 290, the CD-ROM 295, or an IC card and provided by the user.
[0029]
The communication processing device 230 receives the communication packet transmitted by the source communication device from the communication ports 0 to 3 and transfers the communication packet to the network connected to the communication port corresponding to the destination communication device, thereby transferring the communication packet to the destination communication device. Transfer to device. Here, the relay device 150 determines whether the received communication packet is a legitimate communication packet that satisfies a predetermined condition, and transfers only the legitimate communication packet.
[0030]
In the communication processing described above, the communication processing device 230 sends the communication processing to the CPU 200 when the communication processing device 230 alone cannot process the communication packet or when an encrypted communication packet such as an IPsec packet is received. Some may be performed.
[0031]
The physical layer interfaces 232a to 232d correspond to the communication ports 0 to 3, respectively, and convert signal levels between a transmission medium of a network connected to the physical layer interfaces 232a to 232d and a communication port of the communication processing device 230. And conversion in the physical layer, such as conversion between optical communication media and electrical signals.
[0032]
The associative storage memory 234 includes session management information used by the communication processing device 230 to select permission or prohibition of relay of the received communication packet, and communication processing to select a communication port associated with the destination communication device. The communication port management information used by the device 230 is stored. Here, in the present embodiment, the associative storage memory 234 stores session management information for specifying a session between the terminal 160 (see FIG. 1) and the server 120 (see FIG. 1). The relay device 150 is, for example, a connection between a source communication device and a destination communication device dynamically opened and / or closed based on a communication protocol in a transport layer, a session layer, a presentation layer, an application layer, and the like in the OSI reference model. May be stored as session management information. Also, the session management information may be set in advance by the provider or user of the relay device 150 for a set of a source communication device and / or a destination communication device for which the relay device 150 has permitted or prohibited the relay.
[0033]
The session state memory 236 stores session state information indicating a communication state between the terminal 160 and the server 120 in each session. Here, in the present embodiment, the associative storage memory 234 stores a pointer to the session state information corresponding to each session as at least a part of the session management information. As a result, the session state memory 236 stores the session state information corresponding to the session management information. In this case, the session state memory 236 receives, for example, a memory address where the session management information is stored in the associative memory 234 as a pointer.
[0034]
The bridge 270 connects the wireless LAN interface 272, the serial interface 274, and the parallel interface 276 to the CPU bus 280. The wireless LAN interface 272 is connected to an external device by a wireless LAN such as IEEE802.11b or a short-range wireless communication such as Bluetooth (registered trademark). The serial interface 274 is connected to an external device by a serial cable such as USB or IEEE1394. The parallel interface 276 is connected to an external device by a parallel cable such as SCSI. Devices connected to the wireless LAN interface 272, the serial interface 274, and the parallel interface 276 may be, for example, information devices such as a digital set-top box, a game machine, a PDA, or a mobile phone, such as a television receiver, a digital camera, A digital device such as an HDD recorder, an audio device, or a DVD player, an electric device such as an air conditioner, a lighting device, or a refrigerator, or a sensor device such as a thermometer, a pressure sensor, or a security sensor may be used. The relay device 150 may control these devices and / or collect information based on control by the user of the LAN or a person authorized by the relay device 150 and the terminals 160a and 160b within the LAN or from the WAN. .
[0035]
As described above, the relay device 150 determines whether to permit or prohibit the relay of the received communication packet based on the session management information stored in the associative storage memory 234 and the session state stored in the session state memory 236. Accordingly, the relay device 150 can relay only valid communication packets, and can secure security of communication between the WAN and the LAN.
[0036]
FIG. 3 shows a configuration of the communication processing device 230 according to the present embodiment. The communication processing device 230 includes a transfer determination unit 310, a transfer processing unit 306, and a state update unit 308.
[0037]
The transfer determination unit 310 determines whether to permit the transfer of an internal packet, which is a communication packet transmitted from the server 120 to the terminal 160, based on the session state information stored in the session state memory 236. Further, the transfer determination unit 310 causes the transfer processing unit 306 to transfer an externally addressed packet, which is a communication packet transmitted from the terminal 160 to the server 120. In the present embodiment, the transfer determination unit 310 has a session management unit 302 and a determination processing unit 304.
[0038]
The session management unit 302 manages the session management information stored in the content addressable memory 234. Then, when the relay device 150 receives the internal packet, the session management unit 302 identifies a session corresponding to the internal packet based on the session management information. The session management unit 302 obtains session management information that specifies a session corresponding to the internal-addressed packet, for example, by giving a search key based on the header information of the internal-addressed packet to the associative memory 234. Further, when the relay device 150 receives the packet addressed to the outside, the session management unit 302 acquires the session management information corresponding to the packet addressed to the outside.
[0039]
Here, in the present embodiment, the content addressable memory 234 stores a pointer to the session state information in the session state memory 236 as at least a part of the session management information. Therefore, the session management unit 302 acquires a pointer to the session state information based on the session management information. Then, the session management unit 302 gives the obtained pointer to the determination processing unit 304.
[0040]
When a session is started, the session management unit 302 registers new session management information in the content addressable memory 234. When the session ends, the session management unit 302 may delete the session management information corresponding to the session.
[0041]
The determination processing unit 304 acquires session state information corresponding to the session identified by the session management unit 302. For example, the determination processing unit 304 acquires the session state information corresponding to the internally addressed packet from the session state memory 236 based on the pointer received from the session management unit 302. Then, based on the session state information, the determination processing unit 304 determines whether to permit the transfer of the internally addressed packet. Further, the determination processing unit 304 causes the transfer processing unit 306 to transfer the packet addressed to the outside. In another example, the determination processing unit 304 may further determine whether the transfer of the packet addressed to the outside is permitted.
[0042]
Note that the determination processing unit 304 may communicate with the CPU 200 or the like via the CPU bus 280, for example. The determination processing unit 304 may cause, for example, the CPU 200 to process an internal-addressed packet based on the session state information, and may determine whether the internal-addressed packet can be transferred based on a result of this processing. The determination processing unit 304 causes the CPU 200 to decrypt, for example, an encrypted internal-addressed packet.
[0043]
When the determination processing unit 304 determines that the transfer of the packet destined for the inside is permitted, the transfer processing unit 306 transfers the packet destined for the inside to the terminal 160. Further, the transfer processing unit 306 transfers the packet addressed to the outside to the server 120. The transfer processing unit 306 may transfer the internal packet and the external packet based on the communication port management information stored in the associative memory 234.
[0044]
The status update unit 308 updates the session status information based on the respective headers of the externally-addressed packet and the internally-addressed packet. As a result, the determination processing unit 304 can determine whether or not the transfer of the internal-addressed packet can be performed based on the session state information that is updated as needed based on the external-addressed packet and the internal-addressed packet. Therefore, according to the present embodiment, it is possible to appropriately and flexibly determine whether or not to forward a packet addressed to the inside.
[0045]
Note that each of the transfer determination unit 310, the transfer processing unit 306, and the state update unit 308 may be operated by a logic circuit configured by hardware, such as a relay program provided from outside the communication processing device 230. May be operated in accordance with the above-mentioned program. Further, the communication processing device 230 is preferably a monolithic LSI formed by one semiconductor chip. In this case, the communication processing device 230 can be provided at low cost.
[0046]
FIG. 4 shows an example of the associative storage memory 234 according to the present embodiment in a table format. The associative memory 234 stores type identification information, timer processing information, timer information, and storage information in predetermined bit fields of a plurality of data stored at different memory addresses.
[0047]
The type identification information is information for identifying the type of storage information stored in the memory address. The storage information includes session management information (S, value “10”), communication port management information (P, value “11”). ") Or invalid information (E, value" 00 ").
[0048]
The timer processing information is erasure flag information indicating whether or not there is a valid period for the storage information stored at the memory address. The timer processing information includes temporary storage information (value 01) that is to be invalidated when the validity period elapses, or fixed storage information that has no validity period and is not invalidated by the elapse of time. Indicates which of the storage information (value 00). As a result, the associative memory 234 stores, as part of the session management information, erasure flag information indicating whether or not the session management information can be erased. The erasure flag information has a value 01 indicating that erasure is possible for session management information that is temporary storage information.
[0049]
Here, when the session management information is temporary storage information, if the transfer processing unit 306 does not transfer the packet addressed to the outside or the packet addressed to the inside corresponding to the session management information for a predetermined period, the session management unit 302 deletes this session management information. Thus, the session management unit 302 can dynamically manage the session management information according to the start and end of the session.
[0050]
On the other hand, when the session management information is fixed storage information, even if the transfer processing unit 306 does not transfer the packet addressed to the outside or the packet addressed to the inside corresponding to the session management information for a predetermined period, the session management unit 302 does not delete this session management information. Thereby, the session management unit 302 can statically manage a predetermined session set in advance.
[0051]
The timer information is information indicating the validity period of the storage information stored in the memory address, and is valid when the timer processing information is “01”. Here, the timer information may be information for identifying the date and / or time when the storage information is stored, or may be information indicating a period until the storage information is invalidated. In the present embodiment, based on the timer information, the session management unit 302 monitors a period during which an externally addressed packet or an internally addressed packet is not transferred.
[0052]
The storage information stores session management information or communication port management information specified by the type identification information. That is, the associative memory 234 stores, for each memory address, session management data including type identification information “10” and session management information, communication port management data including type identification information “11” and communication port management information, Alternatively, one of invalid data including type identification information “00” and invalid information is stored.
[0053]
The session management information stores information for specifying a session between the terminal 160 and the server 120 as information including a network layer protocol, a transport layer protocol, a remote port number, a local port number, a remote address, and a local address. I do. The network layer protocol field indicates a communication protocol classified into a network layer (third layer) in the OSI reference model, such as IP, IPX (registered trademark), Apple Talk (registered trademark), PPPoE, ARP, and RARP. The transport layer protocol field indicates a communication protocol classified into a layer above the transport layer (the fourth layer) in the OSI reference model, such as IPinIP, IPsec, ICMP, UDP, and TCP.
[0054]
The remote port number field and the remote address field indicate a port number and a network address used for communication by the WAN-side communication device such as 120a-b, which communicates with the LAN-side communication device such as the terminals 160a-b. The local port number field and the remote address field indicate a port number and a network address used for communication by LAN-side communication devices such as the terminals 160a and 160b. Here, the port number may be used to identify an application program or a service, and may correspond to, for example, a source port number or a destination port number included in a TCP header in the TCP protocol. The network address may be identification information used for identifying a communication device on a network, such as an IP address in an IP protocol.
[0055]
Here, in the present embodiment, the associative memory 234 outputs the memory address where the storage information corresponding to the received search key is stored. The associative memory 234 stores, for example, session management information corresponding to the search key according to a search key including a network layer protocol, a transport layer protocol, a remote port number, a local port number, a remote address, and a local address. The stored memory address is output as a pointer to the session state information stored in the session state memory 236. Thereby, the associative memory 234 stores the pointer to the session state information as a part of the session management information. In another example, the associative memory 234 may store a pointer to the session state information in a predetermined bit field in the session management information.
[0056]
The session management unit 302 gives these search keys to the associative memory 234 based on the header information of the internal packet, thereby acquiring a pointer to the session state information corresponding to the internal packet. Then, based on the received pointer, the session management unit 302 acquires session state information indicating the state of the session corresponding to the packet destined for the inside.
[0057]
On the other hand, the communication port management information includes the communication port associated with the destination communication device to which the relay device 150 should forward the communication packet and the MAC address to be the destination MAC address of the communication packet, the destination address, the communication port number, and the MAC address. Store as information including address. The destination address field indicates the network address of the destination communication device to which the relay device 150 should transfer the communication packet. The communication port number field indicates the number of the communication port to which the communication packet should be transmitted when the relay device 150 transfers the communication packet to the destination communication device. The MAC address field indicates a MAC address to be used as the destination MAC address of the communication packet when the relay device 150 transfers the communication packet.
[0058]
As described above, according to the relay device 150 of the present embodiment, when both the session management information and the communication port management information are stored in the associative memory 234, each is separately stored in the associative memory. As compared with, the amount of hardware and the cost can be reduced.
[0059]
FIG. 5 shows an example of the session state memory 236 according to the present embodiment in a table format. The session state memory 236 corresponds to the session management information stored in the associative memory 234, and includes session state information including a state of a session in communication between the source communication device and the destination communication device specified by the session management information. Is stored. Here, the session state memory 236 stores the corresponding session state information at a memory address output by the associative storage memory 234 and designated by a pointer to the session state information. For example, the session state memory 236 stores the corresponding session state information at the same memory address as the memory address output by the associative memory 234 as a pointer.
[0060]
The session state memory 236 may store a plurality of pieces of session state information indicating states of a plurality of sessions based on different communication protocols. The session state memory 236 stores, for example, session state information indicating a session state based on a connection type protocol such as TCP and session state information indicating a session state based on a connectionless type protocol such as UDP. Good.
[0061]
In addition, the session state memory 236 may store session state information including different fields according to the communication protocol corresponding to each session. For example, the session state memory 236 may store, as the session state information corresponding to UDP, information corresponding to a part of a field included in the session state information corresponding to TCP.
[0062]
In the present embodiment, the session state memory 236 stores, for example, as session state information corresponding to TCP, a valid flag, control information, a session communication state, a window size, an ACK number, a sequence number, and a relay permission count. The information including each field of is stored. The valid flag field indicates valid (value “1”) or invalid (value “0”) of the session state information. The control information field includes, for example, permission or prohibition of relaying a communication packet from the WAN side to the LAN side, permission or prohibition of relaying of a communication packet from the LAN side to the WAN side, and whether to apply the PPPoE protocol to the communication packet. Contents of communication processing for the communication packet, such as whether or not to set a bandwidth restriction on the communication packet, whether to allow the CPU 200 to perform a part of the communication processing on the communication packet, and whether to encrypt the communication packet. Is shown.
[0063]
For example, the session state memory 236 stores, in the control information field, processing information indicating processing to be performed by the CPU 200 on an externally-addressed packet or an internally-addressed packet. In this case, the CPU 200 gives the result of processing the externally addressed packet or the internally addressed packet according to the processing information to the determination processing unit 304. The determination processing unit 304 may determine, based on the result, whether to permit the transfer of the internally addressed packet.
[0064]
The session communication status field indicates in which state the session in the communication between the source communication device and the destination communication device is defined by the communication protocol. For example, the session communication state “ESTBLSHD” at the memory address 0 indicates a state in which a connection has been established between the source communication device and the destination communication device in the TCP state transition defined by the TCP protocol. The session communication state “SYN_SENT_1” at the memory address 1 indicates that the relay device 150 has received a communication packet transmitted by the terminal 160 to establish a connection and whose SYN flag is “1” in the TCP state transition. Show.
[0065]
The window size field and the ACK number field indicate a window size and an acknowledgment number (ACK number) notified to the destination communication device by a TCP communication packet based on the TCP protocol transmitted from the LAN side to the WAN side. That is, the session state memory 236 stores the window information indicating the value of the window field and the acknowledgment number information indicating the value of the acknowledgment number field in the header of the packet addressed to the outside, in the window size field and the ACK number field in the session state information. To be stored.
[0066]
The sequence number field indicates a sequence number notified to the destination communication device by a TCP communication packet based on the TCP protocol transmitted from the WAN side to the LAN side. That is, the session state memory 236 stores the sequence number information indicating the value of the sequence number field in the header of the internally addressed packet in the sequence number field in the session state information.
[0067]
The relay permission count field indicates the number of times a communication packet having the same sequence number as the sequence number field in the session state information has been relayed. That is, the session state memory 236 stores the same sequence number count information indicating the number of times the transfer device has transferred the internal destination packet having the same value in the sequence number field and the value of the sequence number field by the transfer permission count in the session state information. Store in the field.
[0068]
In the above, the session management information is a network layer protocol field, a transport layer protocol field, a remote port number field, a local bit field, which is a search target bit field corresponding to at least a part of a search key used for searching the session management information. One or more of the port number field, the remote address field, and the local address field may include an optional value “Any” that is a value indicating that it should match an arbitrary value. Here, “Any” is a value that is not normally used as a value of the field, for example, “all”
It may be a value such as 1 ".
[0069]
FIG. 6 is a diagram illustrating an example of the operation of the state update unit 308. In the present embodiment, the relay device 150 transfers, for example, a TCP packet based on TCP as the internal packet and the external packet. In this case, the session state memory 236 stores a TCP state indicating the state of the TCP session between the server 120 and the terminal 160 in the session state field.
[0070]
The session state memory 236 stores one of the following states as the TCP state: CLOSED, SYN_RCVD_1, SYN_RCVD_2, SYN_SENT_1, SYN_SENT_2, ESTBLSHD, FIN_WAIT, CLOSING, TIME_WAIT, CLOSE_WAIT, or LAST_ACK. Here, when the relay device 150 transfers the packet addressed to the inside or the packet addressed to the outside, the state updating unit 308 updates the TCP state indicating the state of the TCP session corresponding to the packet addressed to the inside or the packet addressed to the outside.
[0071]
In the present embodiment, the status update unit 308 updates the TCP status based on the TCP flags in the headers of the external transmission packet and the internal transmission packet. As a result, the session state memory 236 stores the TCP state indicating the state of the TCP session in the server 120 and the state of the TCP session in the terminal 160. Further, the determination processing unit 304 determines whether or not to permit the transfer of the internally addressed packet based on the TCP flag and the TCP status in the header of the internally addressed packet.
[0072]
If the TCP session has not been started, the session state memory 236 stores CLOSED as the TCP state. Here, when the relay device 150 transfers the packet addressed to the inside including the SYN flag, the state updating unit 308 updates the TCP state to SYN_RCVD_1. When the relay device 150 further forwards an externally-addressed packet including the SYN flag and the ACK flag and an internally-addressed packet including the ACK flag, the state updating unit 308 sequentially changes the TCP state to SYN_RCVD_2 and ESTBLSHD, respectively. Update.
[0073]
When the relay device 150 transfers a packet addressed to the outside including the SYN flag, a packet addressed to the inside including the SYN flag and the ACK flag, and a packet addressed to the outside including the ACK flag when the TCP status is CLOSED, the status update is performed. The unit 308 sequentially updates the TCP status to SYN_SENT_1, SYN_SENT_2, and ESTBLSHD.
[0074]
When the TCP state is ESTBLSHD and the relay device 150 transfers an external destination packet including the FIN flag, an internal destination packet including the FIN flag, and an internal destination packet including the ACK flag, the state updating unit 308 , TCP status are sequentially updated to FIN_WAIT, CLOSING, and TIME_WAIT, respectively. In this case, the status update unit 308 updates the TCP status from TIME_WAIT to CLOSED as the predetermined time elapses.
[0075]
When the TCP state is ESTBLSHD and the relay device 150 transfers an internal destination packet including the FIN flag, an external destination packet including the FIN flag, and an internal destination packet including the ACK flag, the state updating unit 308 , TCP status are sequentially updated to CLOSE_WAIT, LAST_ACK, and CLOSED, respectively. According to the present embodiment, the state update unit 308 updates the TCP state according to each of the internal-addressed packet and the external-addressed packet, so that it is possible to appropriately determine whether the transfer of the internal-addressed packet is possible. It should be noted that the internal-addressed packet or the external-addressed packet including the SYN, ACK, or FIN flag is an internal-addressed packet or an external-addressed packet whose SYN, ACK, or FIN flag is “1”, respectively.
[0076]
FIG. 7 is a diagram illustrating the operation of the determination processing unit 304. In the present embodiment, the determination processing unit 304 determines the TCP status, window information (RWND), acknowledgment number information (RNXT), sequence number information (LSEQ), and the same sequence number count information (LSEQ) stored in the session state memory 236. LSCNT), it is determined whether or not the transfer of the packet addressed to the inside can be performed.
[0077]
For example, when the TCP state is SYN_SENT_1, the determination processing unit 304 permits transfer only to an internal destination packet including a SYN flag and an ACK flag or an internal destination packet including an RST flag. When the TCP state is SYN_SENT_2 or SYN_RCVD_2, the determination processing unit 304 permits transfer only to an internally addressed packet including an ACK flag or an RST flag. When the TCP state is SYN_RCVD_1, the determination processing unit 304 permits the transfer only to the internally addressed packet including the SYN flag.
[0078]
When the TCP state is ESTBLSHD, FIN_WAIT, or CLOSING, the determination processing unit 304 permits the transfer only to an internally addressed packet that does not include the SYN flag. When the TCP state is CLOSE_WAIT or LAST_ACK, the determination processing unit 304 permits transfer only to an internally addressed packet that does not include any of the SYN flag and the RST flag.
[0079]
Further, when the TCP state is SYN_SENT_1, the determination processing unit 304 determines whether or not transfer is possible regardless of the value (SEQ #) of the sequence number field in the internal destination packet header. Further, when the TCP state is SYN_SENT_2, SYN_RCVD_2, CLOSE_WAIT, or LAST_ACK, the determination processing unit 304 permits the transfer only to a packet destined for SEQ # = RNXT. When the TCP state is SYN_RCVD_1 or CLOSING, the determination processing unit 304 permits transfer only to an internal destination packet with SEQ # = LSEQ and LSCNT smaller than 4 which is an example of a predetermined upper limit value. .
[0080]
That is, after #CNT reaches a predetermined number, if # SEQ = LSEQ, the determination processing unit 304 does not permit the transfer of the packet addressed to the inside. In this case, the communication device in the LAN such as the terminal 160 can be protected from unauthorized access such as Dos attack, which sends a large amount of data and illegal packets.
[0081]
Further, when the TCP state is ESTBLSHD or FIN_WAIT, the determination processing unit 304 permits transfer only to an internal packet that satisfies RNXT ≦ SEQ # ≦ RNXT + RWND. However, if the packet addressed to the inside includes TCP data and SEQ # = LSEQ, the determination processing unit 304 permits the transfer of the packet addressed to the inside only when LSCNT <4. According to the present embodiment, it is possible to appropriately determine whether or not the transfer of the packet addressed to the inside can be appropriately performed. Thus, the terminal 160 can be protected from unauthorized access from outside the LAN.
[0082]
FIG. 8 is a flowchart illustrating an example of the operation of the communication processing device 230. When the communication packet received by the relay device 150 is a packet addressed to the outside (S102), and the session management information corresponding to the packet addressed to the outside is stored in the associative memory 234 (S104), the transfer processing unit 306 determines The external destination packet is transferred to the server 120 (S106), and the state update unit 308 updates the session state information based on the header of the external destination packet (S108).
[0083]
On the other hand, when the session management information corresponding to the packet addressed to the outside is not stored in the associative memory 234 (S104), the packet addressed to the outside is a packet including a SYN flag and requesting the establishment of a session with the server 120. If there is (S110), the session management unit 302 newly stores the session management information corresponding to the packet addressed to the outside in the associative memory 234 (S112), and proceeds to S106. If the packet addressed to the outside does not include the SYN flag in S110, the determination processing unit 304 discards the packet addressed to the outside (S114).
[0084]
If the communication packet received by the relay device 150 is an internally addressed packet (S102) and the session management information corresponding to the internally addressed packet is stored in the associative memory 234 (S116), the determination processing unit 304 Then, it is determined whether the transfer of the packet addressed to the inside is permitted (S118).
[0085]
Then, when the transfer is permitted, the determination processing unit 304 transfers the internally addressed packet to the terminal 160 (S106), and the state update unit 308 updates the session state information based on the header of the internally addressed packet. (S108).
[0086]
In this case, the status update unit 308 updates, for example, the sequence number information stored in the session status memory 236 and corresponding to this session to information indicating the value of the sequence number field in the header of the packet addressed to the inside.
[0087]
Here, when the session management information corresponding to the internal address packet is not stored in the associative memory 234 (S116), the determination processing unit 304 does not permit the transfer of the internal address packet, and transmits the internal address packet. It is discarded (S114). Also, in the case where the transfer is not permitted in S118, the determination processing unit 304 discards the internally addressed packet (S118). According to the present embodiment, it is possible to appropriately determine whether to transfer an internal transmission packet.
[0088]
As described above, the present invention has been described using the embodiment. However, the technical scope of the present invention is not limited to the scope described in the embodiment. Various changes or improvements can be added to the above embodiment. It is apparent from the description of the appended claims that embodiments with such changes or improvements can be included in the technical scope of the present invention.
[0089]
As is apparent from the above description, according to the present invention, communication packets can be appropriately transferred.
[Brief description of the drawings]
FIG. 1 is a diagram showing a communication system 100 according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a configuration of a relay device 150 according to the embodiment of the present invention.
FIG. 3 is a diagram showing a configuration of a communication processing device 230 according to the embodiment of the present invention.
FIG. 4 is a diagram showing an example of a content addressable memory 234 according to an embodiment of the present invention in a table format.
FIG. 5 is a diagram showing an example of a session state memory 236 according to the embodiment of the present invention in a table format.
FIG. 6 is a diagram illustrating an operation of a state updating unit 308.
FIG. 7 is a diagram illustrating an operation of a determination processing unit 304.
FIG. 8 is a flowchart illustrating an example of an operation of the communication processing device 230.
[Explanation of symbols]
100 communication system, 120a-b server, 130 ISP relay device, 140 external network, 150 relay device, 160a-b terminal, 200 CPU , 210 ... ROM, 220 ... RAM, 230 ... Communication processing device, 232a-d ... Physical layer interface, 234 ... Associative memory, 236 ... Session state memory, 240 ... Hard disk drive, 250 Flexible disk drive, 260 CD-ROM drive, 270 Bridge, 272 Wireless LAN interface, 274 Serial interface, 276 Parallel interface, 280 ... CPU bus, 282 ... I / O bus, 290 ... Flexible Bull disk, 295 ... CD-ROM, 302 ... session management section, 304 ... determining unit, 306 ... transfer processing section, 308 ... state update unit, 310 ... transfer determination unit

Claims (16)

An internal communication device provided in a predetermined network, and a transfer device for transferring a communication packet in communication between an external communication device provided outside the network,
A state storage unit that stores a communication state indicating the state of the communication in the internal communication device;
A state updating unit that updates the communication state based on a header of an externally addressed packet that is a communication packet that the internal communication device transmits to the external communication device,
A transfer determination unit that determines whether to permit transfer of an internal-addressed packet, which is a communication packet transmitted by the external communication device to the internal communication device, based on the communication state,
A transfer device, comprising: a transfer processing unit that transfers the internal-addressed packet to the internal communication device when the transfer determination unit determines that the transfer of the internal-addressed packet is permitted. The internal communication device, further comprising a session management information storage unit that stores session management information specifying a session between the external communication device,
The state storage unit stores the communication state corresponding to the session management information,
The transfer determination unit,
Managing the session management information, and, based on the session management information, a session management unit that identifies the session corresponding to the internally addressed packet; and a communication state corresponding to the session identified by the session management unit. The transfer device according to claim 1, further comprising: a determination processing unit that determines whether to permit the transfer of the internal destination packet based on the determination. The session management information storage unit is a content addressable storage device that stores a pointer to the communication state corresponding to the session as at least a part of the session management information,
The session management unit stores the IP address and port number of the internal communication device and the IP address and port number of the external communication device in the associative storage device based at least on the header information of the internally addressed packet. By giving a search key including, to obtain a pointer to the communication state,
The transfer device according to claim 2, wherein the determination processing unit acquires the communication state corresponding to the internally addressed packet from the state storage unit based on the pointer received from the session management unit. The session management information corresponding to the packet addressed to the outside is not stored in the session management information storage unit, and the packet addressed to the outside is a packet for requesting the establishment of the session with the external communication device. 3. The transfer device according to claim 2, wherein in the case, the session management unit newly stores the session management information corresponding to the packet addressed to the outside in the session management information storage unit. The method according to claim 2, wherein, when the session management information corresponding to the internal destination packet is not stored in the session management information storage unit, the determination processing unit does not permit the transfer of the previous internal destination packet. The transfer device as described. The transfer processing unit further transfers the external-addressed packet to the external communication device,
When the transfer processing unit does not transfer the externally addressed packet or the internally addressed packet corresponding to the session management information for a predetermined period, the session management unit deletes the session management information. The transfer device according to claim 2. The session management information storage unit stores erasure flag information indicating whether or not the session management information can be erased, as at least a part of the session management information,
When the transfer processing unit does not transfer the externally-addressed packet or the internally-addressed packet corresponding to the session management information for a predetermined period, the erasure flag information corresponding to the session management information can be erased. 7. The transfer device according to claim 6, wherein the session management unit deletes the session management information when indicating that the session management information is the same. A packet processing unit that processes the externally addressed packet or the internally addressed packet,
The state storage unit stores, as at least a part of the communication state, processing information indicating a process to be performed by the packet processing unit on the externally-addressed packet or the internally-addressed packet,
Based on a result of the packet processing unit processing the externally-addressed packet or the internal-addressed packet according to the processing information, the transfer determination unit determines whether to permit the transfer of the internal-addressed packet. The transfer device according to claim 1, wherein The transfer device transfers a TCP packet based on TCP (Transport Control Protocol) as the internal-addressed packet and the external-addressed packet,
The state storage unit stores a TCP state indicating a state of a TCP session in the internal communication device as at least a part of the communication state,
The state updating unit updates the TCP state based on a TCP flag in a header of the packet addressed to the outside,
The transfer according to claim 1, wherein the transfer determination unit determines whether to permit the transfer of the internal packet based on a TCP flag in a header of the internal packet and the TCP state. apparatus. The state storage unit stores acknowledgment number information indicating a value of an acknowledgment number field in a header of the externally-addressed packet as at least a part of the communication state,
The method according to claim 1, wherein the transfer determination unit determines whether to permit the transfer of the internal packet based on a value of a sequence number field in a header of the internal packet and the acknowledgment number information. 10. The transfer device according to 9. The state storage unit further stores window information indicating a value of a window field in a header of the externally-addressed packet as at least a part of the communication state,
The transfer determining unit determines whether to permit transfer of the internal packet based on a value of a sequence number field in a header of the internal packet, the acknowledgment number information, and the window information. The transfer device according to claim 10, wherein The state storage unit stores information based on a header of the internally addressed packet as at least a part of the communication state,
The state update unit further updates the communication state based on a header of the internally addressed packet,
The transfer device according to claim 9, wherein the transfer determination unit determines whether to permit the transfer of the internally addressed packet based on the communication state. The state storage unit stores, as the TCP state, information further indicating a state of a TCP session in the external communication device,
The state updating unit further updates the TCP state based on a TCP flag in a header of the internal destination packet,
13. The transfer device according to claim 12, wherein the transfer determination unit determines whether to permit the transfer of the packet destined for the inside based on the TCP state. The state storage unit stores sequence number information indicating a value of a sequence number field in a header of the internally addressed packet as at least a part of the communication state,
When the transfer of the internal-addressed packet is permitted, the state updating unit updates the sequence number information to information indicating a value of a sequence number field in a header of the internal-addressed packet,
13. The transfer device according to claim 12, wherein the transfer determination unit determines whether to permit the transfer of the internally addressed packet based on the sequence number information. The state storage unit stores at least one of the communication states as the same sequence number count information indicating the number of times the transfer device has transferred the internal destination packet having the same value as the sequence number information and the value of the sequence number field. Further stored as a part,
After the number of times indicated by the same sequence number number information reaches a predetermined number, if the value of the sequence number field in the internally addressed packet is equal to the value indicated by the sequence number information, the transfer determination unit The transfer device according to claim 14, wherein transfer of the packet addressed to the inside is not permitted. A transfer method for transferring a communication packet in communication between an internal communication device provided in a predetermined network and an external communication device provided outside the network,
A state storing step of storing a communication state indicating the state of the communication in the internal communication device;
A state updating step of updating the communication state based on a header of an externally addressed packet, which is a communication packet transmitted by the internal communication device to the external communication device,
A transfer determination step of determining whether to permit transfer of an internal-addressed packet, which is a communication packet transmitted by the external communication device to the internal communication device, based on the communication state;
A transfer processing step of transferring the internal destination packet to the internal communication device when it is determined in the transfer determination step that the transfer of the internal destination packet is permitted.

Images