JP2005341188A - Communication terminal and relay equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication terminal capable of reducing a processing load in a control means, without discarding a necessary packet, when a received packet and a packet already received are duplicated. <P>SOLUTION: A communication terminal 10 includes a communication means 11 for transmitting and receiving a packet to/from equipment connected to a network; a decision means 13, having a calculation means 14 for calculating a value obtained from a received packet which is received by the communication means 11, and a classification means 15 for classifying the received packet on the basis of the value calculated in the calculation means 14, for deciding that the received packets are identical, when there are a plurality of received packets having identical values into which the classification means 15 has classified; an extraction means 16 for extracting a particular packet from among the packets decided to be identical in the decision means 13; and a control means 17 for processing the particular packet extracted in the extraction means 16, and a packet which has been decided as not being identical in the decision means 13. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication terminal and a relay device that transmit and receive packets to and from a device connected to a network.

In recent years, communication terminals such as personal computers having a filtering function and relay devices such as routers have become widespread. The filtering function is a function that blocks packets received by the communication terminal and the relay device under conditions set by the user. For example, as a conventional relay device having a filtering function, a packet compliant with IP (Internet Protocol) and TCP (Transmission Control Protocol) is received from a network, and a sequence number set in the received packet and a packet duplication It is judged whether or not to relay the packet by comparing with a sequence number that is a criterion for detecting the packet, and the packet that is determined not to be relayed is blocked and discarded, and the packet that is determined to be relayed is transferred to another network What is relayed is known (for example, refer to Patent Document 1). In addition, the conventional relay device increases the transmission efficiency of the network by discarding traffic that has become invalid due to duplication or discarding of IP packets (duplicated IP packets or TCP segments in which a part is discarded). Yes.
JP 2003-229900 A

  However, in such a conventional technique, traffic that has become invalid due to the discarding of the packet is discarded, and the discarding itself is not reduced. On the other hand, in an IP network, “a packet for notifying one's existence” such as UPnP (Universal Plug and Play) or “a device that is connected to the network” such as ARP (Address Resolution Protocol) is inquired. Packets "etc. may be sent periodically. In particular, in UPnP, since the same packet is transmitted a plurality of times on the assumption of packet discard, it is not necessary to receive all of them.

  The present invention has been made to solve the conventional problem. When a received packet and a received packet are duplicated, the duplicated packet which is necessary but not necessary to process all is thinned out ( The purpose is to reduce the processing load by processing (reducing the number).

  The communication terminal of the present invention includes a communication unit that transmits and receives a packet to and from a device connected to a network, and a determination unit that determines whether a packet received by the communication unit is the same as a received packet. Extraction means for extracting a specific packet from packets determined to be the same by the determination means, and control means for discarding the specific packet extracted by the extraction means and processing packets determined to be not the same by the determination means And a configuration provided with.

  With this configuration, when a received packet and a received packet are duplicated, the duplicated packets that are necessary but do not need to be processed all are reduced (reduced) to reduce the processing load. can do.

  In addition, the extraction unit of the communication terminal according to the present invention has a configuration in which one packet within the predetermined time is extracted as the specific packet among the packets determined by the determination unit to be the same every predetermined time. Yes.

  With this configuration, in order to extract, as a specific packet, one packet within a predetermined time among packets determined to be the same every predetermined time, a time interval for repeatedly receiving the same packet, for example, a packet conforming to UPnP If the predetermined time is shorter than the above, it is not determined that the packets conforming to the ARP are the same, and the necessary packets can be prevented from being discarded.

  Furthermore, the communication terminal of the present invention comprises distribution means for distributing the packets received by the communication means into priority packets that are processed with priority and non-priority packets that are processed without priority. The distribution unit has a configuration in which the priority packet is processed by the control unit and the non-priority packet is determined by the determination unit.

  With this configuration, since priority packets that are processed with priority are assigned to non-priority packets that are processed without priority, if a packet whose delay is guaranteed is a priority packet, for example, a packet representing audio or video, etc. Packets with guaranteed delays can be processed with priority.

  Further, the determination means of the communication terminal of the present invention includes a calculation means for calculating a value obtained from a received packet that is a packet received by the communication means, and the received packet for each value calculated by the calculation means. A classifying unit that classifies the received packets, and the classifying unit determines that the received packets are the same when there are a plurality of the received packets classified into the same value.

  With this configuration, the value obtained from the received packet is calculated, the received packet is classified for each calculated value, and the received packets classified into the same value are determined to be the same. There is no need to compare, and the same received packet can be extracted efficiently.

  Furthermore, the calculation means of the communication terminal according to the present invention has a configuration for calculating a value obtained from data in which a specific bit field constituting the received packet is masked.

  With this configuration, a value obtained from data in which a specific bit field constituting the received packet is masked is calculated, the received packet is classified for each calculated value, and the received packets classified into the same value are determined to be the same. Therefore, even if the content of the payload portion of the packet is the same packet, it is possible to detect an attack from a TTL or a plurality of terminals that change due to a different route even in the same packet as the same packet.

  Furthermore, the communication terminal of the present invention has a configuration in which a specific bit field constituting the received packet is masked, and when a plurality of packets having matching fields other than the masked bit field are received, it is detected as a duplicate packet. ing.

  With this configuration, packets having the same transmission source address and received packet control content can be extracted as the same received packet.

  Further, the extraction means of the communication terminal according to the present invention has a configuration in which all the same packets are discarded when the number of packets determined by the determination means exceeds a certain number.

  With this configuration, the value obtained from the data composed of the bit field representing the source address constituting the received packet and the bit field representing the control content of the received packet is calculated, and the received packet is classified for each calculated value. For example, if the received packets classified into the same value are determined to be the same and, for example, the bit field indicating the control content is a TCP SYN bit, a DoS attack such as a SYN flood attack can be prevented.

  The relay device according to the present invention includes a communication unit that relays a packet transmitted and received between a communication terminal connected to a network and another communication terminal, and whether the packet received by the communication unit is the same as the received packet. A determination means for determining whether or not, an extraction means for extracting a specific packet from packets determined to be the same by the determination means, a specific packet extracted by the extraction means and a packet for which the determination means is not the same And a control means for processing.

  With this configuration, the extraction unit extracts a specific packet from the packets determined to be the same so that the control unit does not process unnecessary packets, and the control unit determines that the extracted specific packet is not the same as the extracted specific packet. Since the packet is processed, the processing load of the control unit can be reduced without discarding a specific packet that is necessary.

  In addition, the extraction unit of the relay apparatus according to the present invention has a configuration in which one packet within the predetermined time is extracted as the specific packet among the packets that the determination unit determines to be the same every predetermined time. Yes.

  With this configuration, in order to extract, as a specific packet, one packet within a predetermined time among packets determined to be the same every predetermined time, for example, a time interval for repeatedly receiving the same packet such as a packet compliant with ARP If the predetermined time is shorter than the above, it is not determined that the packets conforming to the ARP are the same, and the necessary packets can be prevented from being discarded.

  The relay apparatus according to the present invention further includes a distribution unit that distributes the packets received by the communication unit into priority packets that are processed with priority and non-priority packets that are processed without priority. The distribution unit has a configuration in which the priority packet is processed by the control unit and the non-priority packet is determined by the determination unit.

  With this configuration, since priority packets that are processed with priority are assigned to non-priority packets that are processed without priority, if a packet whose delay is guaranteed is a priority packet, for example, a packet representing audio or video, etc. Packets with guaranteed delays can be processed with priority.

  Further, the determination unit of the relay apparatus of the present invention includes a calculation unit that calculates a value obtained from a received packet that is a packet received by the communication unit, and the received packet for each value calculated by the calculation unit. A classifying unit that classifies the received packets, and the classifying unit determines that the received packets are the same when there are a plurality of the received packets classified into the same value.

  With this configuration, the value obtained from the received packet is calculated, the received packet is classified for each calculated value, and the received packets classified into the same value are determined to be the same. There is no need to compare, and the same received packet can be extracted efficiently.

  Furthermore, the calculation means of the relay apparatus of the present invention has a configuration for calculating a value obtained from data in which a specific bit field constituting the received packet is masked.

  With this configuration, a value obtained from data in which a specific bit field constituting the received packet is masked is calculated, the received packet is classified for each calculated value, and the received packets classified into the same value are determined to be the same. Therefore, even if the contents of the payload portion of the packet are the same, it is possible to extract packets having different specific bit fields included in the header portion of the packet as the same received packet.

  Further, the calculation means of the relay apparatus according to the present invention calculates a value obtained from data configured by a bit field indicating a source address constituting the received packet and a bit field indicating control contents of the received packet. It has a configuration.

  With this configuration, the value obtained from the data composed of the bit field representing the source address constituting the received packet and the bit field representing the control content of the received packet is calculated, and the received packet is classified for each calculated value. Since the received packets classified into the same value are determined to be the same, it is possible to extract packets having the same transmission source address and the same control content of the received packet as the same received packet.

  Further, the extraction means of the relay device of the present invention has a configuration in which all the same packets are discarded when the number of packets determined by the determination means exceeds a certain number.

  With this configuration, the value obtained from the data composed of the bit field representing the source address constituting the received packet and the bit field representing the control content of the received packet is calculated, and the received packet is classified for each calculated value. When the received packets classified into the same value are determined to be the same and the number of packets determined to be the same exceeds a certain number, all the same packets are discarded. If the SYN bit is used, a DoS attack such as a SYN flood attack can be prevented.

  The present invention reduces the processing load by thinning out (reducing the number of) duplicate packets that are necessary but not required to be processed when the received packet and the received packet overlap. The purpose is to do.

Hereinafter, a network system according to an embodiment of the present invention will be described with reference to the drawings.
(First embodiment)
FIG. 1 shows a block diagram of a network system according to the first embodiment of the present invention. As shown in FIG. 1, the network system includes a router 6 connected to the network 8 and the network 9, and a communication terminal 7 and a communication terminal 10 connected to the network 8. The communication terminal 7 and the communication terminal 10 may be information home appliance terminals, personal computers, and the like, and the router 6 may be a router installed in a house. The network 8 may be a LAN (Local Area Network) or the like, and the network 9 may be a WAN (Wide Area Network) such as the Internet.

  FIG. 2 shows a block diagram of the communication terminal according to the first embodiment of the present invention. As shown in FIG. 2, the communication terminal 10 includes a communication unit 11 that transmits and receives packets to and from a device connected to the network 8, a buffer 12 that accumulates packets received by the communication unit 11, and a communication unit 11. Determining means 13 for determining whether the received packet and the received packet stored in the buffer 12 are the same; an extracting means 16 for extracting a specific packet from the packets determined by the determining means 13; and The control unit 17 is configured to process the specific packet extracted by the unit 16 and the packet determined to be different from the determination unit 13.

  Note that the communication unit 11 may be configured by a device such as a network interface. For example, the communication unit 11 transmits and receives packets to and from a device connected to the network 8 in accordance with the Ethernet (registered trademark) standard. ing. The buffer 12 may be configured by a device such as a RAM (Random Access Memory).

  The determination unit 13 and the extraction unit 16 may be configured by a device such as an integrated circuit. The determination unit 13 includes a calculation unit 14 that calculates a value obtained from a received packet that is a packet received by the communication unit 11, and a classification unit 15 that classifies the received packet for each value calculated by the calculation unit 14. Have The control means 17 may be configured by a CPU (Central Processing Unit) or the like, and is a processor that processes a program.

  The operation of the network system according to the first embodiment of the present invention will be described below. A sequence diagram of packets received by the communication terminal 10 is shown in FIG. As illustrated in FIG. 3, the router 6 transmits packets to the communication terminal 10 in the order of packet A, packet C, packet F, and packet G. Further, the communication terminal 7 transmits packets to the communication terminal 10 in the order of packet B, packet D, and packet E. In the present embodiment, these packets conform to the Ethernet (registered trademark) standard, and also conform to protocols such as IP, TCP, ARP, and UPnP.

  In FIG. 2, packets A to G transmitted by the router 6 and the communication terminal 10 are accumulated in the buffer 12. Further, the packet A and the packet B are discarded by the extraction unit 16 because the packet received by the communication terminal 10 and the packet that has already been received are the same. The operation in which the communication terminal 10 discards the packet will be described later.

  FIG. 4 is a diagram for explaining the operations of the calculation unit 14 and the classification unit 15 included in the determination unit 13. The calculating means 14 calculates a hash value from the received packet stored in the buffer 12 using a predetermined hash function. The classification unit 15 classifies the received packet for each hash value calculated by the calculation unit 14. Further, the classification unit 15 creates a hash table 19 representing a correspondence relationship between the hash value and the count number obtained by counting the number of received packets having the same hash value in the order received.

  As shown in FIG. 4, the calculation means 14 uses a predetermined hash function from the packet A, the packet B, the packet C, the packet D, the packet E, the packet F, and the packet G to set each hash value to “5”. ”,“ 1 ”,“ 200 ”,“ 1 ”,“ 255 ”,“ 5 ”,“ 100 ”, and the classifying unit 15 creates the hash table 19 based on the calculated hash values. . For example, in the packet A and the packet F having the hash value “5”, the count values are “1” and “2”, respectively, and the determination unit 13 receives the received packets classified by the classification unit 15 into the same hash value. Therefore, it is determined that the packet A and the packet F are the same.

  The extraction unit 16 performs packet filtering by extracting one packet within a predetermined time among the packets determined by the determination unit 13 to be the same every predetermined time as a specific packet. FIG. 5 is a diagram for explaining the operation of the extraction unit 16, and is a diagram for explaining the operation related to the extraction of the packet having the hash value “5”.

  Since the hash value calculated from the packet A and the packet F is “5” within the time T from the time t0 to the time t1, the extraction unit 16 uses the latest received packet within the time T at the time t1. A certain packet F is extracted, and a packet A that becomes a packet other than the extracted packet is discarded. The time T is a predetermined time such as one second, and is a predetermined time. In the present embodiment, the extraction unit 16 extracts the received packet that is the latest received packet within the time T and corresponds to the largest count value as a specific packet.

  When the hash value calculated from the received packets from the packet Z1 to the packet Z5 is “5” within the time T from the time t1 to the time t2, the extraction unit 16 determines that the time T2 at the time t2 Packet Z5 which is the latest received packet is extracted, and all received packets from packet Z1 to packet Z4 which are packets other than the extracted packet are discarded. Of course, the extraction unit 16 also applies the latest to the received packets whose hash value is other than “5” among the received packets that the determination unit 13 determines to be the same every predetermined time at the time t1 or the time t2. The received packet is extracted. For example, in FIG. 3, the extraction unit 16 extracts the packet D that is the latest received packet from the packet B and the packet D with the hash value “1”.

  The control means 17 processes the received packet determined that the specific packet extracted by the extraction means 16 and the determination means 13 are not the same. As shown in FIG. 2, the packet F and the packet D, which are the received packets extracted by the extracting unit 16 as specific packets, and the packet C, the packet E, which are the received packets that the determining unit 13 determines are not the same, and The control means 17 processes the packet G.

  As described above, in the communication terminal according to the first embodiment of the present invention, the extraction unit 16 extracts a specific packet from packets determined to be the same so that the control unit 17 does not process unnecessary packets. Since the extracted specific packet and the packet determined not to be identical are processed by the control unit 17, the processing load on the control unit 17 can be reduced without discarding the required specific packet.

  In addition, in order to extract one packet within a predetermined time out of packets determined to be the same every predetermined time as a specific packet, for example, a time for repeatedly receiving the same packet such as a packet compliant with ARP or UPnP If the predetermined time is shorter than the interval, it is not determined that the packets conforming to the ARP are the same, and the necessary packets can be prevented from being discarded.

  Also, it calculates the hash value obtained from the received packet, classifies the received packet for each calculated hash value, and determines that the received packets classified into the same hash value are the same. Need to be compared, and the same received packet can be extracted efficiently.

Note that the relay device such as the router 6 may be configured to include the communication unit 11, the buffer 12, the determination unit 13, the extraction unit 16, and the control unit 17 that configure the communication terminal 10. Even with the above means, the same effect as described above can be obtained.
(Second Embodiment)
FIG. 6 shows a block diagram of a network system according to the second embodiment of the present invention. As shown in FIG. 6, the network system includes a router 6 connected to the network 8 and the network 9, and a communication terminal 7 and a communication terminal 20 connected to the network 8.

  Of the components constituting the network system according to the second embodiment of the present invention, the same components as those constituting the network system according to the first embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  FIG. 7 shows a block diagram of a communication terminal according to the second embodiment of the present invention. As shown in FIG. 7, the communication terminal 20 assigns the communication means 11 to priority packets processed with priority on packets received by the communication means 11 and non-priority packets processed without priority. The distribution unit 28, the buffer 12, the determination unit 13, the extraction unit 16, and the control unit 17 are provided. The distribution means 28 may be configured by a device such as an integrated circuit.

  Of the components constituting the communication terminal according to the second embodiment of the present invention, the same components as those constituting the communication terminal according to the first embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  The operation of the network system according to the second embodiment of the present invention will be described below. A sequence diagram of packets received by the communication terminal 20 is shown in FIG. As illustrated in FIG. 8, the router 6 transmits packets to the communication terminal 20 in the order of packet A, packet C, packet F, and packet G. Further, the communication terminal 7 transmits packets to the communication terminal 20 in the order of packet B, packet D, and packet E.

  Note that the packet G is H.264 which is SIP (Session Initiation Protocol) or ITU-T recommendation. A packet that conforms to protocols such as UDP (User Datagram Protocol) and RTP (Real-time Transport Protocol) that are sent and received after a session conforming to H.323 is established and delivery confirmation is not performed, and represents audio and video Packet. In the present embodiment, packets conforming to protocols such as RTP are preferentially processed.

  As shown in FIG. 7, the allocating means 28 includes a packet G, which is a priority packet processed with priority on the packet received by the communication means 11, and a packet A, which is a non-priority packet processed without priority. To packet F. In addition, the distribution unit 28 causes the control unit 17 to process the distributed priority packets and stores the non-priority packets in the buffer 12 so that the determination unit 13 can determine them. As shown in FIG. 8, since the packet G is given priority, it is processed by the control means 17 earlier than the packet F.

  As described above, the communication terminal according to the second embodiment of the present invention distributes priority packets that are processed with priority and non-priority packets that are processed without priority, so that a delay is guaranteed. For example, a packet that guarantees a delay, such as a packet representing audio or video, can be preferentially processed.

Note that the relay device such as the router 6 may be configured to include the communication unit 11, the buffer 12, the determination unit 13, the extraction unit 16, the control unit 17, and the distribution unit 28 that configure the communication terminal 20. Even when the router 6 includes these means, the same effect as described above can be obtained.
(Third embodiment)
FIG. 9 shows a block diagram of a network system according to the third embodiment of the present invention. As shown in FIG. 9, the network system includes a network 8 and a router 6 connected to the network 9, and a communication terminal 7 and a communication terminal 30 connected to the network 8.

  Of the components constituting the network system according to the third embodiment of the present invention, the same components as those constituting the network system according to the second embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  FIG. 10 shows a block diagram of a communication terminal according to the third embodiment of the present invention. As shown in FIG. 10, the communication terminal 30 calculates the value obtained from the communication unit 11, the distribution unit 28, the buffer 12, and the data obtained by masking the specific bit field constituting the received packet. The determination means 33, the extraction means 16, and the control means 17 are provided.

  Of the components constituting the communication terminal according to the third embodiment of the present invention, the same components as those constituting the communication terminal according to the second embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  The operation of the network system according to the third embodiment of the present invention will be described below. A sequence diagram of packets received by the communication terminal 30 is shown in FIG. As shown in FIG. 11, the router 6 transmits packets to the communication terminal 30 in the order of packet A, packet C, packet F, and packet G. Further, the communication terminal 7 transmits packets to the communication terminal 30 in the order of packet B, packet D, and packet E.

  FIG. 12 is a diagram for explaining the operations of the calculation unit 34 and the classification unit 15 included in the determination unit 33. The calculating means 34 masks a specific bit field constituting the received packet stored in the buffer 12 by taking a logical product with 0, for example, and uses a predetermined hash function to calculate a hash value from the masked data. calculate.

  Specific bit fields include, for example, FCS (Frame Check Sequence) defined by Ethernet (registered trademark), TTL (Time To Live) and Checksum defined by the header part in IP, or TCP or UDP The checksum defined in the header part in FIG. Even if the contents of the payload portion of the packet are the same packet, the specific bit field included in the header portion of the packet is different, so that the calculation means 34 masks the specific bit field by taking the logical product with 0. A hash value is calculated from the data using a predetermined hash function.

  As shown in FIG. 12, the calculation means 34 masks a specific bit field included in packet A, packet B, packet C, packet D, packet E, and packet F by performing logical AND with 0. Each hash value is calculated as “121”, “35”, “6”, “35”, “35”, “121” from the data using a predetermined hash function, and the classification means 15 calculates A hash table 19 is created based on each hash value.

  For example, in the packet B, packet D, and packet E with the hash value “35”, the count values are “1”, “2”, and “3”, respectively. Since there are a plurality of received packets classified into hash values, it is determined that packet B, packet D, and packet E are the same.

  Also, as shown in FIGS. 10 and 11, the extraction unit 16 extracts the packet F and the packet E that are the latest packets within a predetermined time from among the packets that the determination unit 33 determines to be the same every predetermined time. The control unit 17 processes the packet F and the packet E extracted by the extraction unit 16, the packet C that is a received packet determined by the determination unit 13 not to be the same, and the priority packet G.

  As described above, the communication terminal according to the third embodiment of the present invention calculates a hash value obtained from data in which a specific bit field constituting a received packet is masked, and calculates each calculated hash value. The received packet classified into the same hash value is determined to be the same, so even if the contents of the payload portion of the packet are the same packet, the specific bit field included in the header portion of the packet is Different packets can be extracted as the same received packet.

Note that the relay device such as the router 6 may be configured to include the communication unit 11, the buffer 12, the determination unit 33, the extraction unit 16, the control unit 17, and the distribution unit 28 that configure the communication terminal 30. Even when the router 6 includes these means, the same effect as described above can be obtained.
(Fourth embodiment)
FIG. 13 shows a block diagram of a network system according to the fourth embodiment of the present invention. As shown in FIG. 13, the network system includes a router 6 connected to the network 8 and the network 9, and a communication terminal 7 and a communication terminal 40 connected to the network 8.

  Of the components constituting the network system according to the fourth embodiment of the present invention, the same components as those constituting the network system according to the second embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  FIG. 14 shows a block diagram of a communication terminal according to the fourth embodiment of the present invention. As shown in FIG. 14, the communication terminal 40 uses the communication means 11, the distribution means 28, the buffer 12, a bit field that represents the address of the transmission source constituting the received packet, and a bit field that represents the control content of the received packet. A determination means 43 having a calculation means 44 for calculating a value obtained from the configured data, an extraction means 46 for discarding all the same packets when the number of packets determined to be the same by the determination means 43 exceeds a certain number, and A control means 17 is provided.

  Of the components constituting the communication terminal according to the fourth embodiment of the present invention, the same components as those constituting the communication terminal according to the second embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  The operation of the network system according to the fourth embodiment of the present invention will be described below. A sequence diagram of packets received by the communication terminal 40 is shown in FIG. As shown in FIG. 15, the router 6 transmits packets to the communication terminal 40 in the order of packet A, packet C, packet F, and packet G. Further, the communication terminal 7 transmits packets to the communication terminal 40 in the order of packet B, packet D, and packet E.

  FIG. 16 is a diagram for explaining the operations of the calculation unit 44 and the classification unit 15 included in the determination unit 43. The calculating means 44 calculates a hash value from a data composed of a bit field indicating a transmission source address constituting the received packet stored in the buffer 12 and a bit field indicating the control content of the received packet as a predetermined hash function. Use to calculate.

  Examples of the bit field representing the address of the transmission source constituting the received packet include the IP address of the transmission source defined by the header part in IP. In addition, as a bit field representing the control content of the received packet, there are a protocol field defined in the header part in IP and a SYN bit defined in the TCP header part. The calculation unit 44 calculates a hash value from the IP address of the transmission source, the protocol field, and the SYN bit using a predetermined hash function.

  As shown in FIG. 16, the calculation means 44 calculates a predetermined hash from the IP address, protocol field, and SYN bit of the transmission source included in the packet A, packet B, packet C, packet D, packet E, and packet F. Using the function, the respective hash values are calculated as “200”, “6”, “35”, “6”, “6”, “2”, and the classifying means 15 calculates the calculated hash values. Based on this, a hash table 19 is created.

  For example, in packet B, packet D, and packet E with the hash value “6”, the IP address of the transmission source is the same and conforms to TCP, so the protocol field is also the same, and the SYN bit Is 1. In addition, since the count values are “1”, “2”, and “3”, respectively, and the determination unit 43 includes a plurality of received packets classified by the classification unit 15 into the same hash value, the packet B, the packet D, and the packet E is determined to be the same (detected as a duplicate packet). The judging means 43 masks and masks the bit fields other than the source IP address, protocol field, and SYN bit included in the packet A, packet B, packet C, packet D, packet E, and packet F. A packet other than the bit field, that is, a packet in which the transmission source IP address, the protocol field, and the SYN bit match may be determined to be the same and detected as a duplicate packet.

  The extracting unit 46 discards all the same packets when the number of packets determined to be the same by the determining unit 43 exceeds a certain number within a predetermined time. For example, if the determination unit 43 determines that the packet B, the packet D, and the packet E are the same when the fixed number is 2, the extraction unit 46 exceeds the fixed number 2 because the number of the same packets exceeds 2. 14 and FIG. 15, the packet B, the packet D, and the packet E are discarded. The control unit 17 processes the packet A, the packet C, the packet F, and the prioritized packet G, which are received packets that are determined not to be the same by the determination unit 43.

  As described above, the communication terminal according to the fourth embodiment of the present invention is based on the data configured by the bit field indicating the address of the transmission source constituting the received packet and the bit field indicating the control content of the received packet. Packets with the same sender address and the same control content of the received packet are calculated to calculate the obtained hash value, classify the received packet for each calculated hash value, and determine that the received packets classified into the same hash value are the same. Can be extracted as the same received packet.

  Also, the hash value obtained from the data composed of the bit field representing the address of the transmission source constituting the received packet and the bit field representing the control content of the received packet is calculated, and the received packet is classified for each calculated hash value. When the received packets classified into the same hash value are determined to be the same and the number of packets determined to be the same exceeds a certain number, all the same packets are discarded. If the SYN bit is used, a DoS attack such as a SYN flood attack can be prevented.

  Note that the relay device such as the router 6 may be configured to include the communication unit 11, the buffer 12, the determination unit 43, the extraction unit 46, the control unit 17, and the distribution unit 28 that constitute the communication terminal 40. Even when the router 6 includes these means, the same effect as described above can be obtained.

  As described above, the communication terminal and the relay device according to the present invention can reduce the processing load of the control unit without discarding the necessary packet when the received packet and the received packet overlap. It is useful as a communication terminal, a relay device, and the like that have the effect of being able to transmit and receive packets to and from a device connected to a network.

The block block diagram of the network system which concerns on the 1st Embodiment of this invention The block block diagram of the communication terminal which concerns on the 1st Embodiment of this invention The sequence diagram of the packet which the communication terminal which concerns on the 1st Embodiment of this invention receives The figure for demonstrating operation | movement of the calculation means and the classification | category means which concerns on the 1st Embodiment of this invention The figure for demonstrating operation | movement of the extraction means which concerns on the 1st Embodiment of this invention The block block diagram of the network system which concerns on the 2nd Embodiment of this invention The block block diagram of the communication terminal which concerns on the 2nd Embodiment of this invention. Sequence diagram of packets received by a communication terminal according to the second embodiment of the present invention The block block diagram of the network system which concerns on the 3rd Embodiment of this invention The block block diagram of the communication terminal which concerns on the 3rd Embodiment of this invention. Sequence diagram of packets received by a communication terminal according to the third embodiment of the present invention The figure for demonstrating operation | movement of the calculation means and classification means based on the 3rd Embodiment of this invention. The block block diagram of the network system which concerns on the 4th Embodiment of this invention The block block diagram of the communication terminal which concerns on the 4th Embodiment of this invention Sequence diagram of packets received by a communication terminal according to the fourth embodiment of the present invention The figure for demonstrating operation | movement of the calculation means and classification means based on the 4th Embodiment of this invention

Explanation of symbols

6 router 7, 10, 20, 30, 40 communication terminal 8, 9 network 11 communication means 12 buffer 13, 33, 43 determination means 14, 34, 44 calculation means 15 classification means 16, 46 extraction means 17 control means 19 hash table 28 Sorting means

Claims (14)

A communication means for transmitting and receiving packets to and from a device connected to the network;
Determining means for determining whether or not the packet received by the communication means and the received packet are the same;
Extraction means for extracting a specific packet from the packets determined to be the same by the determination means;
A communication terminal, comprising: a control unit that processes a specific packet extracted by the extraction unit and a packet that is determined not to be the same. 2. The communication terminal according to claim 1, wherein the extraction unit extracts, as the specific packet, one packet within the predetermined time among the packets that the determination unit determines to be the same every predetermined time. . The communication terminal includes a distribution unit that distributes a priority packet processed with priority to a packet received by the communication unit and a non-priority packet processed without priority,
The communication terminal according to claim 1, wherein the distribution unit causes the control unit to process the priority packet and causes the determination unit to determine the non-priority packet. The determination means calculates a value obtained from a received packet that is a packet received by the communication means;
Classification means for classifying the received packet for each value calculated by the calculation means;
The communication terminal according to any one of claims 1 to 3, wherein the classification unit determines that the received packets are the same when a plurality of the received packets classified into the same value exist. The communication terminal according to claim 4, wherein the calculating unit calculates a value obtained from data in which a specific bit field constituting the received packet is masked. 5. The communication terminal according to claim 4, wherein a specific bit field constituting the received packet is masked, and when a plurality of packets having matching fields other than the masked bit field are received, it is detected as a duplicate packet. . The communication terminal according to claim 6, wherein the extraction unit discards all the same packets when the number of packets determined to be the same by the determination unit exceeds a certain number. A communication means for relaying packets transmitted and received between a communication terminal connected to the network and another communication terminal;
Determining means for determining whether or not the packet received by the communication means and the received packet are the same;
Extraction means for extracting a specific packet from the packets determined to be the same by the determination means;
A relay apparatus comprising: a control unit that processes a specific packet extracted by the extraction unit and a packet that is determined not to be the same as the determination unit. 9. The relay apparatus according to claim 8, wherein the extracting unit extracts one packet within the predetermined time among the packets determined by the determining unit to be the same every predetermined time as the specific packet. . The relay device includes a distribution unit that distributes a priority packet processed with priority to a packet received by the communication unit and a non-priority packet processed without priority,
The relay apparatus according to claim 8 or 9, wherein the distribution unit causes the control unit to process the priority packet and causes the determination unit to determine the non-priority packet. The determination means calculates a value obtained from a received packet that is a packet received by the communication means;
Classification means for classifying the received packet for each value calculated by the calculation means;
The relay apparatus according to any one of claims 8 to 10, wherein the classification unit determines that the received packets are the same when there are a plurality of the received packets classified into the same value. The communication terminal according to claim 11, wherein the calculation unit calculates a value obtained from data in which a specific bit field constituting the received packet is masked. 12. The calculation means calculates a value obtained from data composed of a bit field representing a source address constituting the received packet and a bit field representing control contents of the received packet. The relay device described in 1. 14. The relay apparatus according to claim 13, wherein the extraction unit discards all the same packets when the number of packets determined to be the same by the determination unit exceeds a certain number.

Images