JP2007135137A - Device and program for determining passage of packet - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a VPN device which acquires an IPSec function by a pipeline construction, and completely rejects replay attacks without degrading its performance. <P>SOLUTION: The VPN device 101 is provided with: a first sequence number check portion 102 into which an input packet to be an authentication object having a predetermined sequence number based on IPSec is inputted, and which determines whether or not the input packet is to be passed through based on its sequence number, and allows the input packet to pass when it is determined to be allowed to pass through; a packet authentication portion 104 which receives the input packet having passed to perform its authentication, and allows the input packet to pass through as an authenticated packet, when the input packet is authenticated as the result of authentication; and a first sequence number check portion 105 which receives the authenticated packet having passed through, determines whether to allow the inputted authenticated packet to pass through on the basis of its sequence number, and allows the authenticated packet to pass through when it is determined to be allowed to pass through. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention provides a VPN (Virtual Private Network) that implements an IPSec (Security Architecture for Internet Protocol) function that enables secure packet communication on the Internet by encrypting and authenticating IP (Internet Protocol) packets and adding sequence numbers. The present invention relates to a method for blocking a replay attack by performing a sequence number check and preventing a processing load attack (hereinafter referred to as a Dos attack) against a VPN device.

  The IPSec processing method of a packet is described in a specification RFC (Request For Comments) 2401 by IETF (Internet Engineering Task Force).

  First, an outline of sequence number check will be described. The sequence number in IPSec is used to prevent replay attacks. The VPN device on the IPSec packet transmission side adds a 32-bit sequence number to each IPSec packet and transmits it. The VPN device on the IPSec packet receiving side checks the sequence number, so that the sequence number that is older than the same IPSec packet and the IPSec packet that is allowed to be received (the value is higher than the sequence number of the IPSec packet that is allowed to be received). (Sequence number with small sequence number) is discarded.

  The sequence number is managed in units of SA (Security Association). When transmitting an IPSec packet with the same SA, the transmission side sets the initial value of the sequence number to 0, and increases the sequence number by “1” every time the IPSec packet is transmitted. In IPSec packet transfer using the same SA, the SA must be updated before the value of the 32-bit sequence number goes around.

  Next, the sequence number window memory used in the sequence number check by the IPSec packet receiving side will be described. FIG. 18 is a diagram showing a general sequence number window memory 601. In FIG. 18, the sequence number window memory 601 has an SA number 602 as a unit for managing the sequence number, the latest sequence number 603 for each SA number 602, and the reception history from the latest sequence number 603 to the 32nd previous trace. The history window 604 shown in FIG.

The history window 604 is composed of 32 bits. As shown in FIG. 18, in the history window 604, bit 31 is
"Latest sequence number -1"
Represents the reception history of the IPSec packet corresponding to the sequence number. If it has been received, it is “1”, and if it has not been received, it is “0”.
Similarly, bit 30 is
"Latest sequence number -2"
The reception history of the IPSec packet corresponding to the sequence number is shown.
The same applies to the following.
"That bit X"
"Latest sequence number-(32-X)"
Represents the reception history of the IPSec packet corresponding to the sequence number.

Next, FIG. 19 shows a flowchart of a general IPSec sequence number check performed using the sequence number window memory 601 of FIG. 19 is a sequence number check unit 702 described later with reference to FIG.
(1) When the sequence number is checked by the VPN device, first, it is checked whether or not there is a sequence number of the IPSec packet that has passed the packet authentication (S1).
(2) If it exists (S1 is YES), check whether the sequence number to be updated is the latest number of the SA number 602 (S2),
(3) If it is the latest, overwrite the latest sequence number 603 in FIG. 18 (S3),
(4) The history window 604 is shifted to the right by the difference between the value and the latest sequence number before the update (S4).
(5) If the sequence number to be updated is not the latest number of the SA number 602, the corresponding bit of the history window 604 is set to 1 to record that it has been received (S5).

(6) Next, the operation after receiving the IPSec packet will be described. Waiting for reception of the IPSec packet (S6).
(7) When an IPSec packet is received, the sequence number window corresponding to the SA of the received packet (IPsec packet) is referred to and it is checked whether the sequence number is the latest (S7).
(8) If it is the latest, transfer the received packet (S8),
(9) If it is not the latest, it is checked whether it is within 32 from the latest sequence number which is the width of the reception history window (S9).
(10) If the number is 32 or less, it is checked whether or not the corresponding sequence number flag is raised (S10). If the sequence number flag is not raised, the received packet is not received and is transferred. (S8).
(11) If the sequence number flag is set, this received packet has been received and is discarded. Further, even if it is not within the 32nd from the latest, this received packet is discarded (S11).

  Next, FIG. 20 shows a general configuration when the IPSec function is realized by pipeline processing. 20, the VPN apparatus 701 includes a sequence number check unit 702 having a sequence number window memory 703, a packet authentication unit 704, and another IPSec processing unit 705-1 to another IPSec processing unit 705-N. The VPN device 701 inputs an IPSec packet from the VPN side network 706. Then, the processed packet is output to the plaintext network 707. A solid line arrow in the VPN device 701 indicates a packet flow.

  In the VPN apparatus 701 as shown in FIG. 20, the method of distributing the IPSec processing load is generally performed by the sequence number check unit 702 and the packet authentication unit 704 having a pipeline configuration. Also, by providing the sequence number check unit 702 in front of the packet authentication unit 704, an increase in the authentication processing load of the VPN device 701 due to the replay attack is suppressed.

Next, the operation of the configuration shown in FIG. 20 will be described. In FIG.
(1) The VPN apparatus 701 receives the IPSec packet from the VPN side network 706, and the sequence number check unit 702 refers to the sequence number window memory 703 to perform the sequence number check.
(2) Next, the packet authentication unit 704 performs packet authentication on the IPSec packet that has passed the sequence number check unit 702, and if the authentication is successful, notifies the sequence number check unit 702 of the sequence number of the IPSec packet ( (Dashed arrow).
(3) Here, based on the notification of acceptance from the packet authentication unit 704, the sequence number check unit 702 updates the sequence number window memory 703.
(4) Subsequently, the other IPSec processing unit 705-1 to the other IPSec processing unit 705 -N perform processing other than the processing of the sequence number check and the packet authentication, and send the processed packet to the plaintext side network. To 707.

  In the configuration of FIG. 20, the sequence number check unit 702 and the packet authentication unit 704 are pipelined. For this reason, as shown in FIG. 21, when an IPSec packet of “square # 70” with a sequence number 70 indicated by a square and an IPSec packet of “triangle # 70” with a sequence number 70 indicated by a triangle are received successively. When the sequence number check unit 702 is processing “triangle # 70”, the packet authentication unit 704 is processing “square # 70”. Therefore, the sequence number check unit 702 checks the sequence number of “triangle # 70” before reflecting the sequence number information of “square # 70” being authenticated by the packet authentication unit 704 to the sequence number window memory 703. It will be. Therefore, the sequence number check unit 702 passes “triangle # 70” of “# 70” having the same sequence number. In this way, in the configuration of FIG. 20, when two IPSec packets having the same sequence number are received in succession as shown in FIG. 21, the second decapsulated IPSec packet that should not pass (see FIG. 21). The triangle # 70) also flows into the plaintext network.

Further, in order to realize the sequence number check perfectly with the configuration of FIG. 20, the sequence number check unit 702 needs to wait for the result of the packet authentication unit 704 and then perform the sequence number check of the next received IPSec packet. . In this case, the performance cannot be improved by distributing the processing load due to the pipeline configuration, and the throughput is the same as when sequential processing is performed.
Specifications RFC (Request For Comments) 2401

  The present invention provides a VPN apparatus that completely blocks a replay attack without degrading performance in a VPN apparatus that implements an IPSec function in a pipeline configuration.

The packet passage judging device of the present invention
A sequence number based on the IP security protocol is predetermined and a packet to be authenticated is input as an input packet, and it is determined whether or not the input packet is allowed to pass based on a predetermined sequence number of the input packet that has been input, An input packet determination unit that allows an input packet to pass when it is determined to pass;
A packet authentication unit that inputs and authenticates an input packet passed by the input packet determination unit, and passes the authenticated input packet as an authentication pass packet when the input packet is authenticated as a result of authentication, and
Enter the authentication pass packet passed by the packet authentication unit, determine whether to pass the input authentication pass packet based on the predetermined sequence number, and pass the authentication pass packet if it is determined to pass And an authentication pass packet determination unit to be performed.

  According to the present invention, performance against a replay attack can be improved in a VPN apparatus that implements an IPSec function in a pipeline configuration.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS. The first embodiment includes a first sequence number check unit 102 on the upstream side of the packet authentication unit 104, and further includes a second sequence number check unit 105 on the downstream side of the packet authentication unit 104. The present invention relates to a VPN (Virtual Private Network) device 101 (packet passage determination device) that realizes the function.

  FIG. 1 is a configuration diagram of the VPN apparatus 101. FIG. 2 is a diagram for explaining exchanges between the first sequence number check unit 102 (input packet determination unit) and the packet authentication unit 104 in the VPN apparatus 101. FIG. 3 is a diagram illustrating a packet pipeline process of the first sequence number check unit 102, the packet authentication unit 104, and the second sequence number check unit 105 (authentication pass packet determination unit). FIG. 4 is a flowchart showing the operation of the second sequence number check unit 105 of the VPN apparatus 101.

  First, the configuration of the VPN apparatus 101 will be described with reference to FIG. The VPN apparatus 101 has a configuration in which a second sequence number check unit 105 is added to the VPN apparatus 701 in FIG. As shown in FIG. 1, the VPN apparatus 101 includes a first sequence number check unit 102 having a sequence number window memory 103, a packet authentication unit 104, a second sequence number check unit 105 having a sequence number window memory 106, The other IPSec processing unit 107-1 to the other IPSec processing unit 107 -N are provided. The VPN apparatus 101 receives an IPSec packet from the VPN side network 108, generates a predetermined packet, and outputs the packet to the plaintext side network 109.

(1) The first sequence number check unit 102 has the same function as the sequence number check unit 702 in FIG. The sequence number window memory 103 has the same function and configuration as the sequence number window memory 601 described with reference to FIG. That is, the first sequence number check unit 102 inputs a IPSec packet (input packet) to be authenticated with a predetermined sequence number based on the IP security protocol (IPSec), and has its own sequence number window memory 103. Referring to FIG. 4, it is determined whether or not the IPSec packet is allowed to pass based on a predetermined sequence number of the input IPSec packet. In addition, the first sequence number check unit 102 is notified of authentication success.
(2) The packet authentication unit 104 inputs and authenticates the packet passed by the first sequence number check unit 102. If the packet is authenticated as a result of the authentication, the packet authentication unit 104 determines that the packet that has passed is authenticated. Let it pass as.
(3) The second sequence number check unit 105 inputs an authentication pass packet passed by the packet authentication unit 104. Then, referring to the own sequence number window memory 106, it is determined whether or not to pass the input authentication pass packet based on a predetermined sequence number in the authentication pass packet, and if it is determined to pass, the authentication pass The packet is passed and output to the other IPSec processing unit 107-1. The sequence number window memory 106 included in the second sequence number check unit 105 has the same function and configuration as the sequence number window memory 601 described with reference to FIG.

  Next, the exchange between the first sequence number check unit 102 and the packet authentication unit 104 will be described with reference to FIG. The exchange in FIG. 2 is the same operation as described in the flowchart in FIG. The first sequence number check unit 102 transfers the packet to the packet authentication unit 104 in the case of check OK. The “in case of check OK” is the following case. One of “when the sequence number of the IPSec packet received by the first sequence number check unit 102 is the latest” and “when the sequence number is within 32 and the corresponding bit of the history is 0” This is the case.

  In FIG. 2, the VPN apparatus 101 receives an IPSec packet from the VPN side network 108. The first sequence number check unit 102 checks the sequence number of the IPSec packet received by the sequence number window memory 103. When “check OK”, the IPSec packet is output to the packet authentication unit 104. In the case of “Check NG”, the IPSec packet is discarded. Next, the packet authentication unit 104 performs packet authentication on the IPSec packet that has passed through the first sequence number check unit 102. If the authentication is successful, the packet authentication unit 104 sends the sequence number of the IPSec packet to the first sequence number check unit 102. Notice. Upon receiving this notification, the first sequence number check unit 102 updates the sequence number window memory 103. This will be specifically described with reference to FIG.

  When the VPN apparatus 101 receives 64 packets, 65, 68, 66, the first 70 (packet represented by a square), the second 70 (packet represented by a triangle), and 10 IPsec packets. Is assumed. These IPsec packets are hereinafter referred to as packet # 64, packet # 65, packet # 68, packet # 66, “square # 70”, “triangle # 70”, and packet # 10.

(About packet # 64)
First, assume that packet # 64 is received. The first sequence number check unit 102 checks the sequence number “# 64” in the sequence number window memory 103. It is assumed that there is no record in the sequence number window memory 103 at present. Therefore, the first sequence number check unit 102 transfers the packet # 64 to the packet authentication unit 104. When the packet authentication unit 104 authenticates the packet # 64 and determines that the packet # 64 is passed, the packet authentication unit 104 notifies the first sequence number check unit 102 of the authentication pass of the packet # 64 (S101). Upon receiving this notification, the first sequence number check unit 102 records the sequence number “# 64” of the packet # 64 as the latest sequence number (S102).

(About packet # 65)
The first sequence number check unit 102 receives the packet # 65 and checks the sequence number in the sequence number window memory 103. Since packet # 65 is the packet with the latest sequence number, it is transferred to the packet authentication unit 104. When the packet authentication unit 104 authenticates the packet # 65 and determines that the packet # 65 is passed, the packet authentication unit 104 notifies the first sequence number check unit 102 of the authentication pass of the packet # 65 (S103). Upon receiving this notification, the first sequence number check unit 102 overwrites the “latest sequence number” in the sequence number window memory 103 from “# 64” to “# 65” (S104). Then, the 0th bit (bit corresponding to # 64) of the history window is set to “1” (S105).

(About packet # 68)
The first sequence number check unit 102 receives the packet # 68 and checks it in the sequence number window memory 103. Since packet # 68 is the latest sequence number, it is transferred to the packet authentication unit 104. When the packet authentication unit 104 authenticates the packet # 68 and determines that the packet # 68 is passed, the packet authentication unit 104 notifies the first sequence number check unit 102 of the authentication pass of the packet # 68 (S106). Upon receiving this notification, the first sequence number check unit 102 overwrites the “latest sequence number” in the sequence number window memory 103 from “# 65” to “# 68” (S107). Then, the history window is shifted by “68−65 = 3”, and bit 2 corresponding to “# 65” is set to “1” (S108).

(About packet # 66)
The first sequence number check unit 102 receives the packet # 66 and checks it in the sequence number window memory 103. The packet # 66 is not the latest sequence number, but “within 32” and “corresponding bit 0 of the history window”, so it is transferred to the packet authentication unit 104. When the packet authentication unit 104 authenticates the packet # 66 and determines that the packet # 66 is passed, the packet authentication unit 104 notifies the first sequence number check unit of the authentication pass of the packet # 66 (S109). Upon receiving this notification, the first sequence number check unit 102 changes bit 1 corresponding to “# 66” from “0” to “1” in the history window (S110).

(About “Square # 70”)
The first sequence number check unit 102 receives “square # 70” and checks it in the sequence number window memory 103. Since “square # 70” is the latest sequence number, it is transferred to the packet authentication unit 104. When the packet authentication unit 104 authenticates “square # 70” and determines that it passes, the packet authentication unit 104 notifies the first sequence number check unit 102 of the authentication success of “square # 70” (S111). Upon receiving this notification, the first sequence number check unit 102 overwrites the “latest sequence number” in the sequence number window memory 103 from “# 68” to “# 70” (S112). Then, the history window is shifted by “70−68 = 2”. Then, bit 1 corresponding to “# 68” is changed from “0” to “1” (S113).

(About “Triangle # 70”)
The first sequence number check unit 102 receives “triangle # 70” and checks it in the sequence number window memory 103. FIG. 3 is a diagram illustrating a state of packet pipeline processing by the first sequence number check unit 102, the packet authentication unit 104, and the second sequence number check unit 105. As shown in FIG. 3, at the “processing execution time t6” when the first sequence number check unit 102 is executing the check process of “triangle # 70”, the packet authentication unit 104 is simultaneously set to “square # 70”. The authentication process is being executed. Therefore, in the “process execution time t6” when the first sequence number check unit 102 is executing the “triangle # 70” check process, the sequence number information of “square # 70” is the first sequence number check. It is not reflected in the sequence number window memory 103 of the section 102. Therefore, “triangle # 70” having the sequence number “# 70” passes through the first sequence number check unit 102. The passed “triangle # 70” is discarded by the second sequence number check unit 105 as will be described later with reference to FIG.

(About packet # 10)
The first sequence number check unit 102 receives the packet # 10 and checks it in the sequence number window memory 103. Since the packet # 10 is not within 32 from the latest sequence number # 70, the first sequence number check unit 102 discards the packet # 10.

  The above is the exchange operation between the first sequence number check unit 102 and the packet authentication unit 104.

  Next, the operation of the second sequence number check unit 105 will be described with reference to FIG.

  In step S <b> 201, the second sequence number check unit 105 waits to receive an authentication pass packet from the packet authentication unit 104. It is assumed that the second sequence number check unit 105 receives an authentication pass packet.

  In S202, when the second sequence number check unit 105 receives the authentication pass packet from the packet authentication unit 104, the second sequence number check unit 105 refers to the sequence number window memory 106 to determine whether or not the sequence number of the received authentication pass packet is the latest. To do. If it is determined to be the latest (Yes in S202), the process proceeds to S203. If it is determined that it is not the latest (No in S202), the process proceeds to S205.

  First, a case where it is determined to be the latest (Yes in S202) will be described. This is the process of S202, S203, S204, and S208 in FIG.

  In S203, the second sequence number check unit 105 overwrites the latest sequence number in the sequence number window memory 106 (S203). For example, in FIG. 3, in the state immediately before the second sequence number check unit 105 receives “square # 70” (the state in which the processing time shifts from t6 to t7), the latest sequence number in the sequence number window memory 106 is “# 68. " When the second sequence number check unit 105 receives “square # 70”, the second sequence number check unit 105 changes the latest sequence number in the sequence number window memory 106 from “# 68” to “# 70”. Overwrite. The information “# 68” is recorded in the history window as in the case described in S113 of FIG.

  In S204, as in the case described in S113 of FIG. 2, the second sequence number check unit 105 shifts the history window and sets “1” to the corresponding bit as in the case of S113 in FIG. Recorded in the history window.

  In S208, the second sequence number check unit 105 receives the packet with the latest sequence number received in S201 (the packet with the sequence number that the second sequence number check unit 105 has not yet input in the same SA). Transfer (output) to the IPSec processing unit 107-1.

  Next, a case where the second sequence number check unit 105 determines that the sequence number of the IPSec packet received by the second sequence number check unit 105 is not the latest (No in S202) will be described.

  In S205, the second sequence number check unit 105 determines whether the sequence number of the received IPSec packet is “within 32 from the latest”.

  A case where it is determined that “the number is within 32 from the latest” (S205: Yes) will be described. In this case, the second sequence number check unit 105 checks whether or not the corresponding bit in the history window of the sequence number window memory 106 is “0”. When the corresponding bit is “0” (S206 is Yes), the second sequence number check unit 105 sets “1” in the corresponding bit (S207). On the other hand, when the corresponding bit is not “0” (No in S206), the second sequence number check unit 105 discards the authentication pass packet received in S201 (S209). For example, consider the case of “processing time t8” in FIG. In this case, the second sequence number check unit 105 has received “triangle # 70”. In this case, the second sequence number check unit 105 determines that “triangle # 70” is “within 32 from the latest”, and proceeds to the process of S205. In S206, since the corresponding bit “0” does not exist, the second sequence number check unit 105 discards “triangle # 70”. As a result, even when “square # 70” and “triangle # 70” are continuously received, the subsequent “triangle # 70” can be discarded.

  On the other hand, when it is determined that “the number is not within 32 from the latest” (No in S205), the second sequence number check unit 105 discards the authentication pass packet received in S201 (S209).

  In the VPN apparatus 101 according to the first embodiment, since the second sequence number check unit 105 performs sequence number check after packet authentication, it is possible to prevent IP packets having the same sequence number from passing. Further, since the first sequence number check unit 102 performs the sequence number check before packet authentication, the replay attack packet can be discarded, and a Dos attack against the VPN apparatus 101 aimed at increasing the processing load of the packet authentication unit 104 can be performed. Can be prevented.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIG. The VPN apparatus 101 according to the first embodiment includes two check units, a first sequence number check unit 102 and a second sequence number check unit 105. The second embodiment relates to a VPN device 201 (packet passage determination device) applicable when the throughput of the packet authentication unit 104 in FIG. 1 is equal to or higher than the throughput of the VPN side network 108. The VPN device 201 according to the second embodiment has a first sequence number check unit compared to the VPN device 101 according to the first embodiment on the assumption that the throughput of the packet authentication unit is equal to or higher than the throughput of the VPN side network 108. The check unit corresponding to 102 is deleted.

  In FIG. 5, the VPN apparatus 201 includes a packet authentication unit 202, a sequence number check unit 203 (authentication pass packet determination unit) having a sequence number window memory 204, and other IPSec processing units 205-1 to other IPSec processing units. 205-N. The VPN apparatus 201 inputs an IPSec packet from the VPN side network 206 and outputs the processed packet to the plaintext side network 207.

  In the VPN device 201, the exchange operation between the packet authentication unit 202 and the sequence number check unit 203 is the same as the exchange operation between the packet authentication unit 104 and the second sequence number check unit 105 in the VPN device 101 of the first embodiment. It is.

Embodiment 3 FIG.
With reference to FIG. 6, the VPN apparatus 301 (packet passage determination apparatus) in Embodiment 3 is demonstrated. The VPN apparatus 301 has a configuration in which the packet authentication unit 202 according to the second embodiment is parallelized by a plurality of sub-authentication units.
“Throughput of each sub-authentication unit” <“Throughput of VPN side network 306”
In Although,
By parallelization, “throughput of the packet authentication unit 302” ≧ “throughput of the VPN side network 306”
It is an embodiment.

  The VPN apparatus 201 according to the second embodiment is an embodiment on the premise that the throughput of the packet authentication unit 202 is equal to or higher than the throughput of the VPN side network 206. In the third embodiment, even if the throughput per individual sub-authentication unit is less than the throughput of the VPN side network 306, it is parallelized so that the total performance exceeds the throughput of the VPN side network 306. It is an embodiment.

  FIG. 6 is a configuration diagram of a VPN apparatus 301 in which packet authentication units are parallelized.

  As shown in FIG. 6, the VPN apparatus 301 includes a packet authentication unit 302 including a sub-authentication unit 302-1 to a sub-authentication unit 302-N, and a sequence number check unit 303 having a sequence number window memory 304 (authentication pass). Packet determination unit) and another IPSec processing unit 305-1 to another IPSec processing unit 305-N. The functions of these components are the same as the functions of the corresponding components of the VPN apparatus 201 in the second embodiment.

  In FIG. 6, in the packet authentication unit 302, even if the throughput per individual sub-authentication unit is less than the throughput of the VPN side network 306, this is parallelized, and the performance exceeding the throughput of the VPN side network 206 in total is achieved. I was going to be. Therefore, it is possible to counter the Dos attack against the VPN device.

Embodiment 4 FIG.
The fourth embodiment will be described with reference to FIGS. The fourth embodiment relates to a VPN device (packet passage determination device) in which a sequence number check unit following the packet authentication unit checks the sequence number of a packet for which the decapsulation processing of the IPSec packet has been completed.

  In general, when realizing the IPSec function, the IPSec packet authentication process and the decryption process (processes performed by other IPSec processing units) from the aspect of the key distribution necessary for the authentication process and the decryption process performed by the decapsulation process of the IPSec packet. ) Is a continuous processing method. In this case, in the method of performing sequence number check after packet authentication, as long as packet authentication is performed, the sequence number check may be performed at any timing before transmission to the plaintext network. Therefore, this Embodiment 4 demonstrates three systems of Example 1-Example 3 which performs a sequence number check after authentication and a decapsulation process are completed.

Example 1
A VPN apparatus 401 will be described as Example 1 in Embodiment 4 with reference to FIG. In the VPN apparatus 401, the second sequence number check unit 406 is different from the configuration of the VPN apparatus 101 of the first embodiment shown in FIG. 1 in that the other IPSec processing unit 405-1 to another IPSec processing unit 405-1. The corresponding packet generation unit 405 configured by

  The VPN apparatus 401 includes a first sequence number check unit 402 (input packet determination unit) having a sequence number window memory 403, a packet authentication unit 404, another IPSec processing unit 405-1 to another IPSec processing unit 405-N. And a second sequence number check unit 406 (corresponding packet determination unit) having a sequence number window memory 407.

  The first sequence number check unit 402 inputs an IPSec packet (input packet) to be authenticated while a sequence number is predetermined. Then, referring to the sequence number window memory 403 owned by itself, it is determined whether to pass the IPSec packet based on a predetermined sequence number of the input IPSec packet, and when it is determined to pass, the packet is allowed to pass. Here, the IPSec packet input by the first sequence number check unit 402 is encapsulated according to the IP security protocol.

  The packet authentication unit 404 inputs and authenticates the IPSec packet passed by the first sequence number check unit 402, and when the IPSec packet is authenticated as a result of authentication, the packet authentication unit 404 converts the IPSec packet that has been authenticated as an authentication pass packet. Pass as.

  Corresponding packet generation unit 405 receives the authentication pass packet passed by packet authentication unit 404, takes over a predetermined sequence number based on the input authentication pass packet, and corresponds to the authentication pass packet And output to the second sequence number check unit 406.

  Second sequence number check section 406 (corresponding packet determination section) inputs the corresponding packet output from corresponding packet generation section 405. The corresponding packet input by the second sequence number check unit 406 is decapsulated according to the IP security protocol. The second sequence number check unit 406 refers to its own sequence number window memory 407, determines whether or not to allow the input corresponding packet to pass based on a predetermined sequence number taken over by the corresponding packet, and allows it to pass. If it is determined, the corresponding packet is passed and output to the plaintext network 409. In this case, the functions and operations of the second sequence number check unit 406 and the sequence number window memory 407 are the same as those of the second sequence number check unit 105 and the sequence number window memory 106 in the first embodiment.

  However, in the configuration of FIG. 7, normally, when performing a sequence number check after decapsulating an IPSec packet, the IP packet after decapsulation does not have an IPSec sequence number. FIG. 8 is a diagram showing the format of the IPSec packet. FIG. 9 shows a format of an in-device packet that is a packet obtained by decapsulating an IPSec packet into an IP packet. When passing through another IPSec processing unit 405-1, the IPSec packet shown in FIG. 8 becomes the “intra-device packet format” of FIG. The IPSec packet (before decapsulation) includes a sequence number in the IPSec header. When this is decapsulated into an IP packet, the sequence number is usually deleted. For this reason, in the VPN apparatus 401, as shown in FIG. 9, the sequence number of the IPSec packet is given before the IP packet header and flows in the VPN apparatus 401. Therefore, it is possible to take over the sequence number for each IP packet even after decapsulation. Accordingly, the second sequence number check unit 406 can check the sequence number.

  As described above, in FIG. 7, a sequence number (and an SA number not shown) is added to the decapsulated IP packet, and this IP packet (corresponding packet) is sent to the second sequence number check unit 406. This is a transfer method. In addition to this method, without adding an IP packet, the sequence number of an authentication-passed packet that has passed authentication is transferred from the packet authentication unit 404 to the second sequence number check unit 406 using a FIFO memory or the like through another path. It does not matter if it is a method.

(Example 2)
FIG. 10 is a diagram illustrating a configuration of a VPN device 420 (packet passage determination device) as Example 2 in the fourth embodiment. As described at the beginning of the fourth embodiment, in the method of performing sequence number check after packet authentication, the sequence number check is performed at any timing before transmission to the plaintext side network after packet authentication. I do not care. The VPN apparatus 420 according to the second embodiment has a configuration in which the second sequence number check unit 406 is arranged between other IPSec processing units with respect to the VPN apparatus 401 according to the first embodiment. In FIG. 10, the other IPSec processing unit 405-1 and the other IPSec processing unit 405-2 constitute a corresponding packet generation unit 405.

(Example 3)
FIG. 11 is a diagram illustrating a configuration of a VPN apparatus 501 as Example 3 in the fourth embodiment. In the VPN apparatus 501 of the third embodiment, the sequence number check unit 203 is configured by another IPSec processing unit 205-1 to another IPSec processing unit 205-N with respect to the VPN apparatus 201 of the second embodiment shown in FIG. The corresponding packet generation unit 205 is arranged in the subsequent stage. Note that the VPN apparatus 501 according to the third embodiment may have a configuration in which the sequence number check unit 203 is arranged between other IPSec processing units as in the second embodiment.

  As described above, according to the first to fourth embodiments, since the sequence number check unit is provided after the packet authentication unit, the sequence number is not deteriorated in the pipeline configuration realizing the IPSec function. A check function can be implemented to completely block replay attacks. When the throughput of the packet authentication unit is inferior to the throughput of the VPN side network, a Dos attack against the VPN apparatus can be prevented by providing a sequence number check unit in front of the packet authentication unit.

Embodiment 5. FIG.
The fifth embodiment will be described with reference to FIGS. The fifth embodiment is an embodiment in which the operation of the VPN apparatus described in the first to fourth embodiments is performed using a program and a recording medium on which the program is recorded.

  In the first to fourth embodiments, a series of operations of each component shown as “to part” in the VPN apparatus are related to each other, and these series of operations are performed by a program executed by a computer. Can be replaced. By replacing the operation of each component with processing by a program, an embodiment of a packet passage determination program can be obtained. Further, by recording this packet passage determination program on a computer-readable recording medium, an embodiment of a computer-readable recording medium on which the packet passage determination program is recorded can be obtained.

  12 shows the operation of the first sequence number check unit 102 (input packet determination unit), the operation of the packet authentication unit 104, and the second sequence number check unit 105 (authentication) of the VPN apparatus 101 of the first embodiment shown in FIG. The flowchart which replaces the series of operation | movement called operation | movement of an acceptable packet determination part) with the series of processes which make a computer implement is made into embodiment of a packet passage determination program.

  S301, whether a sequence number based on the IP security protocol is predetermined and a packet to be authenticated is input as an input packet, and whether the input packet is allowed to pass based on a predetermined sequence number of the input packet This is a process of allowing an input packet to pass if it is determined to pass.

  S302 is a process of inputting and authenticating the input packet that has passed, and allowing the input packet that has been authenticated to pass as an authentication-passed packet when the input packet is authenticated as a result of authentication.

  S303 is a process of inputting the passed authentication pass packet, determining whether to pass the input authentication pass packet based on the predetermined sequence number, and passing the authentication pass packet when it is determined to pass. is there.

  FIG. 13 shows the operation of the first sequence number check unit 402 (input packet determination unit), the operation of the packet authentication unit 404, the operation of the corresponding packet generation unit 405, the operation of the VPN apparatus 401 of the fourth embodiment shown in FIG. 2 is a flowchart showing an embodiment of a packet passage determination program by replacing a series of operations called operations of the two sequence number check unit 406 (corresponding packet determination unit) with a series of processes for causing a computer to execute.

  In S401, a sequence number based on the IP security protocol is determined in advance, and a packet to be authenticated is input as an input packet, and whether or not the input packet is allowed to pass based on a predetermined sequence number of the input packet that has been input This is a process of allowing an input packet to pass if it is determined to pass.

  S402 is processing for inputting and authenticating the input packet that has passed, and allowing the input packet that has been authenticated to pass as an authentication-passed packet when the input packet has been authenticated as a result of authentication.

  S403 is a process of inputting a passed authentication pass packet, taking over the predetermined sequence number based on the input authentication pass packet, and generating and outputting a corresponding packet corresponding to the authentication pass packet. .

  S404 inputs the output corresponding packet, determines whether to pass the input corresponding packet based on the predetermined sequence number taken over by the corresponding packet, and if it is determined to pass, It is processing to pass.

  FIG. 14 shows a series of operations for causing the computer to perform a series of operations including the operation of the packet authentication unit 202 of the VPN apparatus 201 of the second embodiment shown in FIG. 5 and the operation of the sequence number check unit 203 (authentication pass packet determination unit). The flowchart which made it the embodiment of the packet passage determination program replaced with a process is shown.

  In step S501, a sequence number based on the IP security protocol is determined in advance, and a packet to be authenticated is input as an input packet through a network having a predetermined throughput, and the input packet is authenticated as a result of authentication. In such a case, the input packet authenticated as passing is passed as an authentication passing packet, and the throughput is equal to or higher than the throughput of the network.

  S502 is a process of inputting the passed authentication pass packet, determining whether to pass the input authentication pass packet based on a predetermined sequence number, and passing the authentication pass packet when it is determined to pass. is there.

  FIG. 15 shows a series of operations including the operation of the corresponding packet generation unit 205, the operation of the packet authentication unit 202, and the operation of the sequence number check unit 203 (corresponding packet determination unit) of the VPN apparatus 501 of the fourth embodiment shown in FIG. 7 is a flowchart illustrating a packet passage determination program according to an embodiment in which a computer is replaced with a series of processes executed by a computer.

  In step S601, a sequence number based on the IP security protocol is determined in advance, and a packet to be authenticated is input as an input packet through a network having a predetermined throughput and authenticated. As a result of authentication, the input packet is authenticated as passed. In such a case, the input packet authenticated as passing is passed as an authentication passing packet, and the throughput is equal to or higher than the throughput of the network.

  S602 is a process of inputting a passed authentication pass packet, taking over the predetermined sequence number based on the input authentication pass packet, and generating and outputting a corresponding packet corresponding to the authentication pass packet. .

  S603 inputs the output corresponding packet, determines whether to pass the input corresponding packet based on the predetermined sequence number taken over by the corresponding packet, and if it is determined to pass, It is processing to pass.

  The embodiment of the program and the embodiment of the computer-readable recording medium on which the program is recorded can be configured by a program operable by a computer.

  FIG. 16 shows the external appearance of a computer system 800 that executes the program shown in the flowcharts of FIGS. In FIG. 16, a computer system 800 includes a system unit 830, a liquid crystal display 813, a keyboard (K / B) 814, a mouse 815, a compact disk device (CDD) 818, and a printer 819, which are connected by a cable. The computer system 800 is connected to another VPN device 900b via the Internet 910.

  FIG. 17 is a hardware configuration diagram of the computer system 800 of FIG. In FIG. 17, a computer system 800 includes a CPU (Central Processing Unit) 810 that executes a program. The CPU 810 is connected to the ROM 811, RAM 812, liquid crystal display 813, K / B 814, mouse 815, communication board 816, FDD (Flexible Disk Drive) 817, CDD 818, printer 819, and magnetic disk device 820 via the bus 825. .

  The magnetic disk device 820 stores an operating system (OS) 821, a window system 822, a program group 823, and a file group 824. The program group 823 is executed by the CPU 810, the OS 821, and the window system 822.

  The program group 823 stores a packet passage determination program for executing the function described as “˜unit” in the description of the first to fourth embodiments. The program is read and executed by the CPU 810.

  The file group 824 stores one or more “sequence number windows”.

  What has been described as “˜unit” in the first to fourth embodiments may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  Each processing in the embodiment of the program and the embodiment of the computer-readable recording medium on which the program is recorded is executed by the program, and this program is recorded in the program group 823 as described above. Then, the program is read from the program group 823 into the CPU 810, and each process of the program is executed by the CPU 810.

  The software or program may be executed by firmware stored in the ROM 811. Alternatively, the program may be executed by a combination of software, firmware, and hardware.

  The packet passage determination program according to the fifth embodiment causes the computer to execute a process of checking the sequence number of the authentication pass packet after the packet authentication process. Therefore, in the pipeline configuration, the packet with the same sequence number is sent to the plaintext side network. It can be discarded without passing.

  In the above embodiment, in the VPN apparatus that implements the IPSec function in the pipeline configuration, the sequence number check method is characterized in that the replay attack is completely blocked by performing the sequence number check before and after the authentication process. explained.

  In the above embodiment, a sequence number check method is described in which a VPN apparatus that implements the IPSec function in a pipeline configuration performs a sequence number check only after authentication processing to completely block a replay attack. did.

  In the above embodiment, in the VPN apparatus that realizes the IPSec function in the pipeline configuration, the authentication processing unit is parallelized against the replay attack aiming at the increase of the authentication processing load, and the sequence number only after the authentication processing unit. A sequence number check method characterized by performing a check to completely block replay attacks was explained.

  In the above embodiment, in the VPN apparatus that realizes the IPSec function with the pipeline configuration, the sequence number check is performed before and after the IPSec decapsulation process to completely block the replay attack. Explained.

1 is a configuration diagram of a VPN apparatus 101 according to Embodiment 1. FIG. The exchange between the first sequence number check unit 102 and the packet authentication unit 104 in the first embodiment will be described. The pipeline processing of the 1st sequence number check part 102, the packet authentication part 104, and the 2nd sequence number check part 105 in Embodiment 1 is shown. 6 is a flowchart of the operation of a second sequence number check unit 105 in the first embodiment. 6 is a configuration diagram of a VPN apparatus 201 according to Embodiment 2. FIG. FIG. 10 is a configuration diagram of a VPN device 301 in a third embodiment. It is a block diagram of the VPN apparatus 401 in Embodiment 4. FIG. 10 shows an IPSec packet format according to the fourth embodiment. The in-device packet format in Embodiment 4 is shown. It is a block diagram of the VPN apparatus 420 in Embodiment 4. FIG. It is a block diagram of the VPN apparatus 501 in Embodiment 4. FIG. 10 is a flowchart of a packet passage determination program corresponding to the VPN apparatus 101 in FIG. 1 according to the fifth embodiment. 10 is a flowchart of a packet passage determination program corresponding to the VPN apparatus 101 in FIG. 7 according to the fifth embodiment. 6 is a flowchart of a packet passage determination program corresponding to the VPN apparatus 201 of FIG. 5 in the fifth embodiment. 12 is a flowchart of a packet passage determination program corresponding to the VPN apparatus 501 of FIG. 11 in the fifth embodiment. 20 shows an external appearance of a computer system 800 in a fifth embodiment. 10 illustrates a hardware configuration of a computer system 800 according to a fifth embodiment. It is a block diagram of the conventional sequence number window. It is a processing flowchart figure of the conventional sequence number check. It is a block diagram of the conventional VPN apparatus which implement | achieves an IPSec function with a pipeline structure. It is a figure which shows the prior art.

Explanation of symbols

  101 VPN device, 102 first sequence number check unit, 103 sequence number window memory, 104 packet authentication unit, 105 second sequence number check unit, 106 sequence number window memory, 107-1, 107-N other IPSec processing unit, 108 VPN side network, 109 plaintext side network, 201 VPN apparatus, 202 packet authentication unit, 203 sequence number check unit, 204 sequence number window memory, 205-1, 205-N Other IPSec processing unit, 206 VPN side network, 207 Plaintext side network, 301 VPN device, 302 packet authentication unit, 302-1, 302-2, 302-N sub-authentication unit, 303 sequence number check unit, 304 sequence number win Memory, 305-1, 305-N Other IPSec processing unit, 306 VPN side network, 307 plaintext side network, 401 VPN device, 402 first sequence number check unit, 403 sequence number window memory, 404 packet authentication unit, 405 Packet generation unit, 405-1, 405-N Other IPSec processing unit, 406 Second sequence number check unit, 407 Sequence number window memory, 408 VPN side network, 409 Plain text side network, 420 VPN device, 410 Other IPSec processing Unit, 501 VPN device, 503 packet generation unit, 601 sequence number window memory, 602 memory address, 603 latest sequence number, 604 history window, 701 VPN device, 702 Sequence number check unit, 703 Sequence number window memory, 704 Packet authentication unit, 705-1, 705-N Other IPSec processing unit, 706 VPN side network, 707 Plain text side network, 800 computer system, 810 CPU, 811 ROM, 812 RAM, 813 DSP, 814 K / B, 815 mouse, 816 communication board, 817 FDD, 818 CDD, 819 printer, 820 magnetic disk device, 821 OS, 822 window system, 823 program group, 824 file group, 825 bus, 830 system unit.

Claims (11)

Whether a sequence number based on an IP (Internet Protocol) security protocol is predetermined and a packet to be authenticated is input as an input packet, and the input packet is passed based on a predetermined sequence number of the input packet An input packet determination unit that allows an input packet to pass when it is determined that
A packet authentication unit that inputs and authenticates an input packet passed by the input packet determination unit, and passes the authenticated input packet as an authentication pass packet when the input packet is authenticated as a result of authentication, and
Enter the authentication pass packet passed by the packet authentication unit, determine whether to pass the input authentication pass packet based on the predetermined sequence number, and pass the authentication pass packet if it is determined to pass A packet passage determination device comprising: an authentication pass packet determination unit for performing The input packet input by the input packet determination unit is:
Encapsulated according to IP security protocol,
The authentication pass packet input by the authentication pass packet determination unit is:
2. The packet passage determination apparatus according to claim 1, wherein the packet passage determination apparatus is decapsulated according to an IP security protocol. A sequence number based on the IP security protocol is predetermined and a packet to be authenticated is input as an input packet, and it is determined whether or not the input packet is allowed to pass based on a predetermined sequence number of the input packet that has been input, An input packet determination unit that allows an input packet to pass when it is determined to pass;
A packet authentication unit that inputs and authenticates an input packet passed by the input packet determination unit, and passes the authenticated input packet as an authentication pass packet when the input packet is authenticated as a result of authentication, and
Corresponding to input the authentication pass packet passed by the packet authentication unit, generate the corresponding packet corresponding to the authentication pass packet and take over the predetermined sequence number based on the input authentication pass packet A packet generator;
Corresponding to the case where the corresponding packet output by the corresponding packet generation unit is input, whether the input corresponding packet is passed based on the predetermined sequence number taken over by the corresponding packet, and determined to be passed A packet passage determination apparatus, comprising: a corresponding packet determination unit that allows a packet to pass. The input packet input by the input packet determination unit is:
Encapsulated according to IP security protocol,
The corresponding packet input by the corresponding packet determining unit is
4. The packet passage determination apparatus according to claim 3, wherein the packet passage determination apparatus is decapsulated according to an IP security protocol. A sequence number based on the IP security protocol is predetermined, and a packet to be authenticated is input as an input packet through a network with a predetermined throughput to execute authentication processing. As a result of the authentication processing, the input packet is passed When authenticating, the input packet authenticated as passing is passed as an authentication passing packet, and the packet authentication unit whose authentication processing throughput is equal to or higher than the throughput of the network;
Enter the authentication pass packet passed by the packet authentication unit, determine whether to pass the input authentication pass packet based on a predetermined sequence number, and pass the authentication pass packet if it is determined to pass A packet passage determination device comprising: an authentication pass packet determination unit for performing The packet authentication unit
With multiple sub-authentication units,
Each of the plurality of sub-authentication units is
An input packet is input through the network to execute authentication processing, and when the input packet is authenticated as a result of authentication processing, the input packet authenticated as passed is passed as an authentication pass packet. The packet passage determination apparatus according to claim 5. A sequence number based on the IP security protocol is predetermined, and a packet to be authenticated is input as an input packet through a network with a predetermined throughput to execute authentication processing. As a result of the authentication processing, the input packet is passed When authenticating, the input packet authenticated as passing is passed as an authentication passing packet, and the packet authentication unit whose authentication processing throughput is equal to or higher than the throughput of the network;
Corresponding to input the authentication pass packet passed by the packet authentication unit, generate the corresponding packet corresponding to the authentication pass packet and take over the predetermined sequence number based on the input authentication pass packet A packet generator;
Corresponding to the case where the corresponding packet output by the corresponding packet generation unit is input, whether the input corresponding packet is passed based on the predetermined sequence number taken over by the corresponding packet, and determined to be passed A packet passage determination apparatus, comprising: a corresponding packet determination unit that allows a packet to pass. A sequence number based on the IP security protocol is predetermined and a packet to be authenticated is input as an input packet, and it is determined whether or not the input packet is allowed to pass based on a predetermined sequence number of the input packet that has been input, A process of passing an input packet when it is determined to pass,
When the input packet that has passed is authenticated by authenticating the input packet as a result of the authentication, the process passes the input packet that has passed as an authentication pass packet,
The authentication pass packet that has passed is input, it is determined whether to pass the input authentication pass packet based on the predetermined sequence number, and if it is determined to pass, the process of passing the authentication pass packet to the computer A packet passage determination program that is executed. A sequence number based on the IP security protocol is predetermined and a packet to be authenticated is input as an input packet, and it is determined whether or not the input packet is allowed to pass based on a predetermined sequence number of the input packet that has been input, A process of passing an input packet when it is determined to pass,
When the input packet that has passed is authenticated by authenticating the input packet as a result of the authentication, the process passes the input packet that has passed as an authentication pass packet,
A process of inputting a passed authentication pass packet, taking over the predetermined sequence number based on the input authentication pass packet and generating and outputting a corresponding packet corresponding to the authentication pass packet;
Processing to input the output corresponding packet, determine whether to pass the input corresponding packet based on the predetermined sequence number taken over by the corresponding packet, and pass the corresponding packet when it is determined to pass And a packet passage determination program that causes a computer to execute. When a sequence number based on the IP security protocol is determined in advance and a packet to be authenticated is input as an input packet through a network with a predetermined throughput for authentication, and as a result of authentication, the input packet is authenticated as passed , A process of passing an input packet authenticated as pass as an authentication pass packet, wherein the throughput is equal to or higher than the throughput of the network;
Input the passed authentication pass packet, determine whether to pass the input authentication pass packet based on a predetermined sequence number, and pass the authentication pass packet to the computer when it is determined to pass A packet passage determination program that is executed. When a sequence number based on the IP security protocol is determined in advance and a packet to be authenticated is input as an input packet through a network with a predetermined throughput for authentication, and as a result of authentication, the input packet is authenticated as passed , A process of passing an input packet authenticated as pass as an authentication pass packet, wherein the throughput is equal to or higher than the throughput of the network;
A process of inputting a passed authentication pass packet, taking over the predetermined sequence number based on the input authentication pass packet and generating and outputting a corresponding packet corresponding to the authentication pass packet;
Processing to input the output corresponding packet, determine whether to pass the input corresponding packet based on the predetermined sequence number taken over by the corresponding packet, and pass the corresponding packet when it is determined to pass And a packet passage determination program that causes a computer to execute.

Images