JP2009038555A - Network apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network apparatus for updating filtering rule, while session data of the established session is maintained. <P>SOLUTION: The network apparatus 1 determines acknowledgment or non-acknowledgment of transfer of packets trying to pass through the network between LAN and WAN based on the filtering rule. When the packets pass through the network based on this filtering rule, a session is established. The network apparatus 1 stores session information of the session established in relation to the corresponding filtering rule. When the filtering rule is updated, the network apparatus 1 evaluates the session information and the corresponding filtering rule within the range of applying influence on the update. On the basis of the evaluation result, the network apparatus 1 stores again the session information and the corresponding filtering rule. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a network device having a packet filtering function for selecting packets to be transmitted and received.

  A general firewall function installed in a network device such as a router selects whether a packet to be transmitted / received is a packet having a passage attribute, passes only a packet having the passage attribute, and does not have a passage attribute. Has a packet filtering function of discarding. This packet filtering function often uses a plurality of filtering rules, which are rules for selecting packets. A session is established when a packet passes based on this filtering rule (see Patent Document 1).

If the session is disconnected, the communication state cannot be maintained, so we want to perform processing for various network connections while maintaining the session. For example, Patent Document 1 describes a method for switching a network device or the like while maintaining a session.
JP 2004-274552 A

  However, when the filtering rule stored in the network device is updated, the established session is disconnected, and a new session is established based on the updated filtering rule. That is, when the filtering rule is updated, the communication state at that time cannot be maintained.

  Therefore, an object of the present invention is to provide a network device that can maintain an established session even if the filtering rule is updated.

  The invention of claim 1 is a network device connected to a plurality of networks, a determination condition for determining an attribute of a packet, and operation designation information for designating an operation to be performed on a packet that matches the determination condition A rule storage unit that stores the filtering rules in order from the highest priority in the execution thereof, and the session information when the session is established through the network device, the identification number of the filtering rule corresponding to the session information, and When a session storage unit stored in association and a filtering rule stored in the rule storage unit are updated, a plurality of filterings stored in the rule storage unit with respect to session information stored in the session storage unit An evaluation means for evaluating whether or not the rule corresponds; and Update means for updating the association between the session information stored in the session storage unit and the identification number of the filtering rule based on the result of the evaluation, and the evaluation means includes the updated filtering rule or the update Evaluation is performed on session information associated with an identification number of a filtering rule having a lower priority than the filtered filtering rule.

  In this configuration, the network device has a firewall function such as a router, and stores a filtering rule for determining whether or not a packet passing between networks is allowed to pass, and session information when a session is established. This session information is stored in association with the identification number of the corresponding filtering rule. When the filtering rule is updated, the network device evaluates whether the session information associated with the identification number of the filtering rule having a lower priority than the updated filtering rule corresponds to the filtering rule. Thereby, when the filtering rule is updated, the network device evaluates whether the session information corresponds to the updated filtering rule, and stores the session information and the identification number of the filtering rule in association with each other based on the evaluation result. To do. Therefore, for a session that should be maintained under the changed filtering rule, the filtering rule can be updated while maintaining the session information of the established session.

  In the invention of claim 2, when the filtering means is added to the rule storage unit, the evaluation unit performs the following on the session information associated with the identification number of the filtering rule having a lower priority than the added filtering rule: It is evaluated whether or not the added filtering rule corresponds, and the updating unit updates the session information corresponding to the added filtering rule so as to be associated with the identification number of the added filtering rule. .

  In this configuration, when adding a filtering rule, the network device evaluates whether session information associated with a filtering rule having a lower priority than the added filtering rule corresponds to the added filtering rule. The network device associates session information corresponding to the added filtering rule with the added filtering rule. As a result, the network device evaluates only the session information affected by the added filtering rule. Therefore, the network device can update the filtering rule while maintaining the session information for the session that should be maintained even under the changed filtering rule.

  In the invention of claim 3, when the filtering rule is deleted from the rule storage unit, the evaluation unit has priority over the deleted filtering rule with respect to the session information associated with the identification number of the deleted filtering rule. It is evaluated whether or not a filtering rule with a lower rank corresponds, and the updating means has the highest priority corresponding to the session information associated with the identification number of the deleted filtering rule among the filtering rules remaining after deletion. The update is performed so as to be associated with the identification number of the filtering rule.

  In this configuration, when a filtering rule is deleted, the network device evaluates whether or not the session information associated with the deleted filtering rule corresponds to a filtering rule having a lower priority than the deleted filtering rule. The network device associates the session information associated with the deleted filtering rule with the filtering rule having the highest priority among the corresponding filtering rules. As a result, the network device evaluates only the session information affected by the deleted filtering rule. Therefore, the network device can update the filtering rule while maintaining the session information for the session that should be maintained even under the changed filtering rule.

  According to a fourth aspect of the present invention, when the filtering rule in the rule storage unit is changed, the evaluation unit changes the filtering rule and the change after changing the session information associated with the identification number of the filtering rule before the change. It is evaluated whether or not a filtering rule having a lower priority than a later filtering rule is supported, and the updating unit displays session information associated with the identification number of the filtering rule before the change among the filtering rules existing after the change. And updating so as to be associated with the identification number of the filtering rule with the highest priority corresponding to.

  In this configuration, when the filtering rule is changed, the network device corresponds to the changed filtering rule or a filtering rule having a lower priority than the changed filtering rule for the session information associated with the changed filtering rule. Evaluate whether or not. The network device associates the session information associated with the changed filtering rule with the filtering rule having the highest priority among the corresponding filtering rules including the changed filtering rule. As a result, the network device evaluates only the session information affected by the changed filtering rule. Therefore, the network device can update the filtering rule while maintaining the session information for the session that should be maintained even under the changed filtering rule.

  In the invention of claim 5, when the order of the filtering rules in the rule storage unit is changed, the evaluation unit has a higher priority than the changed filtering rule for the session information associated with the identification number of the changed filtering rule. It is evaluated whether or not a filtering rule having a lower priority than a filtering rule that has been replaced after replacement corresponds, and the update means performs filtering after replacing session information associated with the identification number of the replaced filtering rule. The rule is updated so as to be associated with the identification number of the filtering rule having the highest priority corresponding to the rule.

  In this configuration, when the order of the filtering rules is changed, the network device has a lower priority than the changed filtering rules for the session information associated with the changed filtering rules, and the filtering rules are changed in order after the replacement. It is evaluated whether or not it corresponds to a filtering rule having a higher priority. The network device associates the session information associated with the replaced filtering rule with the filtering rule having the highest priority among the corresponding filtering rules in the new priority that has been replaced. As a result, the network device evaluates only the session information affected by the filtering rules whose order has been changed. Therefore, the network device can update the filtering rule while maintaining the session information for the session that should be maintained even under the changed filtering rule.

  In the invention of claim 6, when the evaluation means switches the rule storage unit, from the filtering rule after the switching, the filtering rule corresponding to the switching rule after the switching for the session information associated with the filtering rule before the switching. The update means evaluates whether or not it corresponds except for a filtering rule with a high priority, and updates the session information so as to associate it with the identification number of the corresponding filtering rule with the highest priority. And

  In this configuration, at the time of switching the rule storage unit (filtering table), the network device evaluates whether or not it corresponds to the filtering rule after switching with respect to the session information associated with the filtering rule before switching. At this time, if a filtering rule having a higher priority than the filtering rule corresponding to the session information before switching is present in the filtering rule after switching, the filtering rule is excluded and evaluated. Thereby, the network device evaluates only the session information affected by the switching of the filtering table. For this reason, for a session that should be maintained under the changed filtering rule, the network device can update the filtering rule while maintaining the session information.

  According to the present invention, when a filtering rule is updated, the network device evaluates which filtering rule the session information corresponds to within a range affected by the updated filtering rule. Thereby, the network device can update the filtering rule while maintaining the session information of the established session.

  FIG. 1 is a diagram illustrating an environment in which a LAN and a WAN are connected via a network device. A client device 2 (for example, a PC or a mobile phone) installed in the LAN is connected to the network 3 (WAN) through the network device 1. When the network device 1 receives a data acquisition request from the WAN side to the client device 2 installed on the LAN side, the network device 1 determines whether or not to permit the data transfer from the client device 2. In addition, the network device 1 sends a data acquisition request from the LAN side to the communication device 4 (4a, 4b) set on the WAN side (for example, a PC or a mobile phone connected to the network via a router). If it performs, it will be judged whether the data acquisition request will be performed to the communication apparatus 4 installed in the WAN side. This determination is made based on a filtering rule (hereinafter referred to as a rule) stored in the network device 1.

  When a data acquisition request or data transfer is performed based on a rule, a session is established at a timing when a packet from the LAN side to the WAN side or a packet from the WAN side to the LAN side passes. The session information of the established session is stored in the network device. When this session is established, communication of the same service between the same devices (for example, between the client device 2 and the communication device 4a) passes the next packet by referring to the session information without judging based on the rules. Can be made. For example, when a session is established by accessing the communication device 4 from the client device 2 with the port number 80 (WWW service), the client device 2 accesses the communication device 4 with the port number 80 while the session is established. be able to.

  Since this session information is generated based on the rule, when the rule is updated, the session information is also updated. At this time, the network device 1 evaluates the session information based on the updated rule. By evaluating the session information, the updated contents of the rules are reflected in the session information. Thereby, the network device 1 can maintain the session information that does not affect the update of the rule as it is. Further, the network device 1 can maintain even the session information affected by the update of the rule as long as it corresponds to the updated filtering rule.

  In the present embodiment, one client device 2 is installed on the LAN side and two communication devices 4 are installed on the WAN side. However, the present invention is not limited to this, and it is only necessary to install a client device on the LAN side and a communication device on the WAN side.

  Next, the functional configuration of the network device 1 will be described. FIG. 2 is a block diagram of the network device. The network device 1 is, for example, a router device or a firewall device.

  The network device 1 is a device that connects two networks. When a packet is transferred from one network to the other, it is determined whether or not to permit the transfer of the packet, and only the permitted one is allowed to pass. Perform packet filtering to discard other packets.

  The network device 1 includes four LAN side ports 14 and one WAN side port 16. The WAN side port 16 is connected to an ISP or the like that provides Internet services. The WAN side port 16 is connected to the CPU 10 via the PHY chip 15.

  Each of the four LAN ports 14 is connected to a client device 2 such as a PC. These LAN side ports 14 are connected to the layer 2 switch chip 13. The layer 2 switch chip 13 controls communication between the plurality of client devices 2 connected to the LAN side port 14. The layer 2 switch chip 13 is also connected to the CPU 10. The CPU 10 controls communication between the WAN side port 16 and the LAN side port 14.

  A flash memory 11 and a RAM 12 are connected to the CPU 10. The flash memory 11 stores a packet filtering table as shown in FIG. Further, the RAM 12 stores a session information table as shown in FIG. 4, and buffers packets input from the LAN side port 14 and the WAN side port 16 until a transfer or discard process is determined.

  When a packet is input from the LAN side port 14 or the WAN side port 16, the packet is buffered in the RAM 12, and the processing (pass / discard) is determined by applying the rules of the packet filtering table of FIG. 3 to the packet. To do. The packet determined to pass is transferred to the partner port (WAN port 16 or LAN port 14). The packet determined to be discarded is deleted from the RAM 12.

  In this embodiment, the CPU 10 is used as a control unit that controls communication between the WAN and the LAN. However, a dedicated LSI called a network processor may be used.

  In this embodiment, the network device 1 includes four LAN ports 14 and one WAN port 16. However, the present invention is not limited thereto, and at least one LAN side port 14 and at least one WAN side port 16 may be provided.

  Next, a packet filtering table stored in the flash memory 11 by the network device 1 and a session information table stored in the RAM 12 will be described. FIG. 3 is a diagram illustrating an example of a packet filtering table. FIG. 4 is a diagram illustrating an example of the session information table.

  First, the packet filtering table will be described with reference to FIG. The rules registered in the packet filtering table are “input I / F”, “output I / F”, “source address”, “destination address”, “protocol”, “protocol”, “protocol”, “protocol”, “protocol”, and “protocol”. The attributes of “start port (source port)” and “end point port (destination port)” are used as determination conditions. As the operation designation information of the corresponding packet, one of two types of “pass” that allows the packet to pass and “discard” that discards the packet is defined.

In the packet filtering table shown in FIG.
Rule 1 includes “input I / F = LAN”, “output I / F = WAN”, “start point address = 192.168.0.0 / 24”, “end point address = ZZ.ZZ.ZZ.0 / 24”. ”,“ Protocol = tcp ”,“ Start port = * (unquestioned) ”,“ End port = 80 ”, and“ Operation = Discard ”are defined.

  Rule 2 consists of “input I / F = LAN”, “output I / F = WAN”, “start address = 192.168.0.0 / 24”, “end address = *”, “protocol = tcp”, The determination conditions “start port = *” and “end port = 80” and the contents of “operation = pass” are defined.

  Rule 3 includes “input I / F = WAN”, “output I / F = LAN”, “start address = *”, “end address = 192.168.0.0 / 24”, “protocol = tcp”, The determination condition of “start port = 80” and “end port = *” and the content of “operation = pass” are defined.

  Rule 4 includes “input I / F = WAN”, “output I / F = LAN”, “start point address = AA.AA.AA.0 / 24”, “end point address = 192.168.0.0 / 24”. ”,“ Protocol = tcp ”,“ Start port = 23 ”,“ End port = * ”and“ Operation = Pass ”are defined.

  Rule 5 includes “input I / F = WAN”, “output I / F = LAN”, “start point address = BB.BB.BB.0 / 24”, “end point address = 192.168.0.0 / 24”. ”,“ Protocol = tcp ”,“ Start port = 23 ”,“ End port = * ”and“ Operation = Pass ”are defined.

  Rule 6 includes “input I / F = LAN”, “output I / F = WAN”, “start address = *”, “end address = *”, “protocol = *”, “start port = *”, “ The determination condition of “end point port = *” and the content of “operation = discard” are defined.

  Rule 7 includes “input I / F = WAN”, “output I / F = LAN”, “start address = *”, “end address = *”, “protocol = *”, “start port = *”, “ The determination condition of “end point port = *” and the content of “operation = discard” are defined.

The CPU 10 of the router device 1 applies these rules to the input packet in order from the rule 1, and when the determination conditions are met, the operation specified in the operation designation information of the rule is executed. That is, when a certain rule is supported, the operation specified in the rule is executed, and the subsequent rules are not applied. Here, “passing” of the operation is an operation of transferring the input packet to the partner port (output interface). Note that each rule of the packet filtering table shown in FIG. 3 can be updated by the GUI. The flow of the process for evaluating session information that occurs when updating this rule will be described later.

  Further, the CPU 10 of the network device 1 establishes a session for the packet that matches the “pass” of the operation. The established session is registered in a session information table described later. Sessions registered in this session information table are automatically discarded after a certain period of time. As a result, only the session information in which the packet is input / output is registered in the session information table.

  Next, the session information table will be described with reference to FIG. The session information registered in the session information table includes “input I / F”, “output I / F”, “source address”, “destination address”, “protocol”, It is composed of “source port” and “destination port” and is associated with “packet filter ID (corresponding to“ filtering rule identification number ”in claims)”.

In the session information table shown in FIG.
The session information of the session 101 includes “input I / F = LAN”, “output I / F = WAN”, “start point address = 192.168.0.3”, “end point address = ZZ.ZZ.1.ZZ”. , “Protocol = tcp”, “start port = 50001”, “end port = 80”. Since it is determined in order from rule 1 having the highest priority in the packet filtering table shown in FIG. 3 whether or not the session information of session 101 corresponds, the session information of session 101 corresponds to rule 2 and “packet Filter ID = 2 ”.

  The session information of the session 102 includes “input I / F = WAN”, “output I / F = LAN”, “start point address = AA.AA.AA.1”, “end point address = 192.168.0.3”. , “Protocol = tcp”, “start port = 23”, “end port = 56789”. Similarly, since the session information of session 102 corresponds to rule 4, it is associated with “packet filter ID = 4”.

  The session information of the session 103 includes “input I / F = WAN”, “output I / F = LAN”, “start point address = BB.BB.BB.1”, “end point address = 192.168.0.3”. , “Protocol = tcp”, “starting port = 23”, and “ending port = 51234”. Similarly, since the session information of the session 103 corresponds to the rule 5, it is associated with “packet filter ID = 5”.

  The session information of the session 104 includes “input I / F = WAN”, “output I / F = LAN”, “start point address = AA.AA.AA.1”, “end point address = 192.168.0.3”. “Protocol = tcp”, “Starting port = 80”, “Ending port = 59999”. Similarly, since the session information of session 104 corresponds to rule 3, it is associated with “packet filter ID = 3”.

  Next, an evaluation process for session information that occurs when a rule registered in the packet filtering table is updated will be described with reference to FIGS. FIG. 5 is a diagram showing an example in which some rules are extracted from the packet filtering rules shown in FIG. FIG. 5A is a diagram illustrating rules corresponding to “input I / F = WAN” and “output I / F = LAN”. FIG. 5B shows an example in which the rule 9 is added to FIG. FIG. 5C shows an example in which the rule 5 in FIG. 5B is changed. FIG. 5D shows an example in which the order of rule 3 in FIG. 5B is changed. FIG. 6 is a diagram illustrating an example in which some sessions are extracted from the session information illustrated in FIG. 4. FIG. 6A illustrates a session corresponding to “input I / F = WAN” and “output I / F = LAN”. FIG. 6B shows an example in which the packet filter ID of the session 102 in FIG. 6A is changed. FIG. 6C shows an example in which the packet filter ID of the session 104 in FIG. 6A is changed. FIG. 7 is a flowchart showing a flow of session information evaluation processing that occurs when a rule is added. FIG. 8 is a flowchart showing a flow of session information evaluation processing that occurs when a rule is deleted. FIG. 9 is a flowchart showing a flow of session information evaluation processing that occurs when a rule is changed. FIG. 10 is a flowchart showing the flow of the session information evaluation process that occurs when the rule order is changed. FIG. 11 is a flowchart showing the flow of session information evaluation processing that occurs when switching packet filtering tables.

  When a rule is added, deleted, changed, or rearranged in the packet filtering table, the network device 1 evaluates the session information at the time of addition, evaluates the session information at the time of deletion, evaluates the session information at the time of change, Evaluate the session information when changing the order. Further, when switching of the packet filtering table occurs, the network device 1 performs an evaluation process of session information at the time of switching. When a plurality of processes (for example, addition and deletion) are performed, the network device 1 performs each evaluation process (evaluation process for session information at the time of addition, evaluation process for session information at the time of deletion). Alternatively, the session information evaluation process at the time of switching may be performed. The flow of session information evaluation processing will be described below.

1) Flow of session information evaluation processing that occurs when a rule is added For simplicity of explanation, rule 9 is added to the rule shown in FIG. 5A and updated to the rule shown in FIG. An example will be described. At this time, it is assumed that the network device 1 stores the session information table shown in FIG.

  As shown in FIG. 7, when the rule 9 is added, it is checked whether or not there is a next rule with a lower priority for the added rule 9 (S101). If there is no rule (S101: No), the process is terminated. That is, the session information table is not updated.

  In the example of FIG. 5B, since the next rule (rule 4) on the lower priority side exists with respect to the added rule 9 (S101: Yes), the session information associated with the rule 4 is It is checked whether or not it exists (S102). If session information does not exist (S102: No), the process proceeds to step S108.

  Since session information (session 102) associated with the rule 4 exists (S102: Yes), it is checked whether or not the session 102 corresponds to the added rule 9 (S103). If the session 102 does not correspond to the added rule 9 (S103: No), the process proceeds to step S107.

  Since the session 102 corresponds to the added rule 9 (S103: Yes), it is checked whether or not the “action” of the added rule 9 is set to “pass” (S104). Since “pass” is set (S104: Yes), the “packet filter ID” of the session 102 is changed from 4 to 9 (S105), and the process proceeds to step S107. If “discard” is set (S104: No), the session information of the session 102 is deleted (S106), and the process proceeds to step S107.

  In step S107, it is checked whether there is other session information associated with rule 4. Since no other session information exists (S107: No), the next rule (rule 5) on the lower priority side is referred to rule 4 (S108), and the processes of steps S102 to S108 are performed. If other session information exists (S107: Yes), the processing of steps S103 to S107 is performed.

  In step S108, it is checked whether or not there is a next rule having a lower priority than the currently referenced rule (S108). If there is a rule (S108: Yes), the processing of steps S102 to S108 is performed. If there is no rule (S108: No), the process is terminated.

  Thus, the update of the session information table is completed. In the case of this description, when the rule 9 is added, the session information table becomes the table shown in FIG.

  As described above, in the session information evaluation process that occurs when a rule is added, it is checked whether or not the session information associated with the rule behind the added rule (low priority order) corresponds to the added rule, If it corresponds to the added rule, the corresponding session information is associated with the added rule. Thereby, it is not necessary to check which rule corresponds to all the session information registered in the session information table. For this reason, the session information registered in the session information table can be updated in a short time without disconnecting the session.

2) Flow of session information evaluation process that occurs when a rule is deleted For simplicity of explanation, rule 9 is deleted from the rule shown in FIG. 5B and updated to the rule shown in FIG. An example will be described. At this time, it is assumed that the network device 1 stores the session information table shown in FIG.

  As shown in FIG. 8, when the rule 9 is deleted, it is checked whether there is session information associated with the deleted rule 9 (S111). If session information does not exist (S111: No), the process ends. That is, the session information table is not updated.

  When there is session information (session 102) associated with the deleted rule 9 (S110: Yes), it is checked whether or not there is a next rule with a lower priority for the deleted rule 9. (S112). If there is no rule (S112: No), the process proceeds to step S117.

  Since the next rule (rule 4) with the lower priority exists for the deleted rule 9 (S112: Yes), it is checked whether or not the session 102 corresponds to the rule 4 (S113). Since the session 102 corresponds to the rule 4 (S113: Yes), it is checked whether the “operation” of the rule 4 is set to “pass” (S115). Since “pass” is set (S115: Yes), the “packet filter ID” of the session 102 is changed from 9 to 4 (S116), and the process proceeds to step S118. If “discard” is set (S115: No), the session information of the session 102 is deleted (S117), and the process proceeds to step S118.

  If the session 102 does not correspond to the rule 4 (S113: No), it is checked whether or not there is a next rule with a lower priority for the rule 4 (S114). When the next rule does not exist (S114: No), the session 102 is deleted (S117), and the process proceeds to step S118. If the next rule exists (S114: Yes), the process proceeds to step S113.

  In step S118, it is checked whether the deleted rule 9 is associated with other session information. If other session information is associated (S118: Yes), the processing of steps S112 to S118 is performed. If no other session information is associated (S118: No), the process ends.

  Thus, the update of the session information table is completed. If rule 9 is deleted and it corresponds to rule 4, the session information table becomes the table shown in FIG.

  As described above, in the evaluation process of session information that occurs when a rule is deleted, it is determined whether the session information associated with the deleted rule corresponds to which rule on the lower priority side behind the deleted rule. Check and if there is a corresponding rule, associate it with the corresponding rule. Thereby, it is not necessary to check which rule corresponds to all the session information registered in the session information table. For this reason, the session information registered in the session information table can be updated in a short time without disconnecting the session.

3) Flow of session information evaluation process that occurs when a rule is changed For simplification of explanation, the “starting address” of rule 5 is changed from the rule shown in FIG. A case where the rules are updated to be shown will be described as an example. At this time, it is assumed that the network device 1 stores the session information table shown in FIG.

  As shown in FIG. 9, when the rule 5 is changed, it is checked whether there is session information associated with the rule 5 before the change (S121). If session information does not exist (S121: No), the process proceeds to step S132.

  Since there is session information (session 103) associated with the rule 5 before the change (S121: Yes), it is checked whether or not the session 103 corresponds to the rule 5 after the change (S122). Since it corresponds (S122: Yes), it is checked whether or not the “operation” of the changed rule 5 is set to “pass” (S129). Since “pass” is set (S129: Yes), the process proceeds to step S131. If “discard” is set (S129: No), the session information of the session 103 is deleted (S130), and the process proceeds to step S131.

  In step S131, it is checked whether there is other session information associated with rule 5 before the change. When other session information exists (S131: Yes), the processing of steps S122 to S131 is performed. Since no other session information exists (S131: No), the process proceeds to step S132.

  In step S132, it is checked whether or not there is a next rule with a lower priority with respect to the rule 5 before the change. If there is no rule (S132: No), the process is terminated.

  Since the next rule (rule 7) on the lower priority side exists with respect to the rule 5 before the change (S132: Yes), it is checked whether or not the session information associated with the rule 7 exists (S133). ). Since session information does not exist (S133: No), the process proceeds to step S139.

  If session information associated with the rule 7 exists (S133: Yes), it is checked whether or not the session t associated with the rule 7 corresponds to the changed rule 5 (S134). When not corresponding (S134: No), it progresses to Step S138. When it corresponds (S134: Yes), it is checked whether or not the “Action” of the changed rule 5 is set to “Pass” (S135). When “pass” is set (S135: Yes), the “packet filter ID” of the session is changed to 5 (S136), and the process proceeds to step S138. If “discard” is set (S135: No), the session information of the session t is deleted (S137), and the process proceeds to step S138.

  In step S138, it is checked whether there is other session information associated with rule 7. If it exists (S138: Yse), the processing of steps S134 to S138 is performed. When it does not exist (S138: No), it progresses to S139.

  In step S139, it is checked whether or not there is a next rule with a lower priority than rule 7 (S139). When it exists (S139: Yes), the process of step S133-S139 is performed. If it does not exist (S139: No), the process is terminated.

  Thus, the update of the session information table is completed. In the case of this description, when rule 5 is changed, the session information table becomes the table shown in FIG.

  In step S122, if the session 103 does not correspond to the rule 5 after the change (S122: No), whether there is a next rule with a lower priority than the rule 5 after the change. (S123). If there is no rule (S123: No), the session information of the session 103 is deleted (S130), and the process proceeds to step S131. If the next rule (rule 7) on the lower priority side is present with respect to the rule 5 after the change (S123: Yes), it is checked whether or not the session 103 corresponds to the rule 7 ( S124). When the session 103 does not correspond to the rule 7 (S124: No), it is checked whether or not the next rule with the lower priority is present for the rule 7 (S125). S125: Yes), the process proceeds to step S124. If it does not exist (S125: No), the session information of the session 103 is deleted (S128), and the process proceeds to step S131.

  When the session 103 corresponds to the rule 7 (S124: Yes), it is checked whether the “operation” of the rule 7 is set to “pass” (S126). If it is set to “pass” (S126: Yes), the “packet filter ID” of the session 103 is changed from 5 to 7 (S127), and the process proceeds to step S131. When “discard” is set (S126: No), the session information of the session 103 is deleted (S128), and the process proceeds to step S131.

  As described above, in the process of evaluating session information that occurs when a rule is updated, it is checked whether the session information associated with the updated rule corresponds to which rule after the updated rule, and there is a corresponding rule. If so, associate it with the corresponding rule. In addition, it is checked whether or not the session information associated with the rule existing behind the updated rule corresponds to the updated rule, and if it corresponds, it is associated with the updated rule. Thereby, it is not necessary to check which rule corresponds to all the session information registered in the session information table. For this reason, the session information registered in the session information table can be updated in a short time without disconnecting the session.

4) Flow of session information evaluation process that occurs when the order of rules is changed For simplification of explanation, the rule order is changed from the rule shown in FIG. 5B to the rule shown in FIG. 5D. The case where it is updated will be described as an example. At this time, it is assumed that the network device 1 stores the session information table shown in FIG.

  As shown in FIG. 10, the first rule (rule 3) before the order change is referred to (S141), and it is checked whether the order of rule 3 is changed (S142). When the order of rule 3 is not changed (S142: No), the process proceeds to step S152.

  Since the order of rule 3 is changed (S142: Yes), it is checked whether there is session information associated with rule 3 before the order change (S143). If session information does not exist (S143: No), the process proceeds to step S152.

  Since there is session information (session 104) associated with the rule 3 before the order change (S143: Yes), whether there is a next rule with a lower priority than the rule 3 before the order change. (S144). If there is no rule (S144: No), the process proceeds to step S152.

  Since the next rule (rule 9) on the side of lower priority exists for rule 3 before the order change (S144: Yes), rule 9 has a higher priority than rule 3 after the order change. It is checked whether it exists on the side (S145). If it does not exist (S145: No), the process proceeds to step S147.

  Since rule 9 exists on the higher priority side with respect to rule 3 whose order has been changed (S145: Yes), it is checked whether or not session 104 corresponds to rule 9 (S146). When not corresponding (S146: No), it progresses to Step S147.

  In step S147, it is checked whether or not there is a next rule with a lower priority with respect to rule 9. When it exists (S147: Yes), it progresses to step S145. If it does not exist (S147: No), the process proceeds to step S151.

  When the session 104 corresponds to the rule 9 (S146: Yes), it is checked whether or not the “operation” of the rule 9 is set to “pass” (S148). If it is set to “pass” (S148: Yes), the “packet filter ID” of the session 104 is changed from 3 to 9 (S149), and the process proceeds to step S151. If “discard” is set (S148: No), the session information of the session 104 is deleted (S150), and the process proceeds to step S151.

  In step S151, it is checked whether there is other session information associated with rule 3 before the order change. If it does not exist (S151: No), the process proceeds to step S152. When other session information exists (S151: Yes), the processing of steps S144 to S151 is performed.

  In step S152, it is checked whether or not there is a next rule with a lower priority for rule 3. When the next rule (rule 9) exists (S152: Yes), the processing of S142 to S152 is performed for rule 9. As described above, while there are rules registered in the packet filtering rule, the processes in steps S142 to S152 are repeatedly executed. If the next rule does not exist (S152: No), the process ends.

  Thus, the update of the session information table is completed. In the case of this description, when the order of the rules is changed, the session information table becomes a table shown in FIG.

  As described above, in the process of evaluating session information that occurs when the order of rules is changed, it is checked whether or not the order has changed for all rules. Whether the session information associated with the rule whose order has been changed corresponds to a rule that is behind the rule that has been changed in order and is ahead of the rule that has been changed in order after the change. Whether or not the corresponding rule exists is related to the corresponding rule. Thereby, it is not necessary to check which rule corresponds to all the session information registered in the session information table. For this reason, the session information registered in the session information table can be updated in a short time without disconnecting the session.

5) Flow of session information evaluation process that occurs when switching packet filtering tables For simplicity of explanation, the rule shown in FIG. 5A is switched to the rule shown in FIG. 5C as an example. I will explain. At this time, it is assumed that the network device 1 stores the session information table shown in FIG.

  As shown in FIG. 11, in the packet filtering table before switching, the first rule m (rule 3) is referred to (S161), and it is checked whether there is session information associated with rule 3 (S162). ). If it does not exist (S162: No), the process proceeds to step S172.

  Since session information (session 104) associated with rule 3 exists (S162: Yes), the first rule n (rule 3) is referred to in the packet filtering table after switching (S163). It is checked whether or not the rule m before switching (rule 3) and the rule n after switching (rule 3) are the same rule (S164). Since the rules are the same before and after switching (S164: Yes), the process proceeds to step S172.

  In step S172, it is checked whether or not there is a next rule with a lower priority with respect to the rule m (rule 3) before switching, and the next rule (rule 4) exists (S172: Yes), it is checked whether there is session information associated with the rule 4 (S162).

  Since there is session information (session 102) associated with rule 4 (S162: Yes), the first rule n (rule 3) is referred to in the packet filtering table after switching (S163). It is checked whether or not the rule m before switching (rule 4) and the rule n after switching (rule 3) are the same rule (S164). Since the rules are different before and after switching (S164: No), in the packet filtering table before switching, rule 3 (rule n after switching) has higher priority than rule 4 (rule m before switching). (S165). Since rule 3 exists on the higher priority side with respect to rule 4 (S165: Yes), whether the next rule on the lower priority side exists for rule n after switching (rule 3). Whether or not is checked (S166). If the next rule does not exist (S166: No), the session 102 is deleted (S169).

  Since the next rule (rule 9) exists (S166: Yes), it is checked whether the rule m before switching (rule 4) and the rule n after switching (rule 9) are the same rule (S164). Since the rules are different before and after switching (S164: No), whether or not rule 9 (rule n after switching) exists before rule 4 (rule m before switching) in the packet filtering table before switching. Check (S165). Since rule 9 does not exist before rule 4 (S165: No), it is checked whether or not session 102 (session information associated with rule 4) corresponds to rule 9 (S167). If not (S167: No), the process proceeds to step S166.

  Since the session 102 corresponds to the rule 9 (S167: Yes), it is checked whether the “operation” of the rule 9 is set to “pass” (S168). Since “pass” is set (S168: Yes), the “packet filter ID” of the session 102 is changed from 4 to 9 (S170), and the process proceeds to step S171. If “discard” is set (S168: No), the session information of the session 102 is deleted (S169), and the process proceeds to step S171.

  In step S171, it is checked whether there is other session information associated with rule 4. When it exists (S171: Yes), the process of step S163 to S171 is performed about other session information.

Since there is no other session information (S171: No), it is checked whether or not there is a next rule with a lower priority with respect to rule 4 (rule m before switching) (S172). Since the next rule (rule 5) exists (S172: Yes), the processing of steps S162 to S172 is executed for rule 5. As described above, while there are rules registered in the packet filtering table before switching, the processes in steps S162 to S172 are repeatedly executed. If the next rule does not exist (S172: No), the process ends. The update of the session information table is completed. In the case of this description, when the packet filtering table is switched, the session information table becomes the table shown in FIG.

  As described above, in the process of evaluating session information that occurs when switching rules, the following processing is performed for all rules in the packet filtering table before switching. In order from the rule with the highest priority of the packet filtering table after switching, it is checked whether or not the rule exists in front of the evaluation target rule in the filtering table before switching. If it does not exist in front of the evaluation target rule, it is checked whether or not the session information associated with the evaluation target rule corresponds to the corresponding rule. Thereby, it is not necessary to check which rule corresponds to all the session information registered in the session information table. For this reason, the session information registered in the session information table can be updated in a short time without disconnecting the session.

  In the present embodiment, the session information evaluation process when updating the rules of “input I / F = WAN” and “output I / F = LAN” has been described. However, the present invention is not limited to this, and the session information evaluation process can be performed in the same processing procedure even when the rules of “input I / F = LAN” and “output I / F = WAN” are updated.

  As described above, when the rule of the packet filtering table is updated, the network device 1 according to the present invention evaluates the session information registered in the session information table and updates the session information table. At this time, the session information is evaluated with reference to only the rule to be updated and the rules registered after that rule. Thereby, since it is not necessary to evaluate the session information with reference to all the rules registered in the packet filtering table, the session information table can be updated in a short time.

  In addition, when the packet filtering table is updated, the network device 1 according to the present invention evaluates the session information and updates the session information table. The evaluation of the session information associates the session information with the corresponding rule based on the updated packet filtering rule. Thereby, if the session information registered in the session information table corresponds to the rule registered in the updated packet filtering table, it is registered as it is without being discarded. Therefore, the network device 1 can perform the packet filtering process while maintaining the established session.

It is a figure which shows the environment where LAN and WAN were connected via the network apparatus. It is a block diagram of a network device. It is a figure which shows the example of a packet filtering table. It is a figure which shows the example of a session information table. It is a figure which shows the example which extracted a part of rule from the packet filtering table shown in FIG. It is a figure which shows the example which extracted a part of session from the session information shown in FIG. It is a flowchart which shows the flow of the evaluation process of the session information which occurs when a rule is added. It is a flowchart which shows the flow of the evaluation process of the session information which occurs at the time of deletion of a rule. It is a flowchart which shows the flow of the evaluation process of the session information which occurs at the time of a rule change. It is a flowchart which shows the flow of the evaluation process of the session information which generate | occur | produces at the time of order change of a rule. It is a flowchart which shows the flow of the evaluation process of the session information which generate | occur | produces at the time of switching of a packet filtering table.

Explanation of symbols

1-network device, 2-client device, 3-network, 4 (4a, 4b) -communication device, 10-CPU, 11-flash memory, 12-RAM, 13-layer 2 switch chip, 14-LAN side port, 15-PHY chip, 16-WAN side port

Claims (6)

A network device connected to multiple networks,
Rule storage that stores filtering rules including determination conditions for determining packet attributes and operation designation information for specifying operations to be performed on packets that match the determination conditions, in descending order of priority. And
A session storage unit for storing session information when a session is established via a network device in association with an identification number of a filtering rule corresponding to the session information;
When the filtering rule stored in the rule storage unit is updated, it is evaluated whether or not the plurality of filtering rules stored in the rule storage unit correspond to the session information stored in the session storage unit. An evaluation means;
Updating means for updating the association between the session information stored in the session storage unit and the identification number of the filtering rule based on the evaluation result of the evaluation means;
The evaluation unit is a network device that evaluates session information associated with an updated filtering rule or an identification number of a filtering rule having a lower priority than the updated filtering rule. When a filtering rule is added to the rule storage unit, the evaluating unit corresponds to the session information associated with the identification number of the filtering rule having a lower priority than the added filtering rule. Evaluate whether or not
The network device according to claim 1, wherein the updating unit updates the session information corresponding to the added filtering rule so as to be associated with the identification number of the added filtering rule. When the filtering rule is deleted from the rule storage unit, the evaluation means corresponds to a filtering rule having a lower priority than the deleted filtering rule for the session information associated with the identification number of the deleted filtering rule. Evaluate whether or not
The update means updates the session information associated with the identification number of the deleted filtering rule so as to be associated with the identification number of the filtering rule having the highest priority among the filtering rules remaining after the deletion. The network equipment described in 1. When the filtering rule of the rule storage unit is changed, the evaluation unit has priority over the changed filtering rule and the changed filtering rule with respect to the session information associated with the identification number of the filtering rule before the change. Evaluate whether low filtering rules are supported,
The update unit updates the session information associated with the identification number of the filtering rule before the change so as to associate with the identification number of the filtering rule with the highest priority corresponding to the filtering rule existing after the change. Item 4. The network device according to Item 1. When the order of the filtering rules in the rule storage unit is changed, the evaluation unit has a lower priority than the replaced filtering rules for the session information associated with the identification number of the replaced filtering rule, and is replaced after the replacement. Evaluate whether filtering rules with higher priority than filtering rules
The update unit updates the session information associated with the identification number of the replaced filtering rule so as to be associated with the identification number of the filtering rule with the highest priority corresponding to the filtering rule after the replacement. The described network equipment. When the evaluation unit switches the rule storage unit, a filtering rule having a higher priority than the filtering rule corresponding to the pre-switching filtering rule is selected from the post-switching filtering rule for the session information associated with the pre-switching filtering rule. Except, evaluate whether to respond,
The network device according to claim 1, wherein the updating unit updates the session information so as to be associated with an identification number of a corresponding filtering rule having the highest priority.

Images