JP4412489B2 - Defense policy creation system and method for unauthorized access and program thereof - Google Patents

Description

  The present invention, in a system providing some service to the network, detects the occurrence of external program activation, data reference, rewriting, etc. that are not intended by the provided service, or detects them before the occurrence, The present invention relates to a system for creating a defense policy against unauthorized access that identifies a request from a network that causes a problem and generates a rule for preventing similar access.

  A conventional unauthorized access countermeasure rule generation system includes a buffer overflow detection unit on a server and an apparatus that generates an unauthorized access countermeasure rule for use in a packet filter from information detected thereby (for example, a patent) Reference 1).

  The conventional system having such a configuration generates a packet filtering rule corresponding to detection of a buffer overflow attack on a program running on a server, but the current form of unauthorized access is based on these buffer overflows. There are various ways besides things.

  As an example, an external program startup due to a CGI (Common Gateway Interface) input field check mistake or an illegal file reference due to a setting file authority setting omission cannot be detected by these methods, and a defense rule may be generated. I can't.

In addition, the segment protection by packet filtering using the generated rule has a problem that it cannot be protected by filtering when a worm has already entered the segment.
JP 2004-334607 A

  However, in the conventional intrusion detection system, there is a system for detecting illegal access to data flowing on a network by checking the characteristics of data called a signature. In this system, signature information to be detected is detected. It was necessary to generate it first, and access by an unknown method could not be detected. In addition, when data flowing through the network is encrypted, there is a problem that it is impossible to verify the contents and that it is too late at the time of detecting illegal data.

  Currently, there is a policy-based intrusion prevention system (IPS) on the host side that performs intrusion detection and protection on the host that provides the service, and this is set for specific areas and process behavior. It is possible to allow or deny access according to the policy set, but the policy settings depend on the contents of the service provided and the file location on the host. Had to be set.

  Therefore, the present invention detects various forms of unauthorized access by the function of the host-type policy base IPS, and prepares templates for each protocol for the access causing the access from the information detected by them. It is an object of the present invention to provide a defensive policy creation system and method and a program for preventing unauthorized access on the host before the service program accepts these requests when the same unauthorized access is received via the network. To do.

In order to solve the above-described problems, the present invention provides a system for providing a service to a network, the data transmitting / receiving unit transmitting / receiving data to / from the network, and the service providing by receiving data from the data receiving unit. A service process unit that performs process processing for the first time, a first operation monitoring unit that monitors data from the network to the service process unit to detect unauthorized access, and a temporary storage for temporarily transferring data transferred from the network A storage area, data to be accessed by the service process unit are stored, an external storage device having a protection area that is designated for protection in part, and the operation of the service process unit is monitored, and a program other than a program permitted in advance Program startup or access to the protected area other than those permitted in advance The second operation monitoring unit that detects the activation of the program, and the second operation monitoring unit detects activation of a program other than the program permitted in advance or access to the protection area from the program not permitted in advance. A policy generating unit that extracts information that is the source of the unauthorized access from the temporary storage area and generates a defense policy for detecting unauthorized access for the first operation monitoring unit based on the information; , Provided .

  A first effect of the present invention is that a policy for detecting unauthorized access that can be used by other nodes can be generated by setting a policy for starting a file or process. The reason is that the generated policy is configured by a blocking rule and signature information in a transmission / reception unit with the network, and can therefore be applied to other nodes without depending on the node path or the like.

  The second effect is that the security of the node itself can be improved by the automatically generated policy by applying the generated policy as necessary. The reason is that if there is an omission of protection specification in the file area etc. on the node, the transmission / reception unit with the network will be protected from the same attack, so unauthorized access will not reach the service process. It is.

  Next, the best mode of the present invention will be described with reference to the drawings.

  FIG. 1 is a functional block diagram of a defense policy creation system against unauthorized access according to the present invention. A data transmitting / receiving unit 1 for transmitting / receiving data to / from the network, a temporary storage area 4 for temporarily recording received data for a certain size, and a service process unit 2 for receiving data from the data receiving unit and transmitting / receiving data The storage process 3 holds the data for responding to the data received by the service process or the original data for creating the data for responding, and the service process according to the set policy. Data exchanged with the data transmission / reception unit and access to the storage device and service process operations (child processes, thread activation, etc.) are monitored, and an operation monitoring unit 5 that detects unauthorized access and detected by the monitoring operation Based on the information recorded in the temporary storage area that is the source of unauthorized access, It is constituted by the policy generating unit 6 for creating a protection policy for the signal from unauthorized access information detected by the access policy to the storage device, generating a fraud detection policy in the data receiving step.

  Next, the configuration of the embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 2 shows a functional configuration of the first embodiment of the present invention. In the first embodiment, an OS kernel (operation monitoring) that receives data from the network 10 and manages access to data in the external storage device 201, processes that perform services, their start / stop, and data input / output. 1), and implements the functions of the present invention shown in FIG.

  The OS kernel 101 manages the data transmission / reception unit 11 that transmits / receives data to / from the network 10, the temporary storage area 12 that stores the received data for a certain period of time, and the start / stop of each process that operates on the OS. The process generation unit 15, the file access unit 17 that relays and manages the access of the external storage device by each process operating on the OS, and their operation and input / output data are monitored based on the monitoring policy 20. An operation monitoring unit 4 for stopping and permitting is included.

  The external storage device 201 includes data that each process operating on the OS accesses via the OS kernel 101. In this configuration, the protection area 22 and the protection target originally designated for protection by the monitoring policy 20 are provided. Non-protection area 24, a protection area (protection leakage) 23 that should be protected by the monitoring policy 20 but should be protected, and a generated policy 21 that is finally generated by this overall configuration.

  In addition to the above, a service providing process 13 that operates on the OS and provides a service on the kernel 101, a subprogram 16 that the service providing process 13 uses to create response data, and an arbitrary command on the OS A general-purpose shell 18 that can execute the process, and the information recorded in the operation monitoring unit 14 and the temporary storage area 12 are received and analyzed, and a policy for detecting the corresponding access by the data receiving unit from the unauthorized access to the file is created. The policy automatic generation unit 19 is configured.

  FIG. 3 shows a detailed functional configuration of the policy automatic generation unit 19. The policy automatic generation unit 19 reads the unauthorized access information 25 generated by the operation monitoring unit 14 and the connection request time information 26 recorded in the temporary storage area, and accesses a file for which unauthorized access is not permitted. An unauthorized access mode determination dispatcher 91 that determines whether there is a program that is not permitted or not, and determines the next process; and protocol map information 92 that is a table for the dispatcher to determine the next process; When the external program is directly started or when the file name included in the connection request time information 26 is directly referred to, the program / file check means 93 for determining the corresponding part is associated with the data included in the connection request time information 26. Protocol-specific file map means 94 for determining unauthorized access to a file to be accessed The protocol-based common data determination process 96 for determining unauthorized access to other files and the common location in the mapped file access method, and the policy data template 97 and the protocol-specific policy generation guide 98 are read from the results. The policy data generation means 95 for generating the generation policy 21 and the unauthorized access feature data storage statistical information 27 for storing the unauthorized access feature data determined by these processes.

  The generation policy 21 includes both information on temporarily receiving or monitoring data reception from the X service to the Y service, and characteristic information (corresponding to a signature) of request data to be monitored.

  Next, the operation of the first embodiment of the present invention will be described with reference to FIG.

  In order to receive a service request (request data) from the network 10, the service providing process normally waits for data reception while issuing a reception request to the data transmitting / receiving unit.

  In the present invention, a policy for prohibiting access to the protection area 22 by other than the subprogram 16 is applied to the operation monitoring unit 14 in advance, and access by the service providing process 13 or the general-purpose shell 18 in the figure is file access. When implemented via the unit 17, a policy is applied in which access is stopped by the operation monitoring unit 14.

  Further, in the separate monitoring policy 20, a policy for prohibiting activation of other processes is described from the subprogram 16 and applied to the operation monitoring unit 14, and a process is generated to activate an external program from the subprogram 16. When the unit 15 is called, the operation monitoring unit 14 is prevented from starting.

  In the service providing process 13, a policy for prohibiting the activation of external processes other than the subprogram 16 is described and applied to the operation monitoring unit 14. The general-purpose shell 18 other than the subprogram 16 is connected to the process generation unit 15. It is assumed that the operation monitoring unit 14 prevents the user from starting via the Internet.

  The information recorded in the temporary storage area 12 includes a certain size from the beginning of the connection request data received from the network, the network attributes (address, port, protocol, etc.) at the time of reception, and the service providing the reception request The process information and the input / output path (socket descriptor, handle, etc.) of the data requesting reception to the data transmitter / receiver in the service request process are recorded.

  Note that at the first stage, the monitoring policy 20 is not set with operation restrictions based on received data verification in the data transmission / reception unit.

Process 1-1
First, when the data transmission / reception unit 11 receives request data for the service provided by the service providing process 13 from the network 10, the data transmission / reception unit records the received data in the temporary storage area 12 together with the information of the process requested to receive the data. After confirming the received data and the relay permission to the service providing process 13 in the monitoring unit 14, the request data is transferred to the service providing process 13.

Process 1-2:
The service providing process 13 analyzes the received data and goes to the external storage device 201 via the file access unit 17 for information necessary for providing the service. The file access unit 17 notifies the operation monitoring unit 14 of the access source process and the access destination. If the access is permitted (if the accessed data is a non-protected area), the file access unit 17 transfers the corresponding data to the service providing process 13. Return to.

Process 1-3:
The service providing process 13 that has extracted the response to the request data in the process 1-2 returns the response to the request data to the network 10 via the data transmission / reception unit. The data transmission / reception unit determines whether or not response data transmission is possible in the operation monitoring unit 14 before returning the data to the network.
After returning the response, the data recorded in the corresponding temporary storage area is deleted.

Process 1-4:
If the destination referenced by the service providing process 13 in the process 1-2 is the protected area 22, the access is regarded as illegal, and the information of the temporary storage area and the information of the path of the destination to be accessed are combined. The policy automatic generation unit 19 is notified. The location where the policy automatic generation unit 19 processes the received data will be described later.

Process 1-5:
In the process 1-2, when the service providing process 13 tries to start an external program other than the subprogram 16 via the process generation unit 15, the operation monitoring unit 14 prevents the process from starting and is recorded in the temporary storage area. The request data and the information of the program to be started are notified to the policy automatic generation unit 19. The location where the policy automatic generation unit 19 processes the received data will be described later.
Next, a process when the service providing program creates data by starting other subprograms (CGI or other tools) in order to create response data will be described.

Process 2-1
The same processing is performed up to processing 1-1.

Process 2-2:
The service providing process 13 analyzes the received data and activates the subprogram 16 necessary for creating response data via the process generation unit 15. At this time, the process generation unit 15 separately determines whether or not the process monitoring unit 14 can generate the process. If the process can be started, the subprogram 16 is started.

Process 2-3:
The subprogram 16 creates response data by referring to the data in the protected area 10 and notifies the service providing process 13 of the response data.

Process 2-4:
Processing is the same as processing 1-3.

Process 2-5:
In process 2-2, if the process that the service providing process 13 is trying to start is other than the subprogram 16, the operation monitoring unit 14 prevents the process from being started, the request data recorded in the temporary storage area, and the start Information about the program to be tried is notified to the policy automatic generation unit 19. The location where the policy automatic generation unit 19 processes the received data will be described later.

Process 2-6:
In processing 2-3, when the subprogram 16 tries to start another process (general shell 18 or the like) via the process generation unit 15, the request that is blocked by the operation monitoring unit 14 and recorded in the temporary storage area The data and the information of the program to be started are notified to the policy automatic generation unit 19. The location where the policy automatic generation unit 19 processes the received data will be described later.

  In any process, when data is transmitted to the automatic generation unit 9 after detecting unauthorized access, the data in the temporary storage area is deleted.

  Next, the process from when the policy automatic generation unit 19 receives the detection information by the operation monitoring unit 14 and the data in the temporary storage area to the generation of the generation policy 21 will be described.

Process 3-1:
The unauthorized access mode determination dispatcher 91 reads the unauthorized access information 25 generated by the operation monitoring unit 14 and the connection request time information 26 recorded in the temporary storage area, and the protocol information recorded in the connection request time information 26 is If the protocol is recorded in the protocol map information 92, the connection request time information is disassembled according to the map information 93 and the protocol-specific file map means 94 is called. If not, the program / file check means 93 is called.

Process 3-2:
The program / file check means 93 determines from the unauthorized access information 25 which of the following forms of unauthorized access.

  Unauthorized access mode 1: Start of an unauthorized program.

  Unauthorized access mode 2: Access to an unauthorized file.

  After the above determination, it is confirmed whether or not the illegally accessed file or program recorded in the unauthorized access information 25 is recorded in the connection request time information 26. At this time, in the case of the unauthorized access form 1, only the program name in the path is determined to match, and in the case of access to the file, it is determined whether or not the path matches backward. If they match in this determination, it is determined that the vulnerability of the service program is highly likely to be attacked, and data other than the path is recorded in the unauthorized access feature data accumulation statistical information 27. At this time, if there is a feature-matching feature data recorded in the past, the matching frequency information of the corresponding feature data is increased. When the frequency information rises above a certain level, the corresponding part is regarded as data of unauthorized access means, and the policy data generation means 95 is executed.

Process 3-3:
The protocol-specific file map means 94 is a known protocol and has a known format for mapping the description or data included in the connection request time information 26 to the actual file (for example, the request URL in http and the actual content are For the mapping to the file path, etc., the common data determination processing 96 for each protocol is used to determine which of the following types of unauthorized access is made. The unauthorized access information 25 is also used for the determination.

  Unauthorized access mode 3: Protocol is correct and access control settings on the service provider side are missing (for example, the request URL of http is mapped to the corresponding file, and the protected area can be specified by directly specifying the URL. If you can refer to the data).

  Unauthorized access mode 4: A service providing program is processed normally, but a file in a protected area is accessed due to a problem of a subprogram started from the program. Or, a program that cannot be started originally is started (information on the file or program path recorded in the unauthorized access information 25 is described in the argument information such as cgi of the request URL).

  Unauthorized access mode 5: A program that cannot be started from the service providing program is running, or the file is being accessed and the protocol is set so that the relevant file or program path cannot be accessed ( (If the program is hijacked due to a vulnerability in the service provision program such as buffer overrun, or if a vulnerability in which an arbitrary command or file can be accessed due to an internal processing problem)

Process 3-4:
Depending on the determined unauthorized access mode, a protocol-specific common data determination process 96 is separately called, and common information with the previous call is extracted for each unauthorized access mode (the illegal character string common to the request data header is There is an illegal common character in the CGI argument of the request URL). After the common data is extracted, the policy data generation means 95 is called.

Process 3-5:
The policy data generation means 95 uses the unauthorized access feature data accumulation statistical information 27 generated by the above processing and the policy data template 97, and when the unauthorized data is mixed in the connection request accepted by the service, this is performed. Generate a blocking policy. At this time, if the protocol is already known, the generation policy 21 is generated separately according to the information of the policy generation guide 98 for each protocol (necessary to reversely convert the path data of the illegal access destination into the data on the protocol. Because there may be).

  Next, the effect of the first embodiment will be described. In the first embodiment, when a similar unauthorized access is detected in a state where access to an unauthorized file or unauthorized program startup processing has been reached, a policy for protection at an earlier stage is automatically generated. This makes it possible to detect unauthorized access at an earlier stage.

  In addition, the policy using the feature data generated in the present invention does not include node-specific information (when the common information is extracted, the node-specific path is excluded in the process 3-2). By reflecting the generated policy, it is possible to prevent a similar attack on the corresponding node.

  In the first embodiment, the unauthorized access detection by the operation monitoring is described only for the file and the process generation. However, it is possible to add the detection for the unauthorized access of the following form and create a policy in the same manner. Is possible.

  Unauthorized access mode 6: The service providing program is processing normally, but it is executing a network access or access to a service that cannot be executed due to a problem of a subprogram started from the program (request URL cgi) The information on the network address or host name, URL, service, etc. recorded in the unauthorized access information 25 is described in the argument information such as.

  Unauthorized access form 7: Originally not generated from the service providing program (the service program itself does not connect to the network programmatically, or the setting is such that access to the corresponding address and host does not occur by setting. Access to the network (if the program is hijacked due to a vulnerability in the service provision program such as buffer overrun, or because of internal processing problems, access to any network, or other If you are attacking a vulnerability that can connect to the service).

  With respect to the above, it is possible to generate the generation policy 21 by separately defining a network service check unit similar to the program / file check unit 93 in the policy automatic generation unit 19.

  In the first embodiment, the generation policy 21 is generated on the external storage device. However, the generation policy 21 may be dynamically transferred to the network, stored in the memory, or both. Is possible.

It is a functional block diagram of the present invention. It is a functional block diagram of a 1st Example. It is a detailed functional block diagram of a policy automatic generation part.

Explanation of symbols

1 Data Transmission / Reception Unit 2 Service Process Unit 3 Storage Device 4 Temporary Storage Area 5 Operation Monitoring Unit 6 Policy Generation Unit

Claims (3)

A system that provides services to a network,
A data transmission / reception unit for transmitting / receiving data to / from the network;
A service process unit that receives data from the data receiving unit and performs a process for providing a service;
A first operation monitoring unit that detects unauthorized access by monitoring data from the network to the service process unit;
A temporary storage area for temporarily storing data transferred from the network;
Data that is accessed by the service process unit is stored, and an external storage device having a protection area designated as protected in part,
A second operation monitoring unit that monitors the operation of the service process unit and detects activation of a program other than a program permitted in advance or access other than a program permitted in advance to the protection area;
If the second operation monitoring unit detects the start of a program other than the pre-permitted program or the access from the non-pre-permitted program to the protection area, the illegal storage is performed from the temporary storage area. Policy generating means for extracting information that is a source of access and generating a defense policy for detecting unauthorized access for the first operation monitoring unit based on the information;
A system for creating a defense policy against unauthorized access, characterized by comprising: A method for creating a defense policy against unauthorized access of a system providing a service to a network,
A temporary storage area for temporarily storing data transferred from the network;
Data that is accessed by the service process unit is stored, and a part of the external storage device having a protection area designated for protection is included.
Transmitting and receiving data to and from the network by a data transmitting and receiving unit;
Receiving a data from the data receiving unit by a service process unit and performing a process for providing a service;
Monitoring data from the network to the service process unit by a first operation monitoring unit to detect unauthorized access;
Monitoring the operation of the service process unit by a second operation monitoring unit to detect activation of a program other than a previously permitted program or access other than a previously permitted program to the protection area; and
If the policy generation means detects activation of a program other than the program permitted in advance by the second operation monitoring unit or access to the protection area from the program not permitted in advance, the temporary storage Extracting information from the area that is the source of the unauthorized access, and generating a defense policy for detecting unauthorized access for the first operation monitoring unit based on the information;
A method for creating a defense policy against unauthorized access , comprising : Computer
A data transceiver for transmitting and receiving data to and from the network;
A service process unit that receives data from the data receiving unit and performs a process for providing a service;
A first operation monitoring unit that detects unauthorized access by monitoring data from the network to the service process unit;
Pre-permitted program for a protection designated protection area of an external storage device that monitors the operation of the service process unit and starts a program other than a pre-permitted program or stores data accessed by the service process unit A second operation monitoring unit for detecting access other than
Data transferred from the network when the second operation monitoring unit detects activation of a program other than the pre-permitted program or access to the protection area from the non-pre-permitted program Policy generation means for extracting information that is the source of the unauthorized access from a temporary storage area that temporarily stores the information and generating a defense policy for detecting unauthorized access for the first operation monitoring unit based on the information;
Program to make it function .

Images