JP2002016633A - Method and system for controlling communication state - Google Patents

Abstract

PROBLEM TO BE SOLVED: To protect the server of a user connected to an ISP from illegal access transmitting a large quantity of data. SOLUTION: A traffic measuring instrument 115 monitors the state of a network 113 and a traffic monitoring device 116 judges a congestion state or the like detected as a result of monitoring and reports it to a router controller 103. Besides, corresponding to the notice from the traffic monitoring device 116, the router controller 103 controls a line router 101 or Internet router 102 and data from an IP address reported from the router controller 103 are abandoned.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a communication state control method and a communication state control system for connecting to the Internet via an Internet service provider.

[0002]

2. Description of the Related Art In the Internet, when an individual or a company operates a public server such as a Web server, an Internet service provider (ISP) is used.
vice Provider) to connect their network to the Internet. To explain the connection to the Internet by the ISP, first, as shown in FIG.
1, an Internet router 602, and a router control device 603. The line router 601 has an IS
Lines from the user A 610 and the user B 620 attempting to connect to the Internet using the P600 are connected, and the Internet router 602 is connected to the Internet 630.

On the other hand, a user A 610 has a Web server 611 in which the HTML of a home page is stored,
A mail server 612 and the like are provided, and these are connected to a network 613. The user A 610 sets a terminal router 614 on the network 613 and
Is connected to the line router 601 of the ISP 600 via the. In this configuration, the other terminal 650 connected to the Internet 630 and the Web server 611 of the user A 610 connect the terminal router 614 to the line router 601-
The connection is established via the Internet 630 on the route of the Internet router 602. These are the same for the user B620. Therefore, for example, the home page prepared in the Web server 611 can be viewed from the other terminal 650.

[0004]

By the way, from another terminal connected to the Internet 630, the user A6
When data is transmitted to the ten Web servers 611 and the mail server 612, response processing such as data transmission for reply is performed. However, when a large amount of data that cannot be processed by these servers is transmitted from the other terminal, the Web server 611 and the mail server 612 cannot keep up with the corresponding processing, and the inside of each server and the network 613 become congested. Become. Conventionally, when such an unauthorized access occurs, the response to the data transmitted on the user side is stopped, for example, to cope within the network on the user side. For this reason, when the above-mentioned network attack occurs, the user cannot often suppress the stop state of each server due to network congestion.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and has as its object to protect a user server connected to an ISP from unauthorized access that transmits a large amount of data. And

[0006]

SUMMARY OF THE INVENTION A communication state control method according to the present invention comprises the steps of: transmitting an amount of data transmitted via the Internet to a server of a user connected to the Internet via an Internet service provider; Is measured at predetermined time intervals with the IP address of the transmission source that has transmitted the data, and when the measured data amount is equal to or larger than a predetermined specified value, the specific transmission source that has transmitted the data amount equal to or larger than the specified value is measured. The data transmitted from the specific IP address to the server is intended to be discarded by one or both of the Internet router and the line router. According to the present invention, data from a transmission source that has transmitted a data amount equal to or larger than the specified value does not reach the user's server.

In the above invention, the amount of data transmitted to the server via the Internet and the IP address of the transmission source that transmitted the data are measured on the user side, and the data amount measured by the user is measured. When it is determined that the value exceeds the preset value, the Internet service provider discards the data sent to the server from the specific IP address to one or both of the Internet router and the line router. Let it.

Further, the communication state control method according to the present invention is characterized in that the operating rate of the CPU of the server of the user connected to the Internet via the Internet service provider, the usage rate of the main memory of the CPU, and the rate of use of the server per fixed time. Measure the total number of requests and the amount of communication per unit time, and when the operation rate, the usage rate, the total number of requests, and the amount of communication are equal to or more than a preset specified value, The data transmitted to the server from the specific IP address of the specific transmission source that transmitted the data is intended to be discarded by one or both of the Internet router and the line router. According to the present invention, the data from the transmission source when the measured value exceeds the specified value does not reach the user's server.

In the above invention, the user measures the operating rate of the server CPU, the usage rate of the main memory of the CPU, the total number of requests to the server per fixed time, and the traffic per unit time. When the Internet service provider determines that the operation rate, usage rate, total number of requests, and communication volume have exceeded the preset specified values, the data transmitted from the specific IP address to the server by the Internet service provider side. To the Internet router and / or the line router.

In the above invention, the server is connected to a dedicated line via a network to which the server is connected, and the network is connected to the dedicated line via a terminal router. Also, if the amount of data to be discarded by one or both of the Internet router and the line router falls below the preset specified value, the server will be sent to the server from the specific IP address of one or both of the Internet router and the line router. Stop discarding the data sent to it.

A communication state control system according to the present invention includes an Internet service provider having a router control device connected to an Internet router and a line router for controlling the Internet router and the line router, and a user connected to the line router by a dedicated line. Server, a traffic measuring device that measures the amount of data transmitted to the server via the Internet, and the IP address of the transmission source that transmitted the data at predetermined time intervals. When the measured data amount is monitored and the data amount becomes equal to or greater than a predetermined value, traffic for notifying the router control device of a specific IP address of a specific transmission source transmitting the data amount equal to or more than the specified value. A monitoring device, and the router control device includes: The data transmitted from the notified specified IP address to the server from the traffic monitoring device is configured to control so as to discard the one or both of the Internet router or access router. According to the present invention, data from a transmission source that has transmitted a data amount equal to or larger than the specified value does not reach the user's server.

A communication state control system according to the present invention comprises an Internet service provider having a router control device connected to an Internet router and a line router for controlling the Internet router and the line router, and a user who connects to the line router by a dedicated line. A server, a traffic measuring device for measuring an operation rate of a CPU of the server, a usage rate of a main memory of the CPU, a total number of requests to the server per a certain period of time, and a traffic volume per unit time; an operation rate and a usage rate And the total number of requests and the traffic are monitored. If these values exceed a predetermined value, the specific IP address of the specific transmission source that was transmitting data at the time when the values exceeded the predetermined value is set to the router. A traffic monitoring device for notifying the control device; Controller is configured to control so as to discard from a particular IP address notified from the traffic monitoring device data sent to the server, to one or both of the Internet router or access router. According to the present invention, the data from the transmission source when the measured value is equal to or greater than the specified value,
Do not reach the user's server.

In the above invention, there is provided a network to which the server is connected, and a terminal router for connecting this network to a dedicated line. Also, the router control device
If the amount of data to be discarded by one or both of the Internet router and the line router falls below a preset value, the server will be sent to the server from a specific IP address of one or both of the Internet router and the line router Control to stop discarding the transmitted data.

Further, the communication state control method of the present invention provides a line router for passing traffic to a user side network, and a traffic from the Internet to the user side network which is connected to the line router via a communication network. And a communication state control method in a network having an Internet router that receives a control instruction for traffic from a specific IP address from a user-side network.
This is intended to cause a line router and an Internet router to control traffic distribution in accordance with control contents registered in advance in association with a user. According to the present invention, when traffic exceeding a specified value occurs, data from the transmission source is limited by the line router and the Internet router.

In the above invention, the control signal from the user's network is issued when the amount of traffic received by the user's network exceeds a predetermined threshold. The control instruction from the user's network is issued when the system operation rate of a server installed in the user's network exceeds a predetermined threshold.

[0016]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a configuration diagram illustrating a configuration of a communication state control system according to an embodiment of the present invention. As shown in FIG. 1, first, the ISP 100 includes a line router 101, an Internet router 102, and a router control device 103. Line router 101
Are connected to lines from users A 110 and B 120 who intend to connect to the Internet using the ISP 100, and the Internet router 102 is connected to the Internet 130.

On the other hand, the user A 110 has a Web server 111 and a mail server 112 in which HTML of a home page is stored and the like, and these are connected to a network 113. Further, the user A 110 connects the network 113 to the ISP through the terminal router 114.
100, that is, to the line router 101. Therefore, the Web server 111 and the mail server 11
2 is connected to the Internet 130 via the ISP 100. In addition, user A110
Has a traffic measuring device 115 and a traffic monitoring device 116. The user B12
The same applies to 0.

In the present embodiment, first, the traffic measuring device 115 monitors the state of the network 113,
The traffic monitoring device 116 determines the congestion state and the like detected as a result of monitoring and notifies the router control device 103 of the congestion state. Also, according to the notification from the traffic monitoring device 116, the router control device 103 controls the line router 101 and the Internet router 102,
The data from the IP address notified from the router control device 103 is discarded. By the above control, control may be performed so that data from the notified IP address is not sent to the user A110, and data from the notified IP address may be reduced to the user A110 by reducing the data amount. The delivery of traffic may be controlled for each router in any manner of delivery.

More specifically, first, the traffic measuring device 115 measures a source IP address, a destination IP address, and a data amount of data passing through the network 113 at predetermined time intervals. For example, as shown in FIG. 2, the above contents are measured every two seconds, and the IP address is “1”.
0. XX. XX. XX "and the IP address of the transmission source of the data" 223.xxx.xxx.xxx "are detected.

In the traffic monitoring device 116, if the data amount is larger than the set value in the result detected by the traffic measuring device 115, the user A 110
It is determined that the Web server 111 is under a net attack. If the traffic monitoring device 116 determines that the attack is a net attack, the traffic monitoring device 116 notifies the router control device 103 that the network attack has been received from the IP address “223.xxx.xxx.xxx”.

By this notification, the router control device 103
Then, control is performed such that the data transmitted from the IP address “223.xxx.xxx.xxx” is discarded by the line router 101 or the Internet router 102.
As a result of the control by the router control device 103, the IP address “223.xxx.xxx.xxx” on the Internet 130 is obtained.
Will not reach the user A 110, and the net attack on the Web server 111 will be eliminated.

Hereinafter, the communication state control method of the present invention will be described with reference to the flowchart of FIG. First, the traffic measuring device 115 measures the communication status in the network 113 (step S2), and the traffic monitoring device 116 determines the measured communication status (step S3). These are performed at predetermined intervals (step S1). In this determination, it is determined whether or not the data amount from a specific IP address of the own network 113, for example, to the Web server 111, has exceeded a specified value. If it is determined in step S3 that the data amount from the specific IP address has exceeded the specified value, the traffic monitoring device 116 attacks the router control device 103 from the specific IP address with the IP address “ The occurrence is notified to the Web server 111 of “10.XX.XX.XX” (step S4).

The router control device 103, which has been notified of the occurrence of the attack from the traffic monitoring device 116, restricts the operations of the line router 101 and the Internet router 102 and discards data from the specified IP address. Thereafter, the router control device 103 monitors the amount of discarded data (step S7), and releases the operation restriction of the line router 101 and the Internet router 102 when the amount of discarded data per unit time becomes equal to or less than a specified value. (Step S8). These are performed at regular intervals (step S6).

In the above embodiment, an attack on the user's server is determined based on the source IP address, destination IP address, and data amount of data passing through the network 113 measured by the traffic measuring device 115. Although it did, it is not limited to this. As shown in FIG. 4 (a), the traffic monitoring device 116 sends a request from the Web server 111 or the mail server 112 to
Information such as the amount of data transmitted to the network 113 and the source of the data, as well as the CP per unit time in each server as shown in FIG.
The U operating rate, the main memory usage rate, the number of connections per fixed time (total traffic), and the communication traffic per unit time (traffic) may be acquired, and the determination may be made based on these information. The acquisition of the communication amount can be performed, for example, by using an interface (NI) for connecting the server to the network.
The amount of communication passing through C) may be obtained from each server.

For example, the operating rate of the CPU, the usage rate of the main memory, the number of requests per unit time to the server, and the traffic per unit time to the server are all set in advance as shown in FIG. If the value exceeds the set specified value, it may be determined that a net attack has been received. In this case, the IP address of the sender accessing the network at the time of determining that the network attack is being performed is determined to be the attacking source performing the network attack, and the traffic monitoring device 116 uses this information as the router control device 103. Send to As a result, the router control device 1
Reference numeral 03 controls the line router 101 and the Internet router 102 to discard transmission data from the IP address.

In the above embodiment, the traffic monitoring device 116 determines whether or not a network attack has occurred. However, the present invention is not limited to this.
May be used to determine whether a net attack has occurred. in this case,
The traffic monitoring device 116 determines the result measured by the traffic measuring device 115 and the traffic monitoring device 116.
Transmits the acquired information to the router control device 103,
The router control device 103 performs determination and router control based on information sent from the traffic monitoring device 116.

The case where the router control device 103 makes the determination will be described with reference to the flowchart of FIG. First, the traffic measuring device 115
Is measured (step S52), and the traffic monitoring device 116 transmits the measured communication condition to the router control device 103 (step S53). Next, the router control device 103 that has received the data determines whether or not there is a net attack from the received communication state (step S53). These are performed at regular intervals (step S51). In this determination, the Web server 1 of the network 113 of the user A 110 that has transmitted the communication state
It is determined whether or not the amount of data from a specific IP address corresponding to 11 has exceeded a prescribed value.

If it is determined in step S53 that the data amount from the specific IP address has exceeded the specified value,
The router control device 103 restricts the operations of the line router 101 and the Internet router 102, and discards the data from the IP address that has transmitted the data amount exceeding the specified value (step S55). Thereafter, the router control device 103 monitors the amount of discarded data (step S57), and releases the operation restriction of the line router 101 and the Internet router 102 when the amount of discarded data per unit time becomes equal to or less than a specified value. (Step S58). These are performed at regular intervals (step S56).

[0029]

As described above, according to the present invention,
Since the transmission of data from a source that has transmitted a certain amount of data or more is discarded by the ISP, the server of the user connected to the ISP can be protected from unauthorized access that transmits a large amount of data. The effect is obtained.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating a configuration of a communication state control system according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating an example of a measurement result of the traffic measurement device.

FIG. 3 is a flowchart illustrating a communication state control method according to the embodiment of the present invention.

FIG. 4 is a diagram illustrating an example of data acquired by the traffic monitoring device.

FIG. 5 is a flowchart illustrating a communication state control method according to another embodiment of the present invention.

FIG. 6 is a configuration diagram showing a configuration showing a mode of connecting to the Internet via a conventional ISP.

[Explanation of symbols]

100 ... ISP (Internet Service Provider), 10
1 ... line router, 102 ... internet router,
103: Router control device, 110: User A, 11
1 Web server, 112 Mail server, 113
... Network, 114 ... Terminal router, 115 ... Traffic measuring device, 116 ... Traffic monitoring device, 1
20 ... User B, 130 ... Internet.

Claims (13)

[Claims] 1. An Internet service provider comprising an Internet router connected to the Internet side and a line router connected to the Internet router, connects a user's server to the line router with a dedicated line, and connects the server to the server. Connects to the Internet, measures the amount of data transmitted to the server via the Internet and the IP address of the source that transmitted the data at predetermined time intervals, and sets the measured data amount in advance. When the data amount exceeds the specified value, the data transmitted to the server from the specific IP address of the specific transmission source that has transmitted the data amount equal to or more than the specified value is transmitted to either the Internet router or the line router. Or one or both Communication state control how. 2. The communication state control method according to claim 1, wherein the measurement of the amount of data transmitted to the server via the Internet and the IP address of the transmission source that transmitted the data are performed. When the data amount measured by the user is determined to be equal to or greater than a predetermined value set by the user, the Internet service provider transmits the data from the specific IP address to the server. A communication control method of causing said one or both of said Internet router and said line router to discard said data. 3. An Internet service provider having an Internet router connected to the Internet side and a line router connected to the Internet router, connects a user's server to the line router by a dedicated line and connects the server to the server. Connect to the Internet, measure the operating rate of the CPU of the server, the usage rate of the main memory of the CPU, the total number of requests for the server for a certain period of time, and the communication volume per unit time; And when the total number of requests and the communication amount are equal to or greater than a predetermined value, the data is transmitted to the server from the specific IP address of the specific transmission source that was transmitting data at the time when the value exceeded the predetermined value. The data that has been sent to the Internet router or the line router Communication control method for causing discarded either one or both. 4. The communication state control method according to claim 3, wherein an operating rate of a CPU of the server, a usage rate of a main memory of the CPU, a total number of requests to the server for a certain period of time, and a communication amount per unit time. The measurement is performed on the user side, and when it is determined on the user side that the operation rate, the usage rate, the total number of requests, and the communication amount are equal to or greater than predetermined values set in advance, the Internet service provider A communication control method comprising: causing one or both of the Internet router and the line router to discard data transmitted from the specific IP address to the server. 5. The communication state control method according to claim 1, wherein the server is connected to the dedicated line via a network to which the server is connected, and the network is connected via a terminal router. A communication state control method comprising connecting to the dedicated line. 6. The communication state control method according to claim 1, wherein an amount of data to be discarded by one or both of the Internet router and the line router is equal to or less than a predetermined value. The communication state control method is characterized in that when one or both of the Internet router and the line router stop discarding data transmitted from the specific IP address to the server. 7. An Internet having an Internet router connected to the Internet, a line router connected to the Internet router, and a router control device connected to the Internet router and the line router to control the Internet router and the line router. A service provider, a server of a user connected to the line router by a dedicated line, an amount of data transmitted to the server via the Internet, and an IP address of a transmission source that transmitted the data. A traffic measuring device that measures at predetermined time intervals, and monitors a data amount measured by the traffic measuring device and, when the data amount exceeds a preset specified value, transmits a data amount equal to or more than the specified value. Specific sender A traffic monitoring device that notifies an IP address to the router control device, wherein the router control device transmits data transmitted to the server from a specific IP address notified from the traffic monitoring device to the Internet router. Alternatively, a communication state control system is characterized in that one or both of the line routers are controlled to discard them. 8. An Internet having an Internet router connected to the Internet, a line router connected to the Internet router, and a router control device connected to the Internet router and the line router to control the Internet router and the line router. A service provider, a user server connected to the line router by a dedicated line, an operation rate of a CPU of the server, a usage rate of a main memory of the CPU, a total number of requests to the server for a certain period of time, and A traffic measuring device that measures the traffic, and monitors the operation rate, the usage rate, the total number of requests, and the traffic, and when the traffic exceeds a predetermined value set in advance, the traffic value exceeds the predetermined value. Sending data at the time And a traffic monitoring device that notifies the router control device of a specific IP address of the specific transmission source, wherein the router control device has been transmitted to the server from the specific IP address notified from the traffic monitoring device. A communication state control system for controlling one or both of the Internet router and the line router to discard data. 9. The communication state control system according to claim 7, further comprising a network connected to said server, and a terminal router connecting said network and said dedicated line. system. 10. The communication state control system according to claim 7, wherein the router control device sets in advance a data amount to be discarded by one or both of the Internet router and the line router. Control to stop discarding data transmitted to the server from the specific IP address in one or both of the Internet router and the line router when the value falls below the specified value. Characteristic communication state control system. 11. A network comprising: a line router for passing traffic to a user side network; and an Internet router connected to the line router via a communication network and receiving traffic from the Internet to the user side network. The communication state control method according to the above, when a control instruction for traffic from a specific IP address is received from the user side network,
A communication state control method characterized by causing the line router and the Internet router to control traffic distribution according to control contents registered in advance in association with the user. 12. The communication state control method according to claim 11, wherein the control signal from the network on the user side is issued when the amount of traffic received by the network on the user side exceeds a predetermined threshold. A communication state control method, comprising: 13. The communication state control method according to claim 11, wherein the control instruction from the user side network is such that a system operation rate of a server installed in the user side network exceeds a predetermined threshold. A communication state control method characterized in that the communication state control method is issued at the time of communication.