JP2003209561A - Method for strengthening security by transmission source ip address - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security strengthening method by a transmission source IP address with which an illegal address (impersonation) of a transmission source IP address is prevented. <P>SOLUTION: A filter information storing part 31 of a dial-up server system has the transmission source IP address being filter information and its action, IP address information of a capsulated IP datagram is extracted with a PPP, and before transferring the IP datagram, a filter information retrieving means 22 retrieves the propriety (communication permission or rejection) of the transmission source IP address to decide the acceptance/rejection of the transfer of the IP datagram. Thus, the illegal use (impersonation) of the transmission source IP address can be prevented to strengthen security by referring to the IP datagram of a TCPIP by the dial-up PPP and checking the filter information as to whether the transmission source IP address is legal with the transmission source IP address as a key word. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security strengthening method by a source IP address, and for example, a security strengthening method by a source IP address applied to a data link protocol for multi-protocol having an identification function of a higher protocol. Regarding

[0002]

2. Description of the Related Art Conventionally, a source IP (internet protocol)
A security enhancement method using an address is, for example, a PPP (point to point) in a dial-up server system.
TCPIP communication (Transmission Co
ntrol Protocol / Internet Protocol).

TCP by PPP (point to point protocol) operating in a conventional dial-up server system
IP communication (Transmission Control Protocol / Internet Pr
otocol) does not check the validity of the contents of the IP datagram encapsulated by PPP.
Only the data transfer means for fetching the P datagram and passing the fetched IP datagram to TCPIP is executed.

[0004]

However, in the above-mentioned conventional technique, since the IP datagram is passed to TCPIP by executing only the data transfer means, an incorrect address (spoofing) is designated as the source IP address. However, in the case of an IP address that can be routed by TCPIP, there is a problem that communication can be performed in the state of an illegal IP address.

An object of the present invention is to provide a security strengthening method by a source IP address that prevents an illegal address (spoofing) of the source IP address.

More specifically, the present invention relates to a dial-up server system for connecting to the Internet from a personal computer, a mobile terminal or the like by dial-up PPP.
It is intended to provide a security enhancement method by a source IP address that can prevent an illegal address (spoofing) of a source IP address on an IP datagram (IP data frame) encapsulated in a PP.

[0007]

In order to achieve the above object, the security enhancing method by the source IP address of the present invention stores an input / output device for controlling a line, a data processing device operated by program control, and information. In a dial-up server system including a storage device, the IP datagram of TCPIP by dial-up PPP is referred to, and the source IP address is used as a keyword to check whether the source IP address is valid and filter information. It is characterized by strengthening security.

Further, the above data processing device is composed of at least one IP datagram transfer means,
Each of the datagram transfer means has a filter information setting means for storing the filter information, a filter information searching means for searching the filter information, a source IP address setting means for performing the setting of the filter information, and a storage device when the communication is disconnected. A transmission source IP address deleting unit that clears all the obtained filter information may be provided.

Further, the storage device has a source IP address which is filter information and a filter information storage section which records the action thereof, and the filter information retrieval means of the data processing device is provided with a source IP address before transferring the IP datagram. Of the IP datagram can be determined by searching the validity of the above.

In the above record, one record includes a record number (index), a source address and an action, and is composed of a plurality of records. The filter information setting means is a source IP address filter setting means and a source IP. The filter information input from the address filter deleting means is stored in the filter information storage unit of the storage device, and the IP datagram encapsulated in PPP is input from the dial-up terminal permitted to communicate by the input / output device. Then, the filter information search means searches the filter information stored in the filter information storage unit of the storage device using the source IP address included in the IP datagram as a keyword, and searches for a communication permission / rejection action. You should return it as a result.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION Next, an embodiment of a security strengthening method by a source IP address according to the present invention will be described in detail with reference to the accompanying drawings. Referring to FIG. 1 to FIG. 7, there is shown an embodiment of a security enhancing method by a source IP address of the present invention. 1 to 4 are applied to the first embodiment, and FIGS. 5 to 7 are applied to the second embodiment.

In FIG. 1, the filter information storage unit 31
The source IP address, which is the filter information, and its action, and the IP address information of the IP datagram encapsulated by PPP is taken out, and before the transfer of the IP datagram, the filter information retrieving means 22 validates the source IP address. By searching for (communication permission / rejection), it is possible to determine whether or not the IP datagram can be transferred.

Referring to FIG. 1, the first embodiment is an IS
An input / output device 1 that controls a line such as a DN or a LAN, a data processing device 2 that operates under program control, and a storage device 3 that stores information are configured. In addition,
The IP datagram transfer means 25 and the filter information storage unit 31 are configured as one configuration and have the same processing units for the number of communication lines.

The data processing device 2 includes a filter information setting means 21, a filter information searching means 22, a source IP address setting means 23, and a source IP address deleting means 24.
It comprises IP datagram transfer means 25 including.

The storage device 3 includes a filter information storage unit 31.
Is equipped with. In the filter information storage unit 31, one record includes a record number (index), a transmission source address, and an action, and is composed of a plurality of records. It should be noted that the action designates permission or rejection of transfer of the IP datagram in which the transmission source IP address is designated, and stores a value for discriminating the end of the record.

The filter information setting means 21 uses the transmission source I
The filter information input from the P address filter setting unit 23 and the source IP address filter deleting unit 24 is stored in the filter information storage unit 31 of the storage device 3.

When an IP datagram encapsulated in PPP is input from a dial-up terminal permitted to communicate by the input / output device 1, the filter information retrieval means 22.
Is a filter information storage unit 31 of the storage device 3 with the source IP address included in the IP datagram as a keyword.
The filter information stored in is searched, and the action of permitting / denying the communication is returned as the search result.

Source IP address filter setting means 2
3 is provided in order to prohibit the communication of the IP datagram having the IP address other than the IP address (source IP address) assigned to the dialup terminal from the input / output device 1 when the connection of the dialup PPP is completed. The filter information setting means 21 sets the filter information.

The first record specifies the IP address of the dial-up terminal assigned to the source IP address and communication permission for the action, and the second record communicates the action at all source IP addresses. The rejection is specified, and the value (zero) indicating the end of the list is specified as the action in the third record. The designated filter information is input to the filter information setting means 21 and stored in the filter information storage unit 31.

The source IP address deleting means 24 is means for clearing all the filter information stored in the filter information storage section 31 when communication is cut off, and means that there is no registration in the first record (zero value). ) Is designated as an action, the filter information setting means 21 is executed, and it is recorded in the filter information storage unit 31.

The IP datagram transfer means 25 receives the IP datagram encapsulated by PPP from the dial-up terminal from the input / output device 1, extracts the IP address information from the IP datagram, and outputs the source IP address. Filter information search means 2 by specifying it as a keyword
Execute 2 to decide whether to permit or deny the communication. If the permission is permitted, the communication data transmission process is continued to the sender. If the permission is denied, the data is discarded and the next data input waits. .

(Operation) Next, an overall operation example of the present embodiment will be described in detail with reference to the system configuration block diagram of FIG. 1 and the flowcharts of FIGS. First, when the dial-up PPP connection processing request input from the input / output device 1 is completed (step A1 / YES) and communication is permitted, the transmission source IP address is stored in the filter information storage unit 31 by the filter setting processing. (Step A2).
In this process, the transmission source IP address filter setting means 24 executes the setting for permitting communication with respect to the IP address assigned to the dial-up terminal.

Source IP address filter setting means 2
The number 4 designates the IP address of the dial-up terminal assigned to the source IP address of the first record, and designates the action as permission. The source IP address of the second record specifies a value (zero) meaning all IP addresses, and specifies disapproval for the action. Three
For the second record, specify a value (zero), which means the end of the record list, in the action. The filter information designated by the transmission source IP address filter setting means 24 is input, and the filter information setting means 21 is executed (step A2).

Next, when the IP datagram encapsulated by PPP from the dial-up terminal is input from the input / output device 1 (step A3 / NO), the filter information retrieval means 22 is executed (step A4), IP
The source IP address on the datagram is taken out, and the permission / rejection of communication is searched in the order registered in the filter information using the source IP address as a keyword.

FIG. 3 shows an example of a search procedure of the filter information search means 22. Filter information retrieval means 22
Returns the action registered in the record as a search result when the search keyword exists in the filter information, and when it does not exist, the search ends,
An action in which a value (zero) indicating the meaning of no search keyword is set is returned as a search result (steps B1 to B6).

The IP datagram transfer means 25 judges the return value of the filter information retrieval means 22, and if the communication is permitted, the IP datagram transfer means is continued (step A7). When the communication is rejected, the IP datagram is discarded and the next input is awaited (step A6).

Next, when the communication is disconnected for some reason (step A3 / YES), the source IP address deleting means 24 clears the already registered filter information. The source IP address deleting means 24 is 1
Specify a value (zero) indicating the end of the record list in the action of the second record. The filter information means 21 to which the designated filter information is input is executed, and the filter information stored in the filter information storage unit 21 is cleared and stored (step A8).

Next, an example of the structure of the record will be described using the specific example shown in FIG. IP address of the terminal permitted to communicate from the dial-up terminal (source IP address)
Is “111, 222, 333, 444”. The transmission source IP address setting means 21 adds “111, 222, 333, 44 to the transmission source IP address of the first record.
4 ”is specified, and permission is specified for the action. A value (zero) that means all IP addresses is specified for the source IP address of the second record, and the action is specified as deny. In the record, specify a value (zero), which means the end of the record list, in the action.

This filter information is input and the filter information setting means 21 is executed to store the filter information in the filter information storage unit 31 of the storage device 3 (FIG. 4). In addition, in FIG. 4, as an example of a record of information stored in the filter information storage unit 31 of the storage device 3, “N
“O, source IP address, action”.

Next, when the IP datagram is transmitted from the dial-up terminal, the IP datagram transfer means 25 extracts the IP address information of the IP datagram and executes the filter information search means 22.

The filter information search means 22 searches from the first record. Source I of the IP datagram
The P address is, for example, “111, 222, 333, 44.
In the case of 4 ″, the source IP address of the first record is matched, the search is completed, and the action, permission, is returned. Since the IP datagram transfer means permits communication, the transfer means To continue.

If the source IP address of the IP datagram is, for example, "111, 111, 111, 111", it does not match the source IP address of the first record, so the second record is searched, The IP address matches the transmission source IP address of the second record searched (the designated value is a value meaning all IP addresses), the search ends, and the action, rejection, is returned. In the IP datagram transfer means 25, the communication is rejected.
The datagram is discarded and the IP datagram input waits.

Next, when the communication is cut off for some reason, the source IP address deleting means 24 clears the registration information in the first record in order to clear the already set filter information. Specify the meaning value (zero) in the action. The designated filter information is input and the filter information setting means 21 is executed.

(Effect) The first effect is that filtering can be performed by the source IP address, and as a result, unauthorized use (spoofing) of the source IP address can be prevented. The reason is that the transfer means for general IP datagram of TCPIP does not check the spoofing of the source IP address, so that communication may be possible even with an illegal IP address, and the problem can be prevented.

(Other Embodiments) Next, other embodiments of the present invention will be described in detail with reference to the drawings. 5, in addition to the configuration of the embodiment shown in FIG. 1, this embodiment includes an input device 4 and an output device 5 such as a display.
And the information stored in the filter information storage unit 31 of the storage device 3 has a source IP address. Note that “NO, source IP address, destination IP address, action” is illustrated as an example of a record of information stored in the filter information storage unit 31 of the storage device 3.

The input device 4 is an input device such as a keyboard and is a means for a maintenance person to input filter information. The output device 5 is an output device such as a display and is a means for displaying the input filter information and the like.

In addition to the source IP address and action, the destination IP address is stored in the filter information storage unit 21 of the storage device 2 as filter information. By having the destination IP address, it is possible to limit the communication destinations.

The operation of this embodiment will be described in detail with reference to the drawings. The source IP address setting means 23, the source IP address deleting means 24, and the IP datagram transfer means 25 in this embodiment shown in FIG. 5 are the same as those in the embodiment shown in FIG.

The filter information setting means 21 stores the input filter information in the filter information storage section 31 of the storage device 3. However, in this embodiment, the destination IP address is added to the items to be stored. different. In the present embodiment, the contents of the record are changed to "N
O, source IP address, destination IP address, action ”.

The filter information retrieving means 22 retrieves from the IP address information extracted from the IP datagram by using the source IP address and the destination address as keywords (step D3), similarly to the embodiment of FIG.

When the filter information is input from the input device 4, the input data is used as the input of the filter information setting means 21 (step C1), and the filter information storage unit 31 is used.
The filter information input to is stored in the filter information storage unit 31 (step C2). The input data is output to the output device 5 (step C3). Therefore, the other embodiments compare the input IP address information with the source IP address and the "destination IP address" stored in the filter information storage unit 31 (step D).
3), which is different from the above embodiment.

The above-described embodiment is an example of a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.

[0043]

As is apparent from the above description, the security enhancing method by the source IP address of the present invention is
In the dial-up server system, the IP datagram of TCPIP by dial-up PPP is referred to, and the filter information is checked whether the source IP address is valid with the source IP address as a keyword. As a result of this check, unauthorized use (spoofing) of the source IP address can be prevented and security can be enhanced.

[Brief description of drawings]

FIG. 1 is a system configuration block diagram to which an embodiment of a security enhancement method by a source IP address of the present invention is applied.

FIG. 2 is a flowchart 1 showing an operation procedure example.

FIG. 3 is a flowchart 2 showing an operation procedure example.

FIG. 4 shows a configuration example of a record.

FIG. 5 is a system configuration block diagram applied to another embodiment.

FIG. 6 is a flowchart 1 showing an operation procedure example of another embodiment.

FIG. 7 is a flowchart 2 showing an operation procedure example of another embodiment.

[Explanation of symbols]

1, 4 I / O device 2 Data processing device 3 storage devices 5 Output device 21 Filter information setting means 22 Filter information retrieval means 23 Source IP Address Setting Means 24 Source IP address deleting means 25 IP datagram transfer means 31 Filter information storage unit

Claims (6)

[Claims] 1. A dial-up server system comprising an input / output device for controlling a line, a data processing device operated by program control, and a storage device for storing information, and TCPIP IP data by dial-up PPP. The sender I is characterized in that the security is strengthened by referring to the gram and checking the filter information whether the sender IP address is valid with the sender IP address as a keyword.
Security enhancement method by P address. 2. The data processing device comprises at least one IP datagram transfer means, and each of the IP datagram transfer means has a filter information setting means for storing filter information and a filter information search for searching for filter information. A source IP address setting unit for executing setting of filter information; and a source IP address deleting unit for clearing all filter information stored in the storage device when communication is cut off. Source IP described in 1
Security enhancement method by address. 3. The storage device has a source IP address which is filter information and a filter information storage unit which records the action thereof, and the filter information search means of the data processing device has a source IP address before IP datagram transfer. 3. The security enhancement method according to the source IP address according to claim 1, wherein the validity of the address is searched to determine whether or not the IP datagram can be transferred. 4. The security according to the transmission source IP address according to claim 3, wherein one of the records includes a record number (index), a transmission source address and an action, and is composed of a plurality of records. Reinforcement method. 5. The filter information setting means stores the filter information input from the source IP address filter setting means and the source IP address filter deleting means,
The transmission source IP according to any one of claims 2 to 4, wherein the transmission source IP is stored in a filter information storage unit of the storage device.
Security enhancement method by address. 6. An IP encapsulated in PPP from a dial-up terminal permitted to communicate from the input / output device.
When a datagram is input, the filter information search means searches the filter information stored in the filter information storage unit of the storage device using the source IP address included in the IP datagram as a keyword, and permits communication. The sender IP according to any one of claims 3 to 5, characterized in that a refusal action is returned as a search result.
Security enhancement method by address.