JP2003244247A - Packet filter distribution method and distributed packet filter system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a distributed packet filter system and a packet filter distribution method for facilitating countermeasures to the increase or dynamic change of filter rules. <P>SOLUTION: The loads of a packet filter are distributed to an external filter 2 set at the connection point with an external network 1 and an internal filter 5 interposed between a trunk line 4 of the network connected to the external network 1 and a sub-net 3, and the centralized control of the external filter 2 and the external filter 5 is executed by a filter managing server 6 to make each internal filter 5 share a filter rule whose load is heavy. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to connecting a network managed by itself to an external network such as the Internet (hereinafter referred to as "external network").
Ensuring the security of the network it manages,
The present invention relates to a packet filter distribution method and a distributed packet filter system.

[0002]

2. Description of the Related Art Conventionally, it is general to provide a so-called firewall in order to ensure the security of a network. In order to realize this firewall,
There is a function called a packet filter.

This packet filter has a function of deciding whether or not to allow the communication packet to pass, based on a rule preset by the user for the contents of the communication packet. that time,
The contents of the packet used for the determination include the transmission source address, the transmission destination address, the protocol, the transmission source port number, the transmission destination port number, and the packet payload.

Since such a packet filter applies a filter rule to each communication packet, it is a relatively heavy load process for the communication system. Conventionally, since the band of connection with the external network was narrow, there was no particular problem even if these packet filters were concentrated at the connection points with the external network.

[0005]

Recently, however, the connection with an external network has a high bandwidth, the threat to the network security has increased, the filter rules have become more sophisticated, and the filter rules have been dynamically changed in accordance with a new application. Such extremely high performance of the packet filter has been demanded in view of the need for countermeasures against internal threats to security.

Here, the main objects to be solved by the present invention are as follows. A first object of the present invention is to provide a packet filter distribution method and a distributed packet filter system that can deal with an increase in filter rules and dynamic changes.

A second object of the present invention is to provide a packet filter distribution method and a distributed packet filter system that can withstand use even when the band of connection with an external network is high.

A third object of the present invention is to provide a packet filter distribution method and a distributed packet filter system which can satisfy the high performance requirements of packet filters.

A fourth object of the present invention is to provide a packet filter distribution method and a distributed packet filter system capable of coping with security threats from inside the network.

Other objects of the present invention will be apparent from the description, drawings, and particularly the description of each claim in the claims.

[0011]

In order to solve the above-mentioned problems, the method of the present invention distributes packet filters to the network in order to reduce the load on the packet filter that ensures security when connecting the network to an external network. For a heavy load filter rule, not the external filter provided at the connection point to the external network, but the internal filters in the network are in charge, and the external filter and the internal filter are individually controlled. Take the characteristic construction method.

In order to solve the above problems, the system of the present invention is provided in an external filter installed at the connection point and one or more subnets in a network connected to the external network at one or more connection points. A filter management server that centrally controls the internal filter and the external filter so that the load of the packet filter of the network is distributed to each internal filter, and the heavy load filter rule is assigned to each internal filter. The characteristic construction means that "is equipped" is taken.

More specifically, in order to solve the problem, the present invention adopts the following novel characteristic construction method or means to achieve the above object.

The first feature of the method of the present invention is that in order to reduce the load in the packet filter which secures the security when connecting the network to the external network, the packet filter is distributed to the network and the filter rule with heavy load is used. For the packet filter distribution method, the internal filter in the network is in charge of the external filter, not the external filter provided at the connection point to the external network, and the external filter and the internal filter are centrally controlled. It is in composition adoption.

A second feature of the method of the present invention is that the centralized control in the first feature of the method of the present invention is such that, for each policy, the policy satisfies the conditions for applying to the external filter and the external filter. If it can be realized in, the packet filter distribution method is configured to preferentially generate a filter rule for the external filter and control the setting.

A third feature of the method of the present invention is that the centralized control in the second feature of the method of the present invention cannot be realized by the external filter even if the conditions for applying to the external filter are satisfied. If it can be realized by a filter, the configuration adopts a packet filter distribution method that generates a filter rule for the internal filter and controls the setting.

A fourth feature of the method of the present invention is that the conditions for applying to the external filter in the second or third feature of the method of the present invention are that the policy has no state, and the policy regarding the inside / outside of the network. And satisfying all that is applied to the entire network.

A fifth feature of the method of the present invention is that when the centralized control in the second, third or fourth feature of the above-mentioned method of the present invention does not satisfy the application condition to the external filter, first, After listing the target internal filters from the policy, for each listed internal filter, if the policy can be realized by the applicable internal filter, generate a filter rule for the applicable internal filter. Then, if the policy cannot be realized by the corresponding internal filter and can be realized by the external filter, the filter rule for the external filter is generated and the setting control is performed. The adoption of the configuration of the distribution method.

A sixth feature of the method of the present invention is that the centralized control in the first, second, third, fourth or fifth feature of the method of the present invention requires a change of a filter rule from an external server. And, if the change request does not conflict with all policies, generate the filter rule for the change request,
The packet filter distribution method is configured to deal with dynamic filter rule changes by setting each filter.

The first feature of the system of the present invention is that, in a network connected to one or more connection points with an external network, an external filter installed at the connection point and each provided in one or more subnets. A filter management server that centrally controls the internal filter and the external filter so that the load of the packet filter of the network is distributed with respect to the internal filter, and each filter has a heavy load. In the adoption of the configuration of the distributed packet filter system, which comprises

A second feature of the system of the present invention is that, if the filter management server in the first feature of the system of the present invention satisfies the conditions for applying to the external filter for each policy, the policy is If it can be realized by the external filter, a filter rule for the external filter is generated and set in the external filter. On the other hand, if it cannot be realized by the internal filter, a filter rule for the internal filter is generated and the internal filter is generated. If the conditions for applying to the external filter are not satisfied, the internal filters targeted by the policy are listed, and for each internal filter listed, the internal filter policy is set. Is feasible,
While generating a filter rule for the internal filter and setting it in the internal filter, if it cannot be realized and the policy can be realized by the external filter, the filter rule for the external filter is generated and the external filter The configuration of a decentralized packet filter system is configured to store a program for setting the filter and performing the above filter setting processing.

A third feature of the system of the present invention is that the conditions applied to the external filter in the second feature of the system of the present invention are that the policy has no state and that the policy is internal / external to the network. , And is applied to the entire network, which is to satisfy the requirements of the distributed packet filter system.

A fourth feature of the system of the present invention is that when the filter management server in the first, second or third feature of the system of the present invention receives a request for filter operation from the external server, the reception If the specified request does not conflict with all policies, create a filter rule related to the request for the filter operation, set the created filter rule in each filter, and perform the above dynamic filter rule change Filter rule change This is in adopting the configuration of a distributed packet filter system that stores programs.

A fifth feature of the system of the present invention is that the network according to the first, second, third or fourth feature of the system of the present invention uses each internal subnet on the trunk line of the network via the internal filter. Is arranged, or each subnet is arranged in multiple stages with respect to the main line of the network with the internal filter interposed, in the configuration adoption of the distributed packet filter system.

A sixth feature of the system of the present invention is that the internal filter in the first, second, third, fourth or fifth feature of the system of the present invention is installed corresponding to each of the subnets. It is either adopted or permitted to be installed corresponding to a plurality of subnets.

[0026]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below as system examples and method examples with reference to the relevant drawings.

(System Example) FIG. 1 is a conceptual configuration diagram of a distributed packet filter system which is an embodiment of the present invention. In the figure, 1 is an external network, 2 is an external filter, 3 is a subnet, 4 is a backbone (main line), 5 is an internal filter, 6 is a filter management server, and 7 is an external server (authentication server or the like).

The present system example is based on ensuring the scalability with respect to the load by distributing the load of each filter by distributing the filter to each part constituting the network. This is an example.

A filter provided at a connection point to the external network 1 is an external filter 2, and each subnet 3 is directly provided on a backbone 4 which is a trunk line inside the network or is connected via another subnet 3. Then, a filter called an internal filter 5 is provided at the connection point of the subnet 3. Although the internal filter 5 is mainly provided for each subnet 3 in FIG. 1, it is not excluded to handle a plurality of subnets 3 by one internal filter.

By the way, the rules of each filter are centrally managed by the filter management server 6. The filter management server 6 converts a policy (network policy) described by a network administrator into a filter rule for each of the filters 2 and 5, and sets the filter rule in each of the filters 2 and 5.

When the filter rule is dynamically changed, the request is accepted from the external server 7 such as the authentication server, and it is confirmed that the policy set by the network administrator is not violated. Change the setting of 5. Examples of the server (external server 7) whose filter rule is to be dynamically changed include an authentication server that works with IPsec, a SIP proxy of VoIP, and an intrusion detection system (IDS).

A packet filter distribution program is stored in the filter management server 6 so that the filter management server 6 sets the external filter 2 and the internal filter 5 according to the security policy.

2 to 4 show the operation of the filter management server 6 by executing the packet filter distribution program stored in the filter management server 6, and FIG. 2 (a) shows the filter setting. The operation, (b), shows the dynamic filter rule changing operation in pseudo code, and FIGS. 3 and 4 show (a) and (b) of FIG. 2 as a flow chart, respectively. It is a thing.

As shown in FIGS. 2 (a) and 3, the filter setting is such that the main program has no state, the policy is internal / external network policy, and is applied to the entire network. If the conditions applied to the filter are cleared (Yes in ST1)
s), application to the external filter 2 (ST2), and if not, the process proceeds to each subroutine of application to the internal filter 5 (ST3).

If the policy can be realized by the external filter 2 (Yes in ST2-1), the application subroutine (ST2) to the external filter 2 generates a filter rule for the external filter 2 to generate the external filter 2. Set to (ST2
-2, ST2-3), otherwise (N in ST2-1)
o), if the policy can be realized by the internal filter 5 (S
Yes in T2-4), a filter rule for the internal filter 5 is generated and set in the internal filter 5 (ST2-5, S).
T2-6).

The sub-routine (ST3) to be applied to the internal filter 5 lists the internal filter 5 to be targeted from the policy (ST3-1), and for each filter in the list (ST3-2), If the policy can be realized by the internal filter 5 (Yes in ST3-21), the filter rule for the internal filter 5 is generated and set in it (ST3-22, ST3-23), and otherwise (ST3).
If No at -21) and the policy can be realized by the external filter 2 (Yes at ST3-24), a filter rule for the external filter 2 is generated and set to it (ST3-25,
ST3-26).

On the other hand, the dynamic filter rule change is started when a filter operation request is received from the external server 7 (ST11) as shown in FIGS. 2B and 4, and the request conflicts with all policies. If not (Yes in ST12
s), a filter rule is generated (ST13), and the rule is set in each filter (ST14).

(Method Example) This method example is applied to the above system example. A description will be given based on the above description.

By the programs of FIG. 2 and the flows of FIGS. 3 and 4, static filter rules mainly applied to the entire network are set in the external filter 2, but the number of such filter rules is relatively small. Since the update frequency is low, the load on the filter is low. On the contrary,
The filter rule for each subnet 3 that tends to increase in the number of rules, the filter rule with a high update frequency, and the dynamic filter rule with a state have a large load on the filter, but these are internal filters 5 that pass a small amount of traffic. Handles.

In this way, the load of the filter is distributed by distributing the filter to each part constituting the network, and scalability is ensured against an increase in the load.

The system example and the method example, which are the embodiments of the present invention, have been described above. However, the present invention can be appropriately modified and implemented within a range that achieves the objects of the present invention and the following effects.

[0042]

According to the present invention, the load of the filter can be distributed by distributing the filter in each part constituting the network, and scalability with respect to the load can be ensured. Therefore, as a means for ensuring network security, A packet filter can be used regardless of the scale, and it has an excellent effect that a high performance requirement for the packet filter can be satisfied, such as a high bandwidth connection with an external network and an advanced filter rule.

[Brief description of drawings]

FIG. 1 is a conceptual configuration diagram of a distributed packet filter system according to an embodiment of the present invention.

FIG. 2 is also a pseudo code showing the operation by the filter management server, in which (a) is a filter setting operation,
(B) relates to a dynamic filter rule changing operation.

FIG. 3 is a flowchart of the filter setting operation of FIG.

FIG. 4 is a flowchart of the dynamic filter rule changing operation of FIG.

[Explanation of symbols]

1 ... External network 2 ... External filter 3 ... Subnet 4 ... Backbone (main line) 5 ... Internal filter 6 ... Filter management server 7 ... External server (authentication server, etc.)

Claims (12)

[Claims] 1. To reduce the load on a packet filter that ensures security when connecting a network to an external network, a packet filter is distributed over the network and a heavy load filter rule is used.
A packet filter distribution method, characterized in that each internal filter in the network is assigned to the internal filter instead of the external filter provided at the connection point to the external network, and the external filter and the internal filter are centrally controlled. 2. The centralized control, for each policy, preferentially generates a filter rule for the external filter if the policy satisfies the conditions for applying to the external filter and can be realized by the external filter. The packet filter distribution method according to claim 1, further comprising: 3. The centralized control cannot be realized by the external filter even if the application condition for the external filter is satisfied, and if it can be realized by the internal filter, a filter rule is generated and set for the internal filter. It controls, The packet filter distribution method of Claim 2 characterized by the above-mentioned. 4. The conditions to be applied to the external filter are that the policy has no state, inside the network /
The packet filter distribution method according to claim 2 or 3, characterized in that the policy is related to the outside and that it is applied to the entire network. 5. The centralized control, when the condition for applying to the external filter is not satisfied, first, lists the internal filters to be targeted from the policy, and then, for each internal filter listed. Then, if the policy can be realized by the internal filter,
Generates a filter rule for the applicable internal filter and performs setting control. If the policy cannot be realized by the applicable internal filter and can be realized by an external filter, a filter rule for the external filter is generated. The setting control is performed by using the packet filter distribution method according to item 2, 3, or 4. 6. The centralized control is such that, when there is a filter rule change request from an external server, the filter rule relating to the change request is generated and the filter rule is generated for each filter only when the change request does not conflict with all policies. The packet filter distribution method according to claim 1, 2, 3, 4, or 5, wherein a dynamic change of a filter rule is dealt with by setting. 7. In a network connected to an external network at one or more connection points, an external filter installed at the connection point and internal filters provided at one or more subnets are provided. A filter management server for centrally controlling the internal filter and the external filter so that the load of the network packet filter is distributed and the heavy load filter rule is assigned to each internal filter. Decentralized packet filter system. 8. The filter management server generates a filter rule for an external filter, if the policy can be realized by the external filter, if the application condition for the external filter is satisfied for each policy. On the other hand, if the internal filter cannot be realized while being set as an external filter, the filter rule for the internal filter is generated and set in the internal filter, and the application condition to the external filter is not satisfied, List the internal filters to be targeted from the policy, and for each internal filter listed, if the internal filter can realize the policy, generate a filter rule for the internal filter. While setting it in the internal filter, the policy can be realized in the external filter that cannot be realized. If, distributed packet filtering system of claim 7 which produces a filter rule for external filter, set to the external filter, for storing a program for performing the above filter setting process, it is characterized. 9. The conditions to be applied to the external filter are that the policy has no state, inside the network /
The decentralized packet filter system according to claim 8, wherein both the policy regarding the outside and the fact that the policy is applied to the entire network are satisfied. 10. When the filter management server receives a filter operation request from the external server, the filter management server generates a filter rule related to the filter operation request if the received request is consistent with all policies. The distributed packet filter according to claim 7, 8 or 9, characterized in that the generated filter rule is set in each filter, and a filter rule changing program for dynamically changing the filter rule is stored. system. 11. The network arranges each subnet by interposing the internal filter on the trunk line of the network, or arranges each subnet by interposing the internal filter in multiple stages with respect to the trunk line of the network. The distributed packet filter system according to claim 7, 8, 9 or 10, characterized in that 12. The internal filter is either installed corresponding to each of the subnets or allowed to be installed corresponding to a plurality of subnets. The distributed packet filter system according to claim 7, 8, 9, 10 or 11.