JP2003298628A - Server protection network system, server, and router - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a server protection network system capable of reducing the influence of a server that has encountered DOS attack on service sufficiently. <P>SOLUTION: A server protection network system has a plurality of number of client terminals connected to network; a plurality of number of routers that forwards service request packets from the client terminals sequentially; a server that accepts and processes the service requests forwarded from the routers; source address detecting means that detects the source address of the client terminal that sent out the service request when the server encounters DOS attack from the client terminal; and a specified packet discarding request means that tracks backward a path through which the service request is sent to a router close to the client terminal of the source address and requests the router positioned along the path to drop the packets from the source address detected by the source address detecting means. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system composed of a server and a client terminal, and more particularly to a server protection network system and the like for protecting the server from unauthorized access that intentionally interferes with the processing of the server.

[0002]

2. Description of the Related Art The spread of the Internet in recent years is remarkable. A server and many client terminals are connected to the Internet, and these client terminals often request a server to perform processing and receive services. The spread of the Internet has resulted in an increase in the severity of the influence of malicious users on others.

One of them is a so-called DoS (Denial of Servic) that accesses a server that performs a specific service from a client terminal and prevents normal processing of the server.
e) Attacks and social problems. Among them,
In particular, by accessing a specific server all at once from many client terminals in different locations, the DDoS (D
The impact of istributed DoS) attacks is significant, and measures against such unauthorized access are urgently needed.

Conventionally, against such a DoS attack, a firewall having a function of detecting a DoS packet is installed in front of the server, and normal packets are sent to the server, but DoS packets are not sent to the server and are discarded. By doing so, the server's service was prevented from being adversely affected.

However, the above method has a problem in that the influence of the server can be reduced, but the influence on the network from the terminal performing the DoS attack to the server is not reduced. Particularly in the case of a DDoS attack, not only the server but also the network on the way was seriously affected.

[0006]

SUMMARY OF THE INVENTION The present invention has been made in view of the problems of the conventional system as described above.
An object of the present invention is to provide a server protection network system and the like that can sufficiently reduce the influence on not only the server but also the network when an os attack is performed.

[0007]

In order to achieve the above object, according to claim 1 of the present invention, a plurality of client terminals connected to a network and service request packets from these client terminals are sequentially transmitted. A plurality of routers for forwarding, a server for accepting and processing the service requests forwarded by these routers, and a source address of the client terminal which issued the service request when the server receives a DoS attack from the client terminal And a source address detecting means for detecting the source address so as to discard the packet from the source address detected by the source address detecting means, and traces back the route through which the service request is sent to the router near the client terminal of the source address. A specific packet discard request to the router on that route Providing server protection network system characterized by comprising a means.

According to a second aspect of the present invention, the server receives a service request from a plurality of client terminals via a network router and processes the service request. When a DoS attack detecting means for detecting that a DoS attack has been received and when a DoS attack has been detected by this DoS attack detecting means,
Source address detecting means for detecting the source address of the client terminal requesting the service, and the route to which the request for the service has been sent by designating the source address detected by the source address detecting means to the route. There is provided a server in a server protection network system, characterized in that the router comprises a specific packet discard requesting means for requesting to discard a packet from a client terminal having that address.

According to a fourth aspect of the present invention, a router for transferring a service request from a client terminal to a request destination server via a network, the server being subject to a DoS attack when the server receives the DoS attack. Has a means for transferring a request for discarding a specific packet transmitted from the source address of the client terminal which made the service request, back to the client terminal of the source address, and the server protection network system. To provide a router in.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows an example of the configuration of a server protection network system according to an embodiment of the present invention. This system 10
Is a server 11 that is subject to a DoS attack on the Internet
And routers 12a to 12f connected to this server 11 and other servers not shown and having a decryption function, and client terminals 13a to 1 connected to these routers.
3d and an authentication server 1 for authenticating the server 11 and the like
It consists of 4 and.

The above servers, routers, and client terminals are connected to the Internet, and actually there are a very large number of devices, but only the illustrated numbers are shown here for the sake of clarity. .

It is assumed that the server 11 is registered in the authentication server 14 in advance and has been subjected to a DDoS attack.
Each of the routers 12a to 12f has a function of decoding an encrypted command sent from the server 11 or the like, and by inquiring the authentication server 14, the server sending the command is an authentic server. It also has a function to determine if there is any.

The client terminals 13a to 13d are terminals that are connected to the Internet and can receive individual services from the server.

Next, the operation of this embodiment will be described based on the flow chart shown in FIG. It is assumed that, while the server 11 is providing services to each client terminal via the Internet, a large number of accesses are suddenly requested and the processing efficiency is lowered. At this time, in the server 11, in step S201 of FIG.
Detects an S attack. This is detected, for example, by the fact that the number of access requests is a predetermined number or more. Next, in step S202, the source of the request is detected by checking where the processing request comes from.

From the detected source address, the server 11 estimates the router through which the processing request has passed, and if it is estimated that it has passed through the router 12a, for example, in step S203, the router 12a receives the detected address. Send a request, for example via the SNMP protocol, to discard packets coming from (or this address and its transmitted port). Server 1 for this request
The signature 1 is attached, encrypted with a specific secret key, and sent to the router 12a.

In step S204, the router 12a decrypts the encrypted request sent from the server 11 with a public key known in advance. And router 12
In step 205, a asks the authentication server 14 whether the signature of the server 11 attached to the request is authentic.

In response to the inquiry, the authentication server 14 examines the signature sent from the router 12a and replies to the router 12a whether the signature of the server 11 is correct. If the signature of the server 11 is correct, in step S206, the router 11a responds to that effect, and the router 12a, which has received the reply that it is correct, discards the packet sent from the source address in step S207. The request is sent to the router 12c that traces the estimated route that has been sent. At this time, the signature of the server 11 is attached to this request, and the request is transmitted to the router 12c.

The router 12c which has received the request decrypts the request sent from the router 12a by the public key in step S208. In step S209,
Also in this case, the authenticity of the signature of the attached server 11 is inquired to the authentication server 14.

When the response from the authentication server 14 is correct (S210), the router 12c sends a request for discarding the packet coming from the source address to the service request in step S211 as in the router 12a. It sends the estimated route back to the router. In this case as well, the signature of the requesting server 11 is attached and sent by the SNMP protocol.

In the same manner, requests for discarding specific packets are sequentially sent to the router closest to the client terminal having the source address. In FIG. 2, if the client terminal having the source address is 13a, for example, a request for discarding the packet from the client terminal 13a comes to the router 12d closest to this.

Similarly, in the case of a DDoS attack which receives a DoS attack from a plurality of client terminals, a request for discarding a packet coming from a source address may be issued to the router by tracing back a plurality of estimated routes for which processing has been requested.

According to the above embodiment of the present invention, since the request for discarding the specific packet is encrypted and sequentially sent to the router, it is rarely read by a third party, and the request is signed by the requesting server. Is attached, and there is an advantage that the discarding of a specific packet is less likely to be disturbed by spoofing by a third party.

In the above-described embodiment of the present invention, the system using the encryption by the public key is described, but this encryption may not be performed, and for example, a cookie may be used to specify the requesting server. it can.

Further, in the above embodiment, the case where the SNMP protocol is used as a request to the routers that have been traced back one by one has been described, but the router alert option (Route
r Alert Option) and IP which is the next generation address system
Hop-by-pop option used in v6
Requests to the router may be sequentially made by (Hop-by-Hop Option).

In the above embodiment, the route for which a service request has been made is estimated, the route is traced in reverse, and the routers on that route are sequentially requested to discard specific packets. In the symmetric system, there is no problem, but in the asymmetric system, it is possible that the service request did not come due to the estimated route. In this case, the TTL of the request packet (for example, SNMP) is sequentially increased to the router, and the router to the attacker on the route is determined (this is
forward path). When the final router for the attacker is determined, the IPv6 routing header (Routing Header, RFC246
Use 0) to specify the final router as the intermediate router and throw a request packet to the server (this becomes the reverse path from the attacker). Of course, the final router may be dominated by an attacker, so the requester may choose any router on the forward path as the intermediate router. In this case, the specified intermediate
Up to the router is the target of the DoS protection mechanism.

In the above embodiment of the present invention, it is premised that the server which has been subjected to the Dos attack can detect the service request or the address of the client terminal, that is, the source address. Network Ingress Filtering (Network I
In the (ngress Filtering) technology, when a router on the way receives a service request from the client terminal, if it judges that the request is from an impossible address, the packet of that request is discarded, so a false address is added. It becomes impossible to make a service request, and the present invention becomes more effective under such a technique.

[0028]

As described above, according to the present invention, since a request for discarding a specific packet is made by going back to the router on the route which is presumed to have caused the service request which is the source of the DoS attack, the load on the entire network is reduced. Therefore, there is an effect that it is possible to sufficiently reduce the influence on the service of the server under the DoS attack.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of an embodiment of the present invention.

FIG. 2 is a diagram for explaining the operation of the embodiment of the present invention.

[Explanation of symbols]

10 ... Server protection network system, 11 ...
-Server, 12a-12f ... Router, 13a-13
d ... Client terminal, 14 ... Authentication server.

Claims (5)

[Claims] 1. A plurality of client terminals connected to a network, a plurality of routers that sequentially transfer service request packets from these client terminals, and accept and process service requests transferred by these routers. A server, source address detection means for detecting the source address of the client terminal that issued the service request when the server receives a DoS attack from the client terminal, and source address detection means for detecting the source address from the source address detection means. In order to discard the packet, a specific packet discard requesting means for requesting the router in the route by tracing back the route of the service request to the router near the client terminal of the source address is provided. Server protection network system . 2. A server which receives service requests from a plurality of client terminals via a router of a network for processing and detects a DoS attack due to a predetermined number of service requests or more. DoS attack detecting means, a source address detecting means for detecting a source address of a client terminal requesting the service when the DoS attack detecting means detects a DoS attack, and a source address detecting means for detecting the source address. A specific packet discard requesting means for requesting the router on the route to discard the packet from the client terminal having that address by tracing back the route through which the service request is sent by designating the specified source address. Server protection network system characterized by comprising Ba. 3. The server according to claim 2, wherein the request by the specific packet discarding unit is encrypted and transmitted to the router. 4. A router that transfers a service request from a client terminal to a request destination server via a network, and when the specific server is subjected to a DoS attack, the server makes the service request. A router in a server protection network system, comprising means for transferring a request for discarding a specific packet transmitted from a source address of a terminal so as to trace back to a client terminal having the source address. 5. When the router receives a request for discarding a specific packet from the server, the router sends the signature of the server attached to the discard request to an authentication server to confirm its authenticity. The router according to claim 4.