JP2004140618A - Packet filter device and illegal access detection device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a packet filter device that can reduce illegal accesses to a PC or network equipment by not receiving, but discarding a malicious packet in case of an attack with malicious packets. <P>SOLUTION: The packet filter device is equipped with: a shift register which shifts and propagates a received communication packet; and a packet passage/discard control part which compares the communication packet with a detection pattern to find the number of consistency and inconsistency, collates the number with criteria to determine the state transition and passes or discards the packet outputted from the shift register on the basis of the determined state transition. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a packet filter device capable of detecting and removing intrusion of unauthorized access such as transmitting a malicious packet in a communication network including the Internet, and an unauthorized access detection device using the device. .
[0002]
[Prior art]
In a communication network including the Internet, communication data is transmitted in units of packets.
By transmitting a malicious packet, a network device may become unable to communicate or may illegally access a PC connected to the network, which has become a social problem.
[0003]
FIG. 7 is a configuration diagram illustrating an example of a known network system. In the figure, reference numeral 10 denotes a personal computer (PC) or a network device (hereinafter, collectively referred to as PC or device) to be attacked, in which a network interface card (hereinafter simply referred to as an interface) 11 and a central processing unit (CPU) are provided. ) 12 are provided. Reference numeral 20 denotes a malicious PC that attacks. Reference numeral 30 denotes a communication network such as the Internet or a private LAN.
[0004]
In such a configuration, when a malicious packet is transmitted from the malicious PC 20 to the device 10 via the network 30, the interface 11 of the device 10 transfers the received attack packet to the CPU 12. The CPU 12 has a function of analyzing the header content of the received attack packet, and causes a malfunction due to a specific pattern included in the malicious attack packet.
[0005]
As an attack method from the malicious PC 20, there is also a denial-of-service attack method in which the processing capacity of the CPU 12 is exceeded and the processing operation is disabled by repeatedly transmitting a large number of malicious packets. {For a Denial of Service (DoS) attack, see, for example, Patent Document 1}.
[0006]
The device 10 is, for example, a server of a company or a government office, a network device such as a gateway PC or a router (Router) equipped with a firewall, or an intrusion detection device (IDS).
[0007]
The firewall is described in, for example, Patent Document 2, the gateway is described in, for example, Patent Document 3, the router is described in, for example, Patent Documents 1 and 2, and the IDS is described in, for example, Patent Document 1.
[0008]
[Patent Document 1]
JP-A-2002-252654 (page 3)
[Patent Document 2]
JP 2000-261483 A
[Patent Document 3]
JP-A-10-271154
[0009]
[Problems to be solved by the invention]
However, the conventional configuration as described above has the following problems.
(1) If the device 10 is a server such as a company or government office, if it cannot be processed due to an attack packet, the device 10 is invaded by the server and causes a financial loss due to service interruption or leakage of important confidential data. Problems occur.
[0010]
(2) If the device 10 is a network device such as a gateway PC or a router equipped with a firewall, the load on the CPU 12 that processes the firewall software increases, and the firewall function becomes inoperable. Unauthorized access becomes possible.
[0011]
(3) When the device 10 is an IDS, if the processing load on the CPU 12 increases, the detection rate of unauthorized access decreases, and it becomes easy to overlook unauthorized intrusion. This allows unauthorized access to the internal network.
[0012]
(4) When installing an IDS for detecting intrusion, network construction is complicated and difficult, such as connecting to the same segment as a plurality of servers to be monitored by a repeater HUB or using a mirror port or TAP of a switch. In addition, there have been cases where operations involving operational danger are required, such as when the settings of a firewall must be changed in order to remotely manage an IDS.
That is, there is a problem that the scalability (extensibility) of the network is low in installation and operation of the IDS and the firewall.
[0013]
(5) When receiving a DoS attack, the service may be stopped because the attack is continued from the time when the unauthorized access is detected until the time when the countermeasures are actually taken.
[0014]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problem. When a malicious packet is attacked, the packet is not received but discarded, thereby reducing unauthorized access to a PC or a network device. It is an object of the present invention to provide a packet filter device capable of performing such operations.
[0015]
Another object of the present invention is to provide an unauthorized access detection device that can use the above-described packet filter device, reduce the processing for detecting unauthorized access of the device, and increase the unauthorized access detection rate. .
[0016]
[Means for Solving the Problems]
In order to achieve such an object, in the invention of the packet filter device of claim 1,
A shift register for shifting and propagating the received communication packet;
The communication packet is compared with a detection pattern to determine the number of matches or non-coincidences, and this is compared with a determination criterion to determine a state transition, and a packet that passes or is discarded from the shift register based on the state transition. Pass / discard control unit
It is characterized by having.
According to such a configuration, when the pattern of the attack packet is detected, the attack packet can be easily discarded. It is also possible to easily set only a packet addressed to a specific address to pass.
[0017]
In this case, the packet can be constituted by the elements as described in claim 2, and the processing for determining whether or not the information matches the specified information is performed by a hardware configuration as in claim 3. The filter device is perceived as mere hardware having no second or higher OSI layer.
Therefore, it is possible to obtain a packet filter device that does not cause a system failure due to an unauthorized access from the outside and has little influence on the network configuration.
[0018]
The unauthorized access detection device according to claim 4 is
A device connected to a network, and a packet filter device according to claim 1, 2 or 3 installed before the device, to reduce unauthorized access to the device.
[0019]
In this case, the device may be a network device such as a gateway or a router equipped with a firewall, or a device equipped with an IDS function as described in claim 6.
[0020]
The invention of claim 7 is
A server device connected to a network and having an IDS function;
4. The packet filter device according to claim 1, wherein said packet filter device is provided at a stage preceding said server device, wherein a lower layer in an OSI model of a network is assigned to said packet filter device, and an upper layer is assigned to said server device. Features.
As described above, when the packet filter device removes the unauthorized access in the lower layer, the processing traffic volume of the server device is easily reduced. Further, in the server device, since the monitoring target is limited to only unauthorized access that should be determined by the upper layer, the performance of the monitoring process can be easily improved.
[0021]
In this case, it is possible to configure the packet filter device to pass necessary packets in the communication addressed to the server device and remove the DoS attack.
[0022]
Further, the packet filter device can be configured to remove an attack related to lower layers from layer 1 to layer 4 in the OSI model.
Further, the IDS function of the server device includes a function of monitoring an unauthorized access related to an upper application and removing an attack related to an upper layer from layer 4 to layer 7 in the OSI model. be able to.
[0023]
Further, as in claim 11, a plurality of server devices connected to the network are prepared, each of the server devices is provided with a packet filter device in front thereof, and a packet function having a filter function required for each server is provided in front thereof. It is also possible to adopt a configuration realized by each of the filter devices.
[0024]
Further, as in claim 12, when detecting an unauthorized access, the server device dynamically controls the packet filter device to set a packet filter for blocking the unauthorized access, and the packet filter device determines the packet filter. A configuration in which a specific packet is discarded according to the setting of the filter may be adopted.
[0025]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a main part configuration diagram showing one embodiment of a packet filter device according to the present invention. FIG. 2 is a diagram showing an example of an unauthorized access detection device using this packet filter device.
[0026]
It should be noted that the packet filter device of the present invention is configured by hardware, and even if the device is connected to a network, system failure does not occur due to unauthorized access from the outside, etc. There is a feature that there is little.
[0027]
In the packet filter device 40 shown in FIG. 1, reference numeral 41 denotes a serial connection of a plurality of flip-flops, a shift register circuit for shifting received packet data in synchronization with an operation clock, and 42 a received register data. A pattern determination circuit 43 determines whether or not the packet data matches the detection pattern. Reference numeral 43 denotes a detection pattern setting holding circuit that sets and stores the detection pattern.
[0028]
44 is a state transition determination circuit that determines whether to pass or discard the pattern based on the result of the pattern determination circuit 42 and the determination reference data, 45 is a determination reference setting holding circuit that sets and stores the determination reference data, Reference numeral 46 denotes a packet passing / discarding control circuit for passing or discarding a packet output from the shift register circuit 41 according to the determination of the state transition determining circuit 44.
[0029]
47 is a header pattern cache for accumulating header information of received data for a certain period of time, and 48 is for discarding a packet having this header if a packet having the same header exceeding the determination standard exists in the cache 47 within a certain period of time. A cache management / discard control circuit for setting a detection pattern and a criterion in the detection pattern setting and holding circuit 43 and the criterion setting and holding circuit 45, respectively.
The packet filter device 40 including the above components is inserted immediately before the device 10 as shown in FIG.
[0030]
Note that a portion including a pattern determination circuit 42, a detection pattern setting holding circuit 43, a state transition determining circuit 44, a determination criterion setting holding circuit 45, a packet passing / discarding control circuit 46, a header pattern cache 47, and a cache management / discarding control circuit 48. Is referred to as a packet passing / discarding control unit here.
[0031]
The operation of the device configured as described above will now be described. The operation can be roughly classified into the following two cases A and B. The operations A and B are performed simultaneously.
[0032]
[Operation A]
(1) The received communication packet is transmitted to the shift register 41 and the pattern determination circuit 42.
(2) The pattern determination circuit 42 receives the detection pattern data from the detection pattern setting and holding circuit 43, and performs comparison (pattern matching) with the received communication packet. The result of whether the patterns match is passed to the state transition determination circuit 44.
[0033]
(3) The state transition determining circuit 44 counts the received result (match / mismatch) and compares the result with the criterion data of the criterion setting holding circuit 45. If certain criteria are met, the decision is made to pass or drop the packet. The decision information is transmitted to the packet passing / dropping control circuit 46.
[0034]
(4) The packet received during the operations (2) and (3) is held in the shift register 41. The shift register 41 is not composed of a buffer memory having a FIFO configuration but is composed of flip-flops connected in series, and shift-propagates in synchronization with the operation clock of the circuit. The shift register 41 has a length sufficient to hold data until the pattern is determined and the state transition determination circuit 44 outputs the determination result.
[0035]
(5) The packet passing / discarding control circuit 46 passes or discards the packet data output from the shift register 41 in accordance with the pass / discard determination output from the state transition determining circuit 44.
(6) Packets transmitted from the device 10 to be protected from an attack toward the network 30 are not subjected to packet filtering on the assumption that the device 10 is a reliable device. If a bidirectional packet filter is required, it can be realized by preparing two packet filter devices.
[0036]
[Operation B]
(1) The received communication packet is transmitted to the header pattern cache 47 together with the shift register 41 and the pattern determination circuit 42.
(2) The header pattern cache 47 has a cache memory inside, and stores header information of received data in the cache memory for a certain period of time. The cache memory includes a memory for counting the number of specific identical patterns from among the received communication packets, and when a packet of the same pattern is received, the counter value increases.
[0037]
(3) The cache management / discard control circuit 48 manages the storage time of the cache memory of the cache 47 and the like. Cache information with a count value that does not satisfy the criteria even after a certain time has elapsed is deleted from the cache memory.
(4) The cache management / discard control circuit 48 holds a setting for discarding a packet having this header when a packet having the same header exceeding the determination criterion exists in the cache memory within a predetermined time, in a detection pattern setting. It is set in the circuit 43 and the judgment reference setting holding circuit 45, respectively.
[0038]
(5) Based on the data (detection pattern and determination reference value) set by the cache management / discard control circuit 48, the state transition determination circuit 44 determines the passage / discard of the packet by the same processing as in the operation A. The information is transmitted to the packet passing / discarding control circuit 46.
(6) The packet passage / discard control circuit 46 passes or discards the packet data output from the shift register 41 in accordance with the result of the pass / discard determination output from the state transition determination circuit 44.
[0039]
(7) Packets transmitted from the device 10 to be protected from an attack toward the network 30 are not subjected to packet filtering, assuming that the device 10 is a reliable device. If a bidirectional packet filter is required, it can be realized by preparing two packet filter devices.
[0040]
According to the packet filter device as described above, the following effects can be obtained.
(1) As shown in FIG. 2, since the packet filter device 40 disposed immediately before the device 10 that is attacked from the outside via the network 30 is constituted only by hardware, a system failure occurs due to unauthorized access from the outside. Does not occur, and the configuration of the network is hardly affected.
[0041]
(2) When detecting the pattern of the attack packet, the packet filter device 40 discards the attack packet, so that the device 10 can be protected from unauthorized access. (3) For example, when the IP address (address) of the device 10 is 192.168.100.1, if the setting is made so that only the packet addressed to the address 192.168.10.0.1 is passed, the above-described operation is performed. By not receiving unnecessary packets according to A, the CPU load of the device 10 can be reduced, and the operation efficiency of the device 10 can be increased.
[0042]
(4) For example, a large amount of ping packets are sent from the IP address of the malicious attacker (???. ???. ??????? in the figure) of the device 10 (192.168.100 in the figure). .1), a large number of packets having the same header content are counted in the cache memory 47. By setting the operation B so that the device 10 is discarded when the count exceeds a certain count value, the device 10 can be protected from such a DoS attack.
[0043]
Note that the present invention is not limited to the above-described embodiment, but includes many more changes and modifications without departing from the essence thereof.
For example, in FIG. 2, when the device 10 is a network device such as a gateway PC or a router equipped with a firewall, a setting is made to receive only packets addressed to the MAC address of the network interface card 11 connected to the network 30. By doing so, the operation efficiency of the device 10 is increased, and it is possible to prevent the firewall function from becoming inoperable due to the attack packet, and it is possible to block unauthorized access to the internal network.
[0044]
Although the firewall itself has such a filtering function, if a large number of attack packets are sent, the load on the CPU that processes the firewall software may increase and the firewall function itself may stop. is there. Therefore, the use of the hardware packet filter device 40 is also effective in a firewall.
[0045]
In FIG. 2, when the device 10 is an IDS, the packet filter device 40 removes harmless packets that do not need to be detected by the IDS and packets that do not need to be detected by the security policy of the IDS in advance. The processing load on the CPU of the IDS device can be reduced.
By reducing the processing load, the IDS device increases the detection rate of unauthorized access, makes it easier to detect unauthorized intrusion, and protects the internal network.
[0046]
FIG. 3 shows another configuration example of the unauthorized access detection device. This unauthorized access detection device uses one intrusion detection device (IDS) to detect unauthorized access to each device.
[0047]
In FIG. 3, the same parts as those in FIG. 2 are denoted by the same reference numerals. In the figure, 10a is an intrusion detection device (IDS), 50 is a firewall inserted and connected to the network side immediately before the intrusion detection device 10a, 100 is a WWW server connected to the network 30 via the firewall 50, and 110 is a firewall 50 Is an FTP server connected to the network 30 via.
[0048]
The firewall 50 is software for passing or discarding only specific communication packets, and is generally installed between an external network and an internal network (such as a local LAN) to protect the internal network.
[0049]
The IDS 10 has a network interface card (NIC: Network Interface Card) 11 for receiving a signal from a network, and a central unit having a function of analyzing a received packet to determine whether or not the access is unauthorized and issuing a warning in the case of an unauthorized access. A processing device (CPU: Central Processing Unit) 12 is provided.
[0050]
Note that both the firewall 50 and the IDS 10a are software, and when the PC that operates them is inoperable, the functions of these software are stopped or deteriorated.
[0051]
In such a configuration, when a malicious packet is transmitted from the device 20 via the network 30, the intrusion detection device 10a receives all the packets from the network interface card 11, and the CPU 12 detects whether or not the access is unauthorized. When unauthorized access is detected, the network administrator takes measures against it.
[0052]
However, such an unauthorized access detection device has the following problems (1) to (3).
(1) Since the processing capacity of the IDS 10a is limited, when the network bandwidth usage rate is high (that is, when the communication traffic volume is large), detection omission that an unauthorized access is missed occurs.
[0053]
(2) If a denial of service (DoS) attack is received, the service may be stopped because the attack is continued from detection of unauthorized access until actual countermeasures are taken. .
(3) It is necessary to devise a network configuration so that all communication packets are transmitted to the IDS 10a.
[0054]
FIG. 4 is a diagram showing an embodiment of an unauthorized access detection device having a distributed IDS configuration to solve this problem. The unauthorized access detection device according to the present embodiment can reduce the processing load on the IDS and increase the detection rate of unauthorized access by dispersing the processing burdened by the IDS. In addition, it is possible to protect a device targeted for attack from a DoS attack that cannot be prevented only by the IDS.
Furthermore, it is possible to eliminate the restriction on the installation of the IDS and to enhance the network scalability.
[0055]
In FIG. 4, the same parts as those in FIG. 3 are denoted by the same reference numerals. In the figure, reference numeral 40a denotes a packet filter device equivalent to 40. 100a is a WWW server. However, unlike the WWW server in FIG. 3, the WWW server 100a has an IDS function 101 in the server. Similarly, the FTP server 110a has an IDS function 111 therein unlike the FTP server in FIG.
[0056]
The operation in such a configuration will now be described. FIG. 5 shows a comparison between the distributed IDS configuration and the configuration of the OSI reference model.
(1) It is assumed that a malicious packet is transmitted from the device 20 via the network 30 and illegally accesses the device 100a through the firewall 50.
[0057]
(2) The packet filter 40 not only allows necessary packets to pass through in the communication addressed to the device 100a, but also prevents DoS attacks such as ping bombs and SYN flood attacks (SynFlood attacks) that stop the other party's breath by transmitting a large amount of packets. Remove to protect device 100a.
This operation conceptually removes an attack related to a lower layer (layers 1 to 4) in the OSI model of FIG.
[0058]
(3) The device 100a has an IDS function and mainly monitors unauthorized access related to a higher-level application. This operation conceptually removes an attack related to an upper layer (layers 4 to 7) in the OSI model of FIG. (4) The allocation range of the packet filter device 40 and the device 100a may be overlapped, and the lower layer which requires low-speed processing although the analysis difficulty of unauthorized access is low is mainly implemented by hardware, and the analysis difficulty is low. The upper layers that need to store communication sessions for a long period of time are mainly implemented by software.
[0059]
According to such a configuration, the following effects can be obtained.
(1) The packet filter device 40 mechanically filters based on information [MAC (Media Access Control) address, IP address, packet type, port number, etc.] embedded in the packet header. Since the determination as to whether or not the information matches the specified information is implemented by hardware, 100% processing can be performed even when the network traffic volume increases.
[0060]
(2) Since the packet filter device 40 limits the packets that reach the device 100a, the processing traffic volume of the device 100a can be reduced.
(3) The packet filter device 40 can reduce the processing traffic volume of the device 100a in order to remove unauthorized access in the lower layer.
[0061]
(4) The performance of the monitoring process is improved because the device 100a limits the monitoring target to only the unauthorized access to be determined by the upper layer. As the number of monitoring targets increases, processing omissions are more likely to occur. That is, the performance of the monitoring process decreases as the number of monitoring targets increases.
[0062]
(5) Since each server device has the IDS function, such as the device 100a or the device 110a, it is not necessary to consider the arrangement of the IDS device and the securing of the network path to the IDS device unlike the related art, and the network scalability is improved. Increase.
[0063]
FIG. 6 is a configuration diagram showing another embodiment of an unauthorized access detection device having a distributed IDS configuration. This device differs from the device of FIG. 4 in that the IDS function and the packet filter device are linked.
[0064]
In FIG. 6, when an unauthorized access of an upper layer is detected by the device 100a, the device 100a dynamically controls the setting of the packet filter device 40. The operation will be described below.
(1) It is assumed that the device 20 transmits a malicious packet via the network 30 and illegally accesses the device 110a through the firewall 50.
(2) The packet filter device 40 protects the device 100a by not only passing necessary packets out of communication addressed to the device 100a but also removing DoS attacks such as SynFlood attacks.
(3) The device 100a has an IDS function, and monitors only an unauthorized access related to a higher-level application.
[0065]
(4) Upon detecting an unauthorized access, the device 100a dynamically controls the packet filter device to set a packet filter for blocking the unauthorized access. Here, the expression "control dynamically" means that the setting contents change with time. For example, there are controls such as discarding a specific protocol for a fixed time or discarding access from a specific IP address for a fixed time. (5) The packet filter device 40 discards a specific packet according to the setting from the device 100a, thereby blocking a communication session that is considered to be an unauthorized access.
[0066]
According to the invention having the configuration shown in FIG. 6, the following effects can be obtained.
(1) Since it is difficult to distinguish an unauthorized access in a lower layer from a normal access, it is difficult to provide a strict access restriction in a lower layer. On the other hand, unauthorized access at the upper layer is clearly unauthorized in many cases, so it is easy to set access restrictions to the lower layer based on the result at the upper layer, and a more reliable security effect is expected. it can.
[0067]
(2) At the same time that the IDS concentrates on the process of detecting unauthorized access, the load is distributed by clarifying the role sharing of blocking the unauthorized access by another device (filter device), and the load on each device is reduced. Is reduced, and the performance can be easily improved.
[0068]
(3) By installing a packet filter device individually for each server at the front stage, only a filter required for each server can be set. Therefore, there is no need to change the policy applied to the firewall device that is the origin of the connection to the Internet. Changing firewall settings is a daunting task, and changing them dynamically makes network maintenance more difficult. (4) Even when the installation location of the server is changed, it is not necessary to change the setting of the firewall at the relocation destination, and network scalability is improved.
[0069]
【The invention's effect】
As described above, according to the packet filter device of the present invention, the following effects can be obtained.
(1) When a pattern of an attack packet is detected, the pattern can be easily discarded. In addition, it can be easily set so that only a packet addressed to a specific address is passed.
(2) Also, a large number of ping packets and SynFlood attack packets can be easily discarded, and DoS attacks can be dealt with.
[0070]
Further, according to the unauthorized access detection device of the present invention, the following effects can be obtained.
(1) On the other hand, according to the unauthorized access detection device of the present invention, when the device attached to the packet filter device is a network device such as a gateway or a router equipped with a firewall, the interface connected to the network side By setting so as to receive only the packet addressed to the MAC address, it is possible to easily increase the operation efficiency of the device and to block unauthorized access to the internal network.
[0071]
(2) If the device is an IDS, if a harmless packet that is unnecessary to be detected by the IDS or a packet that is unnecessary to be detected by the security policy of the IDS is previously removed by a packet filter device, the processing load on the IDS device can be easily reduced. be able to. As a result, the detection rate of unauthorized access increases, and the detection of unauthorized intrusion becomes easy.
(3) The packet filter device determines whether the information embedded in the packet header matches the specified information. However, since the determination mechanism is implemented by hardware, the amount of network traffic increases. Can also be processed 100%.
[0072]
(4) In addition, since the packet filter device 40 limits the packets that reach the subsequent device, the processing traffic volume of the device can be easily reduced.
(5) Further, since the packet filter device 40 removes unauthorized access in the lower layer, the processing traffic volume of the device can be reduced.
[0073]
(6) Further, since the monitoring target can be limited to only the unauthorized access to be determined by the upper layer, the performance of the monitoring process can be easily improved.
(7) Since a plurality of server devices connected to the network each have an IDS function, there is no need to consider the arrangement of IDS devices and the securing of a network route to IDS devices as in the related art, thus facilitating network scalability. Can be increased.
[0074]
(8) Since it is difficult to distinguish an unauthorized access from a normal access in a lower layer, it is difficult to provide a strict access restriction in a lower layer. On the other hand, since unauthorized access in the upper layer is clearly unauthorized in many cases, it is easy to set the access restriction to the lower layer based on the result in the upper layer by the configuration shown in FIG. More secure security effects can be expected.
[0075]
(9) The IDS concentrates on the original process of detecting unauthorized access, and the part of blocking unauthorized access is assigned to a device different from the IDS, so that each device reduces processing load and improves performance. It becomes possible.
(10) By installing a packet filter device individually for each server at the front stage, only filters necessary for each server can be set. Therefore, there is no need to change the policy applied to the firewall device that is the origin of the Internet connection.
[0076]
(11) Even if the installation location of the server is changed, it is not necessary to change the settings of the firewall at the relocation destination, and it is easy to enhance network scalability.
[Brief description of the drawings]
FIG. 1 is a main part configuration diagram showing an embodiment of a packet filter device according to the present invention.
FIG. 2 is a diagram illustrating an example of a network system in which a packet filter device is installed.
FIG. 3 is a configuration diagram illustrating an example of an unauthorized access detection device that detects unauthorized access according to the present invention.
FIG. 4 is a configuration diagram illustrating an example of an unauthorized access detection device having a distributed IDS configuration according to the present invention.
FIG. 5 is a diagram showing a comparison between a distributed IDS configuration according to the present invention and a configuration of an OSI reference model.
FIG. 6 is a configuration diagram showing another embodiment of an unauthorized access detection device having a distributed IDS configuration.
FIG. 7 is a configuration diagram illustrating an example of a network system.
[Explanation of symbols]
10 Equipment
10a Intrusion detection device
11 Network interface card
12 CPU
20 Malicious PC
30 Network
40,40a Packet filter device
41 shift register circuit
42 Pattern Judgment Circuit
43 Detection pattern setting holding circuit
44 State transition decision circuit
45 Judgment standard setting holding circuit
46 Packet Pass / Drop Circuit
47 Header Pattern Cache
48 Cache management / discard control circuit
50 Firewall
100,100a WWW server
101,111 IDS function
110,110a FTP server

Claims (12)

A shift register for shifting and propagating the received communication packet;
The communication packet is compared with a detection pattern to determine the number of matches and non-coincidences, and the number is compared with a determination criterion to determine a state transition. A packet filter device comprising a passage / discard control unit. The packet passing / discarding control unit compares a communication packet with a detection pattern and outputs a match / mismatch result, a detection pattern setting / holding circuit for setting and holding the detection pattern, and a pattern determination circuit. A state transition determining circuit that determines whether a packet is passed or discarded by comparing a count value of a match / mismatch of a given pattern with a criterion, a criterion setting holding circuit that sets and holds the criterion, A header pattern cache for accumulating information and counting the same header pattern; and a detection pattern setting holding circuit for discarding a packet having this header when the count value of the same header pattern exceeds a determination reference within a predetermined time. The detection pattern and the judgment reference data are stored in the Setting packet filtering apparatus according to claim 1, characterized in that they are composed of cache management and disposal control circuit. 3. The method according to claim 1, wherein the data is mechanically filtered based on the information embedded in the packet, and whether or not the information matches the specified information is determined by a hardware configuration. Packet filter device. Devices connected to the network,
4. An unauthorized access, comprising: the packet filter device according to claim 1, 2 or 3, which is installed in front of the device, and configured to reduce unauthorized access to the device and a denial of service (DoS) attack. Detection device. 5. The unauthorized access detection device according to claim 4, wherein the device is a network device such as a gateway or a router equipped with a firewall, and configured to reduce unauthorized access to the network device. A device equipped with a function (IDS) for analyzing the contents of an attack packet and detecting an unauthorized access when the device is attacked by a malicious packet via a network, so that an unauthorized access detection rate is increased. The unauthorized access detection device according to claim 4, wherein the device is configured. A server device connected to the network and having a function (IDS) for analyzing the contents of the attack packet and detecting unauthorized access when attacked by a malicious packet via the network;
4. The packet filter device according to claim 1, wherein said packet filter device is provided in a stage preceding said server device, wherein a lower layer in an OSI model of a network is allocated to said packet filter device, and an upper layer is allocated to said server device. Characteristic unauthorized access detection device. The unauthorized access detection device according to claim 7, wherein the packet filter device is configured to pass a necessary packet in the communication addressed to the server device and remove a DoS attack. 8. The unauthorized access detection device according to claim 7, wherein the packet filter device is configured to remove an attack related to lower layers from layer 1 to layer 4 in an OSI model. 8. The server according to claim 7, wherein the IDS function of the server device includes a function of monitoring an unauthorized access related to an upper application and removing an attack related to an upper layer from layers 4 to 7 in an OSI model. Unauthorized access detection device. A plurality of server devices are connected to the network, and a plurality of the packet filter devices are prepared and provided in front of each server device, and a filter function required for each server is realized by each packet filter device. 8. The unauthorized access detection device according to claim 7, wherein the unauthorized access detection device is configured as described above. The server device, when detecting an unauthorized access, dynamically controls a packet filter setting for blocking the unauthorized access to the packet filter device,
12. The unauthorized access detection device according to claim 7, wherein the packet filter device is configured to discard a specific packet according to the packet filter setting.

Images