JP2004187208A - Firewall multiplexing apparatus and packet distribution method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an apparatus which utilizes a tunneling technology to freely set a processing unit to be covered by one firewall from a plurality of servers to an information group within the single server without disposing any special device on the pre-stage and multiplexes firewall processing not to increase entry capacity of a distribution table to be utilized for distribution. <P>SOLUTION: A part of an identifier of a tunnel to be used for communicating with the terminals is used for distribution to firewall processing, a value of a virtual network identifier to be used for communicating with the servers is applied to the one part of the tunnel identifier, such that the processing unit to be charged by one firewall may be freely set from the plurality of servers to the information units within the single server without disposing the special device on the pre-stage of the apparatus for multiplexing firewall processing, and that the entry capacitance of the distribution table to be utilized for distribution may not be increased. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a system for multiplexing firewall processing in packet communication between a plurality of terminals and a server and distributing each packet to each firewall in a system in which a plurality of firewalls are realized by a single device.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, in packet communication related to Web contents via a packet communication network, servers holding contents are aggregated and arranged in a data center, and operation and maintenance are collectively performed to reduce a management load and reduce a load on the data center. Physical security is strengthened by restricting entry and exit. In addition, a firewall device is installed at a stage preceding each server in order to enhance security concerning communication via a network.
[0003]
Also, in order to reduce the cost of the firewall device, a firewall multiplexing device that realizes a plurality of firewall processes by a single device has been devised.
[0004]
In a conventional firewall multiplexing apparatus, as a method of distributing a packet to each firewall processing (hereinafter, referred to as a virtual firewall), a packet from a terminal side (hereinafter, referred to as an upstream side) and a packet from a Web server (hereinafter, referred to as a downstream side) are used. ), There is a method using a virtual network identifier for identifying a virtual network. In this method, the same method can be used for the distribution table to be referred to at the time of distribution by using the same method for the upstream side and the downstream side.
[0005]
In addition, the processing unit granularity of the virtual firewall can be adjusted by grouping by the virtual network. For example, by including a plurality of Web servers in the same virtual network and forming a single group, a single virtual firewall process can be realized for each Web server belonging to the virtual network, or a single Web server can be realized. When a plurality of hosts exist in a server, for example, virtual firewall processing can be realized for each host by allocating a virtual network to each host. From such a point, the virtual network identifier is used for the virtual firewall distribution in the firewall multiplexing device.
[0006]
The above-mentioned prior art is derived from interviews with vendor products and the like, and does not have a corresponding document. In addition, the prior art relating to the firewall multiplexing apparatus and the packet distribution method was searched by PLINESS, but the same technology as the present invention could not be found. Therefore, the prior art document name cannot be described.
[0007]
[Problems to be solved by the invention]
However, in the case of a method of distributing packets to a virtual firewall by using a virtual network identifier, in order to distribute an upstream packet to a virtual firewall by using a virtual network identifier, the packet is located in front of the firewall multiplexing device, and for each packet, A virtual network entrance device is required for the network.
[0008]
In the case of the normal entrance device, the virtual network is resolved from the destination address or the input port, and the packet is transferred to the virtual network. However, in this function, adjustment of the virtual firewall processing granularity is limited.
[0009]
For example, it is impossible to implement virtual firewall processing for each host in a single Web server. This is because, when the destination address is used for the resolution of the virtual network, the destination address of the single Web server is single, the host cannot be identified, and the virtual network is not identified by the virtual network entrance device. When an input port is used for the solution, all accesses from terminals accommodated in the port are transferred to a single host, which means that a host cannot be selected.
[0010]
Further, in the solution of the virtual network by the destination address, in order to realize the virtual firewall processing of a plurality of servers having different subnets, the entry resources of the virtual network entrance device are wasted. This is because an entry is required for each subnet.
[0011]
Thus, the function of the firewall multiplexing device depends on the function of the virtual network entrance device installed at the preceding stage.
[0012]
The present invention has been made in view of the above circumstances, and an object thereof is to provide a tunneling technology for maintaining security when a terminal and a firewall multiplex device perform packet communication via a packet communication network. When packet communication is performed, the same distribution table can be used for the upstream side and the downstream side without restricting the function of the firewall multiplexing apparatus, and the virtual network entrance apparatus can be used. An object of the present invention is to provide a firewall multiplexing device and a distribution method which are not required.
[0013]
[Means for Solving the Problems]
In order to achieve the above object, according to the first and second aspects of the present invention, the firewall multiplexing apparatus of the present invention has a tunnel processing unit that realizes repacket transfer with a terminal by a tunneling technique, The distribution of upstream packets is realized by using the tunnel constructed by the tunnel processing unit. Specifically, this is realized by using a firewall identifier as a part of the tunnel identifier given to the header part of each packet used for tunnel identification. This eliminates the need to install an entrance device in front of the firewall multiplexing device, and makes it possible to distribute upstream packets to the corresponding virtual firewall.
[0014]
According to the first and third aspects of the present invention, a part of the tunnel identifier is used for distribution by using, as a firewall identifier, the same value as a virtual network identifier used for distribution of downstream packets. It is possible to make the distribution table the same on the upstream side and the downstream side.
[0015]
Further, according to the first and fourth aspects of the present invention, in addition to a tunnel processing unit that establishes a tunnel between the terminal and realizes packet transfer, an authentication processing unit that performs authentication when a tunnel is established is provided. Originally, by determining the virtual firewall processing granularity, the upstream packet is distributed to the virtual firewall at an appropriate granularity without being restricted by the virtual firewall processing granularity due to the function of the virtual network entrance device installed in the preceding stage. It becomes possible.
[0016]
Furthermore, according to the first and fifth aspects of the present invention, when a packet addressed to a different host is received by the virtual firewall, the packet forwarding tunnel is deleted, thereby assigning a virtual firewall to each host in a single Web server. In such a case where the granularity of the virtual firewall processing is fine, it is possible to switch the host accessed by a single terminal.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
[0018]
FIG. 1 is a block diagram showing the internal functions of a firewall multiplexing device 20 according to an embodiment of the present invention. The firewall unit 11 shown in FIG. 1 includes a tunnel processing unit 15, a virtual network processing unit 17, a packet distribution unit 18, A plurality of virtual firewalls 12 that are connected to each other and perform firewall processing for each Web server, for each Web server, or for each host of a single Web server are accommodated.
[0019]
The user-side interface unit 13 is an interface that connects to the tunnel processing unit 15 and transmits and receives packets in packet communication with terminals via the Internet. The server-side interface unit 14 connects to the virtual network processing unit 17. Is an interface for transmitting and receiving packets in packet communication with a Web server in a data center.
[0020]
In addition, the tunnel processing unit 15 connects to the authentication processing unit 16 and the packet distribution unit 18 in addition to the firewall unit 11 and the user-side interface unit 13, and establishes a tunnel to be used for packet communication with the terminal. A packet communication using the tunnel and a process of extracting a firewall identifier used for packet distribution from each packet from the terminal and notifying the packet distribution unit 18 are performed. At the time of tunnel establishment, a tunnel indicated by the tunnel identifier including the virtual firewall identifier notified from the authentication processing unit 16 is established.
[0021]
The authentication processing unit 16 is connected to the storage unit 19 in addition to the tunnel processing unit 15, and refers to the storage unit 19 based on an authentication process performed when the tunnel is established in the tunnel processing unit 15 and a result of the authentication process. Then, a firewall identifier is determined and an authentication process is performed.
[0022]
The virtual network processing unit 17 is connected to a packet processing unit in addition to the firewall 11 and the server-side interface unit 14, and performs VLAN communication by using a VLAN as a virtual network with a Web server, and performs packet distribution. A VLAN-ID is extracted from the packet as a virtual network identifier corresponding to a firewall identifier used in the packet distribution, and the packet distribution unit 18 is notified.
[0023]
The packet distribution unit 18 connects to the storage unit 19 in addition to the firewall unit 11, the tunnel processing unit 15, and the virtual network processing unit 17, and is transmitted from the tunnel processing unit 15 or the virtual network processing unit 17. The incoming packet is resolved into the corresponding virtual firewall 12 by referring to the storage unit 19 based on the firewall identifier sent together with the packet and sent to the corresponding virtual firewall 12 in the firewall unit. Performs processing to send packets.
[0024]
The storage unit 19 is connected to the authentication processing unit 16 and the packet distribution unit 18 and searches a distribution table to be held based on the virtual firewall information transmitted from the authentication processing unit 16. Is returned to the authentication processing unit 16, and based on the firewall identifier sent from the packet distribution unit 18, the retained distribution table is searched, and the virtual firewall information that has been hit is responded to the packet distribution unit 18.
[0025]
FIG. 2 is a diagram showing an embodiment of a network model showing the operation of the firewall multiplexing device shown in FIG. 1. The firewall multiplexing device 20 establishes a VLAN with the Web server 26 in the data center 22. Packet communication using the Internet 21 is assumed as a packet communication network, and a tunnel 29 for packet communication is established with the terminal 23 via the Internet 21 by using a tunneling technology to carry out packet communication. I do.
[0026]
The IP address of the Web server 26 is IP. α, and two hosts having different administrators, host A27 and host B28, exist in the Web server. Further, the terminal 23 is operated by the user 24 of the user X whose user name is permitted to access both the host A and the host B.
[0027]
A DNS (Domain Name Service Server) for resolving the address of the host A or the host B is connected to the Internet 21.
[0028]
Also, among the virtual firewalls 12 shown in FIG. 1, the virtual firewall 12-1 performs firewall processing for packets related to the host A, and the virtual firewall 12-2 performs firewall processing for packets related to the host B. Suppose
[0029]
FIG. 3 is an example of an authentication table held by the authentication processing unit 16 shown in FIG. 1, and the entries stored in the authentication table include a table user name, a password, and virtual firewall information. 2, entries necessary for explanation of the operation in the network model of FIG. 2 are shown. For the authentication of the host A, the user name is the user X, the password is the password A, and the virtual firewall information is the virtual firewall 12-1. And an entry in which the user name is user X, the password is password B, and the virtual firewall information is the virtual firewall 12-2 for the authentication of the host B.
[0030]
FIG. 4 is an example of the distribution table held in the storage unit 19 shown in FIG. 1. The entries stored in the distribution table are composed of firewall identifiers and virtual firewall information. 2 shows an entry necessary for explanation of the operation in the network model of No. 2 and, for distribution to the virtual firewall 12-1, an entry in which the firewall identifier is VLAN1 and the virtual firewall information is the virtual firewall 12-1; For distribution to the firewall 12-2, an entry whose firewall identifier is VLAN2 and whose virtual firewall information is the virtual firewall 12-2 is stored. As can be seen from FIG. 4, a 12-bit value that is a VLAN-ID is used as the firewall identifier.
[0031]
FIG. 5 shows an example of a tunnel identifier used by the tunnel processing unit 15 shown in FIG. 1 to identify a tunnel based on a notification from the authentication processing unit 16 when a tunnel is established. And SPI (Security Parameters Index) corresponding to a tunnel identifier when IPSec is used as a tunnel. The SPI is included in the IPSec header portion of each packet at the time of packet transfer between terminals for tunnel identification, and is composed of a 32-bit field. The firewall identifier notified from the authentication processing unit at the time of tunnel establishment is inserted into the upper 12 bits of this SIP field, and the lower 20 bits are values arbitrarily determined by the tunnel processing unit at the time of tunnel establishment.
[0032]
FIG. 6 is an example of a sequence diagram showing an operation of the network model shown in FIG. 2, and shows a sequence in which the user 24 accesses the host A27 and then accesses the host B28 on the same Web server 26. It is.
[0033]
The configuration of the firewall multiplexing device 20 is as shown in FIG. 1, and the table held by each unit holds the entries shown in FIG. 3 and FIG. In addition, IPSec is used for communication between the terminal and the firewall multiplexing device, and the SPI field of the IPSec packet header has the configuration shown in FIG. The sequence of FIG. 6 is shown below.
[0034]
The user 24 requests the terminal 23 to access the host A. The terminal 23 issues an address resolution request to the DNS 25 to resolve the address of the host A. The DNS 25 resolves the address of the host A, and the IP. is returned to the terminal 23. The terminal 23 attempts to establish an IPSec tunnel with the tunnel processing unit 15 of the firewall multiplexing device 20 in order to access the address, establishes a control signal tunnel with the tunnel processing unit 15 as Phase 1, and thereafter, The authentication request from the tunnel processing unit 15 is received. The terminal 23 requests a user name and a password from the user 24 based on the request. The user 24 is notified to the terminal 23 of the user X as the user name and the password 1 as the password. The terminal 23 notifies the tunnel processing unit 15 of the notification.
[0035]
The tunnel processing unit 15 that has received the notification sends the notification to the authentication processing unit 16 as the authentication information, and issues an authentication request. Upon receiving the authentication request, the authentication processing unit 16 refers to the authentication table shown in FIG. 3 and determines that access to the virtual firewall 12-1 is possible, and stores the virtual firewall information in the storage unit 19 to resolve the firewall identifier. Send.
[0036]
The storage unit 19 that has received the virtual firewall information refers to the distribution table shown in FIG. 4, resolves the VLAN 1 that is the firewall identifier, and responds the firewall identifier to the authentication processing unit 16. Upon receiving the firewall identifier, the authentication processing unit 16 notifies the tunnel processing unit 15 that the authentication has been completed and, at the same time, responds with the firewall identifier.
[0037]
Upon receiving the firewall identifier, the tunnel processing unit 15 establishes a packet communication tunnel 29 with the terminal 23 using the upper 12 bits of the SPI, which is the tunnel identifier, as VLAN1, which is the firewall identifier.
[0038]
The terminal 23 establishes a TCP connection with the Web server 26 using the established packet communication tunnel 29. At this time, in the case of a packet from the terminal 23, the firewall multiplexing apparatus 20 first extracts, in the tunnel processing unit 15, VLAN1 which is a firewall identifier embedded in the upper 12 bits of the SPI field included in the header of the packet. The packet distribution unit sends the firewall identifier to the packet distribution unit together with the packet. The packet distribution unit refers to the distribution table shown in FIG. 4 based on the firewall identifier and determines that the distribution destination is the virtual firewall 12-1. And sends the packet to the virtual firewall 12-1. The virtual firewall 12-1 firewall-processes the packet and sends it to the virtual network processing unit 17. 12-1 Thus, the operation is performed such that the VLAN-ID is set to VLAN 1 and the packet is transferred to the Web server 26. When the packet is the Web server 26, first, the virtual network processing unit 17 that has received the packet transmits the packet to the header of the packet. The VLAN-ID, which is included and has a value of VLAN1, is sent as a firewall identifier to the packet distribution unit 18 together with the packet, and the packet distribution unit 18 performs the same operation as described above, and transmits the packet to the virtual firewall 12-1. The virtual firewall 12-1 performs the same operation as the above operation, and sends the packet to the tunnel processing unit 15. In the tunnel processing unit 15, the packet is from the virtual firewall 12-1, and the destination is the terminal 23. As a result, the packet is transmitted to the terminal using the packet communication tunnel 29. Operable to transmit.
[0039]
When a TCP connection is established between the terminal 23 and the Web server 26, the terminal 23 sends an HTTP request to the host A27. At this time, the firewall multiplexing device 20 operates in the same manner as when receiving a packet from the terminal 23 at the time of establishing the TCP connection, and the Web server receiving the HTTP request transmits the VLAN-ID of the packet carrying the HTTP request. Is the VLAN1, and sends the HTTP request to the host A27.
[0040]
Upon receiving the HTTP request, the host A27 processes the HTTP request and returns the result to the terminal 23 as an HTTP response. At this time, the firewall multiplexing device 20 operates in the same manner as when receiving a packet from the Web server 26 at the time of establishing the TCP connection, and the terminal 23 can receive the HTTP response.
[0041]
In this way, the terminal 23 can establish communication with the host A27.
[0042]
Next, a sequence for communication switching between hosts in the same Web server, in which the user 24 requests access to the host B28 in the state of the communication end, will be described.
[0043]
The user 24 requests the terminal to access the host B28. The terminal 23 that has received the request resolves the address by using the DNS 25 in the same manner as when accessing the host A27. At this time, the address to be resolved is IP. α.
[0044]
Next, the terminal 23 receives the address IP. Since the packet communication tunnel addressed to α already exists, an HTTP request to the host B 28 is transmitted using the packet communication tunnel.
[0045]
The firewall multiplexing device 20 that has transmitted the packet operates in the same manner as when receiving the packet from the terminal 23 in the case of establishing the TCP connection when accessing the host A, but the virtual firewall 12-1 This is a request to B28, and requests the tunnel processing unit 15 to delete the packet communication tunnel 29 for the packet at the same time as discarding the request.
[0046]
The tunnel processing unit 15 that has received the request discards the packet communication tunnel 29.
[0047]
On the other hand, in the TCP on the terminal 23 side, an acknowledgment of the TCP packet used for the HTTP request is not returned, so that the transmission is attempted again. However, since there is no packet transfer tunnel 29, the packet transfer is performed again. Attempt to establish a service tunnel 29.
[0048]
At this time, the same processing as that at the time of access to the host A27 is performed. In response to the request for the user name and the password, the user 24 inputs the user X as the user name and the password 2 as the password. A packet communication tunnel 29 having a VLNA2 value in the upper 12 bits of the SPI is established.
[0049]
Using the newly established tunnel communication tunnel 29, the TCP retransmission is performed.
[0050]
Since the upper 12 bits of the SPI are transmitted through the IPSec tunnel of VLAN2, the TCP retransmitted with the HTTP request is transmitted to the host B28 through the virtual firewall 12-2 which is an appropriate virtual firewall. The response to the HTTP request is processed in the same manner as in the case of the host A 27, and can be received by the terminal 23.
[0051]
The above-described embodiment is a specific example of the present invention, and the present invention is not limited to only the above-described embodiment.
[0052]
【The invention's effect】
As described above, according to the firewall multiplexing device of the present invention, when distributing a packet from a terminal to a virtual firewall, identification information of a tunnel used for the packet communication is used, which is conventionally required. There is no need to install a virtual network entrance device in front of the firewall multiplexing device.
[0053]
In addition, only a part of the identification information of the tunnel is bound as a firewall identifier with the virtual firewall, and the firewall identifier to be bound is determined by authentication, so that the unit of firewall processing assigned to one virtual firewall is determined. From multiple servers to one host in a single server, it can be changed to any granularity.
[0054]
This makes it possible to set the granularity of the firewall processing unit of the virtual firewall, which has conventionally depended on the function of the preceding device, without depending on the function of the preceding virtual network entrance device.
[0055]
Also, by using a part of the tunnel identification information used for distributing the packet from the terminal described above to the same value as the virtual network identifier used for the server-side distribution, one table used for the distribution can be provided. This makes it possible to realize the distribution process with the same distribution table capacity as before, even if different methods are used for distributing packets from the terminal and packets from the server. Become.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a firewall multiplexing device according to an embodiment of the present invention.
FIG. 2 is a diagram showing an example of a network model showing an operation of the firewall multiplexing device according to the present invention.
FIG. 3 is a diagram illustrating an example of an authentication table held by an authentication processing unit according to the present invention.
FIG. 4 is a diagram illustrating an example of a distribution table held in a storage unit according to the present invention.
FIG. 5 is a diagram showing an example of a tunnel identifier used for identifying a tunnel in the present invention.
FIG. 6 is a sequence diagram showing the operation of one embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 11 ... Firewall part, 12-1-12-2 ... Virtual firewall, 13 ... User side interface part, 14 ... Server side interface part, 15 ... Tunnel processing part, 16 ... Authentication processing part, 17 ... Virtual network processing part, 18 ... Packet sorting unit, 19 ... Storage unit, 20 ... Firewall multiplexing device, 21 ... Internet, 22 ... Data center, 23 ... Terminal, 24 ... User, 25 ... DNS, 26 ... Web server, 27 ... Host A, 28 ... Host B, 29: Packet transfer tunnel.

Claims (5)

Through a packet communication network, a plurality of terminals that request access to the content, a server that distributes the requested content, and a terminal that is installed between the packet communication network and the server and communicates with the terminal through the packet communication network. Implements packet communication using a tunnel, implements packet communication using a virtual network with a server, and implements firewall processing for each server, or for multiple servers, or for each information group within a server A firewall multiplexing device in a content distribution system including a firewall multiplexing device,
A user-side interface unit for transmitting / receiving an IP packet from a terminal via the packet communication network;
A server-side interface unit that transmits and receives IP packets from the server, and a firewall unit that includes a plurality of virtual firewalls that perform firewall processing for each server, or for each of a plurality of servers, or for each information group in the server,
A storage unit that stores a distribution table in which header information of a packet from the terminal and the Web server and an identifier indicating a virtual firewall that processes the packet are associated with each other;
By connecting to the firewall unit, based on header information of a packet from a terminal and a server, by referring to the storage unit, a destination virtual firewall of a packet including the header information is determined, and according to the determination, a virtual firewall in the firewall unit is determined. A packet sorting unit that sends packets to the virtual firewall,
The user-side interface unit, the firewall unit, and the packet distribution unit are connected to each other, and a tunnel is established between the terminal and the terminal via the user-side interface unit. The packet is transmitted to the terminal via the tunnel, the packet from the terminal is received, and a part of the tunnel identifier included in the header information of the received packet and indicating the tunnel used to transfer the packet is included in the packet together with the packet. A tunnel processing unit to be sent to the processing unit;
A recognition processing unit that connects to the tunnel processing unit and the storage unit, performs an authentication process at the time of tunnel establishment, refers to an authentication result, and responds to the tunnel processing unit with information used as a tunnel identifier;
The server-side interface unit, the firewall unit, and the packet processing unit are connected to each other, and a virtual network associated with each virtual firewall of the firewall unit is used. The packet from the virtual firewall is transferred to the server in the corresponding virtual network, the packet from the terminal is received, and the identifier of the virtual network used for the transfer, which is included in the header information of the received packet and used for the transfer, is included in the packet together with the packet. A firewall multiplexing device comprising a virtual network processing unit for sending to a processing unit. After the authentication processing, the tunnel processing unit creates a tunnel to be used for communication with the terminal based on the authentication, determines a tunnel identifier,
The tunnel identifier is used by the tunnel processing unit to notify the packet receiving terminal of the tunnel used in the packet transfer when transmitting a packet, and is attached to the header of the received packet when receiving the packet. Used to identify the tunnel used by the packet, a part of the tunnel identifier is used as a firewall identifier associated with the virtual firewall,
2. The packet distribution method according to claim 1, wherein the packet distribution unit distributes the packet by using a firewall identifier of the received packet as a search key for distribution to the virtual firewall. In the tunnel identifier, the firewall identifier associated with the virtual firewall in the tunnel identifier is the same as the virtual identifier used to distribute the packet from the server to the virtual firewall;
3. The firewall multiplexing method according to claim 1, wherein an entry of the distribution table in the storage unit comprises a set of a virtual network identifier and a virtual firewall identifier that are the same as the firewall identifier. apparatus. The authentication unit performs authentication processing based on the authentication information sent from the tunnel processing unit, and when authentication is confirmed, resolves and stores the virtual firewall that processes packets from the authentication terminal or the authentication user. Requesting a firewall identifier associated with the virtual firewall by referring to the tunnel processing unit, and using the firewall identifier as a part of the tunnel identifier together with the authentication result. 3. The firewall multiplexing device according to claim 1, which realizes the distribution method according to claim 2. A virtual firewall performs firewall processing on a single server, or multiple servers, or hosts in a single server, and is sent from a terminal in firewall processing on a host in a single server. Based on the host information indicated in the packet, when receiving a packet requesting access to a host other than the host, instruct the tunnel processing unit to delete the tunnel used to transmit the packet, 2. The firewall multiplexing device according to claim 1, wherein said tunnel is deleted.

Images