JP2004248198A - Dos attack prevention method and apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a DoS attack prevention method and apparatus in which a packet processor to be protected can continuously work without incurring system down even when the packet processor is applied with DoS attack of sending a large quantity of packets within a short time not to be normally functioned. <P>SOLUTION: When packet storage capacitance of a memory for temporarily storing packets to be processed by the packet processor to be protected is less than a predetermined threshold set not to exceed a throughput limit of the packet processor, all received packets are stored in the memory but when the quantity of stored packets is equal with or more than the predetermined threshold, the received packets are discarded on the basis of predetermined thinning conditions corresponding to the throughput, and only the received packets which are not discarded, are stored in the memory. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a DoS attack protection method and apparatus, and more particularly to a DoS attack protection method and apparatus that transmits a large number of packets in a short time so as to prevent a packet processing apparatus from functioning normally.
[0002]
[Prior art]
Conventionally, firewalls have been used to protect their own devices from unauthorized access from the outside. A firewall is a device installed at the boundary between a public network such as the Internet and its own network. (1) A source IP address or a type of a protocol belonging to a transport layer (in the case of an intruding packet) (TCP, UDP, etc.) or a port number as a key to prevent the set from passing (or pass only the set) or (2) NAT (Network Address Translator) There is known a device that does not show the IP address of the device to the outside.
[0003]
By installing a firewall as described in (1) above, it is possible to pass only the packets required by the user by designating the protocol and port number. Also, by specifying the IP address of a device determined to be malicious, access from a device having that IP address is rejected, or conversely, by specifying only the IP address of a device permitted to access, the identity is unknown. Your device can be protected from access by others.
[0004]
Further, in the firewall described in the above item (2), the IP address of the device to be attacked can be concealed by the NAT function, so that the device itself can be protected from unauthorized access.
As an example of the above-mentioned firewall, there is an intrusion detection device (for example, see Patent Literature 1) in which detection of unauthorized intrusion is determined from a packet, and if there is unauthorized intrusion, measures are taken to prevent unauthorized intrusion.
[0005]
In addition, an intrusion detection device (for example, see Patent Reference 2).
Furthermore, there is also a network monitoring system that detects unauthorized access from an external network to an in-house information network and enables detection of the source of an unauthorized packet (for example, see Patent Document 3).
[0006]
[Patent Document 1]
JP-A-2002-73433 (abstract, FIG. 4)
[0007]
[Patent Document 2]
JP-A-2002-252654 (abstract, FIG. 7)
[0008]
[Patent Document 3]
JP-A-2000-261483 (abstract, FIG. 1)
[0009]
[Problems to be solved by the invention]
In the above-described conventional firewall, a function of filtering using a type of a protocol (TCP, UDP, or the like) or a port number belonging to an IP address or a transport layer as a key, or a function of detecting or detecting an unauthorized access is an attack pattern of an unauthorized access. This is a coping-therapeutic defense that supposes. Therefore, in the future, when a new attack pattern appears, it is expected that the defense will not be able to be completed, and the response may be delayed.
[0010]
Concealing its own IP address using the NAT function is very effective because it can eliminate an attack itself, but is one of the devices that constitute a system that realizes Mobile IP (Mobile IP), for example. The NAT function cannot be used in a device such as a home agent which needs to be accessed from the outside to realize the original function.
[0011]
A general home agent accumulates position information periodically sent from a mobile terminal called a mobile node, and stores a packet sent to an original position of the mobile node (called a home address). And has a function to transfer the data to the current mobile node position (called a care-of address (Care of Address)) so that it can be received.
[0012]
As described above, in the home agent, receiving position information from the mobile node, that is, receiving a packet transmitted to itself from the outside is indispensable for satisfying the function. Need to be considered enough.
[0013]
When a firewall is used for the home agent, on the other hand, the following problems are conceivable with regard to guarding by designating an IP address.
(1) As a home agent, it is necessary to guarantee that a packet from a device to be serviced can be received. For example, when a carrier implements a mobile IP service, an IP address registered as a customer is Must be received until it turns out to be a malicious user. For this reason, when the customer is determined to be a malicious user by sending an abnormal packet, the system may already be down.
[0014]
(2) Even if the IP address of a good customer is used, an unnecessary packet may be transmitted in addition to a necessary packet due to a malfunction or an incorrect setting of the device. Blocking all packets by specifying an address can be overprotective.
[0015]
(3) Further, when the above-mentioned DDoS attack in which a plurality of devices collide and sends a large amount of unnecessary packets is performed, there is a possibility that the defense method using the IP address as a key may not be sufficient.
On the other hand, for the home agent, the function of filtering using the IP address, the type of the protocol belonging to the transport layer (TCP, UDP, etc.) and the port number in the firewall described above as a key is effective to some extent. Can protect against the same level of attack on servers.
[0016]
However, since the home agent needs to receive at least a packet for which the mobile node reports location information, such a packet cannot be guarded by designating a protocol or a port number. Therefore, there is a high possibility that unauthorized access is performed using a protocol or port number that is not guarded.
[0017]
That is, the home agent has a particularly weak defense against an attack called a DoS (Denial of Service) attack that sends a certain amount of packets in large quantities to prevent the target device from functioning properly. I can say.
Considering that the purpose of the attacker who attacks the DoS attack is to bring down the system of the device to be attacked, on the contrary, prevention of the system down is the most important issue for the victim.
[0018]
Therefore, the present invention provides that even if a packet processing device receives a DoS attack that sends a large number of packets in a short time so that the packet processing device does not function properly, the packet processing device to be protected continues to operate without causing a system down. It is an object of the present invention to provide a DoS attack defense method and apparatus capable of performing the following.
[0019]
[Means for Solving the Problems]
In order to achieve the above object, in the DoS attack prevention method according to the present invention, a packet storage amount of a memory for temporarily storing packets to be processed by a packet processing device to be protected is reduced by a processing amount of the packet processing device. A first step of monitoring whether or not the capacity is less than a predetermined threshold set so as not to exceed the limit of the capacity; and if the packet storage amount is less than the predetermined threshold, all received packets are stored in the memory. A second step of storing, and when the packet storage amount is equal to or more than the predetermined threshold, the received packet is discarded based on a predetermined thinning condition corresponding to the processing capacity, and the received packet not discarded is discarded. And a third step of storing only the data in the memory.
[0020]
That is, a predetermined threshold value is set for the amount of packet storage in the memory for temporarily storing packets to be processed by the packet processing device to be protected so as not to exceed the processing capacity limit of the packet processing device. Thus, the first step monitors whether or not the packet storage amount is less than the predetermined threshold. As a result of the monitoring in the first step, when the packet storage amount is less than the predetermined threshold, all the received packets are stored in the memory by the second step, and when the packet storage amount is equal to or more than the predetermined threshold value. In some cases, in the third step, the received packet is discarded based on a predetermined thinning condition, and only the received packet that is not discarded is stored in the memory.
[0021]
The state in which the amount of stored packets in the memory is equal to or larger than the predetermined threshold means that the processing capability of the packet processing device to be protected is close to its limit, that is, the danger of a system down is increasing. In such a situation, based on a predetermined thinning condition, only a part of the packets corresponding to the processing capacity is stored in the memory, so that the processing capacity of the packet processing device to be protected is limited. It is possible to prevent reception of a packet with an excessive amount.
[0022]
Therefore, not only intentional DoS attacks from malicious users, but also large inflows of packets (frequency abnormalities) that may have substantially the same effect as DoS attacks due to malfunctions or misconfigurations are received. Thus, it is possible to avoid a system down of the packet processing device.
[0023]
Also, in the above DoS attack prevention method, the packet storage amount of all source addresses of the packet in the memory for temporarily storing the packet to be processed by the packet processing device to be protected is determined by the processing amount of the packet processing device. A first step of monitoring whether or not the packet storage amount for each source address is less than a predetermined threshold value so as not to exceed the limit of the capability; A second step of storing all the received packets from the source address corresponding to the packet storage amount in the memory, and a receiving packet from the source address corresponding to the packet storage amount that is equal to or greater than the predetermined threshold. A third step of discarding based on a predetermined thinning condition corresponding to the processing capability and storing only the received packet that has not been discarded in the memory. .
[0024]
That is, the packet storage amount of the memory for temporarily storing the packet to be processed by the packet processing device to be protected is stored in the memory for each source address so as not to exceed the processing capacity limit of the packet processing device. By setting a predetermined threshold value for the amount, it is monitored in the first step whether or not the packet storage amount of all the source addresses of the packet is less than the predetermined threshold value.
[0025]
As a result of the monitoring in the first step, all received packets from the source address whose packet storage amount is less than the predetermined threshold are stored in the memory in the second step, and the packet storage amount is Packets received from the source address that are equal to or greater than the predetermined threshold are discarded based on the predetermined thinning conditions in the third step, and only the received packets not discarded are stored in the memory.
[0026]
In this way, if the target of the thinning processing is limited to the received packets from the source address where the packet storage amount is equal to or more than the predetermined threshold, the normal received packets can be avoided while the system down of the packet processing device is avoided. Can be reduced.
[0027]
Further, the above-mentioned predetermined thinning condition may be a condition in which a ratio of the amount of packets to be stored to the amount of received packets is determined according to the processing capability of the packet processing device.
In other words, the predetermined thinning condition is such that the ratio of the amount of received packets to the amount of packets to be stored is, for example, 5: 1.
[0028]
The ratio can be obtained by calculating the processing capacity of the packet processing device as A (packets / second), the maximum amount of received packets as B (packets / second), and the amount of packets stored in the memory as B '(packets / second). In this case, B ′ <A may be determined.
For example, when only one received packet is stored in the memory for C packets, since B / C = B ', a value that satisfies B / C <A and C> B / A may be set.
[0029]
As a result, the received packets are thinned out at a fixed rate, and only the amount of packets corresponding to the processing capacity of the packet processing device to be protected is stored in the memory, so that the system down can be avoided.
Further, the above-mentioned predetermined thinning-out condition may be such that the amount of packets permitted to be stored in the memory at one time and the time interval at which the storage is permitted are determined in accordance with the processing capacity of the packet processing device. .
[0030]
That is, the predetermined thinning-out condition is that the amount of packets permitted to be stored in the memory at one time is set to, for example, one, and the time interval at which the storage is permitted is set to, for example, 100 msec.
In this case, assuming that the time interval is D (seconds) and the amount of packets permitted at one time is E (pieces), the amount of packets stored in the memory is B '= E / D, so that E / D <A. Such a value may be set.
[0031]
As a result, the received packets are thinned out at regular time intervals, and only the amount of packets corresponding to the processing capacity of the packet processing device to be protected is stored in the memory, so that a system down can be avoided.
Further, the above-mentioned predetermined thinning-out condition may be such that the accumulation of only the packets protected by the predetermined security function is permitted.
[0032]
That is, the predetermined thinning condition is set so as to permit the accumulation of only packets protected by a predetermined security function such as IPSec.
Thereby, the received packets are thinned out based on the condition of whether or not the packets are protected by the predetermined security function, and only the amount of packets corresponding to the processing capacity of the packet processing device to be protected is stored in the memory. , System down can be avoided.
[0033]
Further, the predetermined thinning condition may be a condition that all the received packets are discarded.
That is, in the third step, all received packets from the source address corresponding to the packet storage amount equal to or larger than the threshold are discarded.
[0034]
As described above, a system down can be avoided by a relatively simple thinning-out condition of discarding all packets from a source address subjected to a DoS attack.
In order to achieve the above object, a DoS attack prevention apparatus according to the present invention includes a packet storage unit for temporarily storing packets to be processed by a packet processing apparatus to be protected in a memory, and a packet storage amount in the memory. An accumulation amount monitoring unit that monitors whether or not the packet accumulation amount is less than a predetermined threshold value set so as not to exceed the processing capacity limit of the packet processing device; and when the packet accumulation amount is less than the predetermined threshold value. It is determined that all received packets are stored in the memory, and when the packet storage amount is equal to or more than the predetermined threshold, the received packets are discarded based on a predetermined thinning condition corresponding to the processing capability. And a packet determining unit that determines to store only the received packet that has not been discarded in the memory.
[0035]
FIG. 1 is a diagram for explaining the principle of a DoS attack defense device according to the present invention. A packet storage unit 10 arranged as shown in FIG. The unit 20 and the packet determination unit 30 constitute a DoS attack defense device according to the present invention.
[0036]
That is, the packet storage unit 10 temporarily stores the packet to be processed by the packet processing device to be protected (the packet processing unit 40 in the example of FIG. 1) in a memory (not shown). The storage amount monitoring unit 20 monitors by comparing the packet storage amount stored in the memory by the packet storage unit 10 with a predetermined threshold set so as not to exceed the processing capacity limit of the packet processing device.
[0037]
The packet determination unit 30 determines whether the received packet should be stored in the memory or discarded. When the packet storage amount is less than the predetermined threshold, all the received packets are stored in the memory. And if the packet storage amount is equal to or greater than the predetermined threshold, the received packet is discarded based on a predetermined thinning condition corresponding to the processing capacity, and the received packet not discarded is discarded. It is determined that only the data is stored in the memory.
[0038]
Accordingly, in a state where the packet storage amount is equal to or more than the predetermined threshold, only a part of packets corresponding to the amount corresponding to the processing capacity is stored in the memory based on a predetermined thinning condition. It is possible to prevent reception of a packet of an amount exceeding the processing capacity limit of the packet processing device to be protected.
[0039]
Therefore, not only intentional DoS attacks from malicious users, but also large inflows of packets (frequency abnormalities) that may have substantially the same effect as DoS attacks due to malfunctions or misconfigurations are received. Thus, it is possible to avoid a system down of the packet processing device.
[0040]
Further, the DoS attack prevention apparatus includes a packet storage unit that temporarily stores a packet to be processed by a packet processing apparatus to be protected in a memory, and a packet storage amount of all source addresses of the packet in the memory. A storage amount monitoring unit that monitors whether the packet storage amount of each source address is less than a predetermined threshold value so as not to exceed the limit of the processing capacity of the packet processing device; and the predetermined threshold value. It is determined that all received packets from the source address corresponding to the packet storage amount that is less than the storage amount are stored in the memory, and the transmission source corresponding to the packet storage amount that is equal to or greater than the predetermined threshold value is determined. A packet received from an address is discarded based on a predetermined thinning condition corresponding to the processing capability, and only the received packet not discarded is stored in the memory. And determining the packet determination unit to be provided with a.
[0041]
Further, the above-mentioned predetermined thinning-out condition may be such that the ratio of the amount of packets to be stored to the amount of received packets is determined according to the processing capacity of the packet processing apparatus, and the storage in the memory is permitted at one time. The packet amount and the time interval at which the accumulation is permitted may be determined according to the processing capability of the packet processing device.
[0042]
Further, the above-mentioned predetermined thinning-out condition may be such that the accumulation of only the packets protected by the predetermined security function is permitted.
The predetermined thinning condition may be a condition that all the received packets are discarded.
[0043]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 2 shows an embodiment in which the DoS attack defense method and apparatus according to the present invention are applied to a home agent.
A home agent 100 shown in FIG. 1 includes a network interface unit 200 composed of a NIC (Network Interface Card) such as a LAN card, a main body 300 composed of a normal server or a personal computer, and a PCI bus connecting these. 400.
[0044]
The network interface unit 200 includes a packet receiving unit 50 for receiving a packet from the network and a packet transmitting unit 60 for transmitting a packet to the network. A packet determination unit 30 that determines packet handling and a packet storage unit 10 that has a buffering function are connected.
[0045]
The packet determination unit 30 is connected to a CAM (content addressable memory) 70 that is a searchable memory that records how to handle packets for each source IP address (mobile node). The CAM 70 also records mobile node location information called a binding cache.
[0046]
The packet storage unit 10 is connected to a memory 80 as an actual storage destination of the received packet.
Further, between the packet storage unit 10 and the packet determination unit 30, a storage amount monitoring unit 20 is connected.
[0047]
On the other hand, the main body 300 is provided with a packet processing unit 40 for processing a received packet.
In operation, the packet receiving unit 50 controls a physical interface (not shown), receives a packet transmitted from a mobile node (not shown), and sends the packet to the packet determining unit 30. The packet determination unit 30 checks the header of the received packet, extracts information such as a source address and a destination address, and searches the CAM 70 based on the information.
[0048]
The packet determination unit 30 determines, based on the search result of the CAM 70, whether to discard the received packet, pass it to the packet processing unit 40, process it, or forward it. With respect to the packet determined to be passed and processed, a thinning process is performed on the basis of the status display signal I given from the accumulation amount monitoring unit 20 to avoid a system down.
[0049]
The details of the thinning process will be described later as embodiments (1) to (6) of the packet determination unit 30.
The packet storage unit 10 divides the received packet from the packet determination unit 30 into a packet to be processed by the packet processing unit 40 of the main body 300 and a packet to be transferred as it is, accumulate.
[0050]
The accumulation amount monitoring unit 20 compares the packet accumulation amount accumulated in the memory 80 by the packet accumulation unit 10 with a predetermined threshold value, and determines a state indication signal I indicating whether the packet accumulation amount is less than the predetermined threshold value by packet judgment. To the part 30.
The packet processing unit 40 sequentially processes the packets stored in the memory 80 by the packet storage unit 10 and provides a transmission packet to the packet transmission unit 60 as needed.
[0051]
The packet transmission unit 60 multiplexes the transmission packet supplied from the packet processing unit 40 and the packet supplied from the packet storage unit 10 for transfer, and controls and transmits a physical interface (not shown).
In the present embodiment, the home agent 100 is protected from a DoS attack in which the packet processing unit 40 sends a large number of packets to be processed, and a system down is avoided. For this reason, according to the processing capacity of the packet processing unit 40, any one or two of the six embodiments of the packet determination unit 30 (1) to (6) described below with reference to FIGS. The thinning process of the received packet is performed by one or more combinations.
[0052]
The “received packet” referred to in the following description of each embodiment (1) to (6) of the packet determination unit 30 means a received packet to be processed by the packet processing unit 40 unless otherwise specified. Shall be. That is, in the operation of the packet determination unit 30 described with reference to FIG. 2, the reception packet determined to be discarded or transferred by referring to the CAM 70 based on the information of the header of the reception packet is described below. It is assumed that no packet is included.
[0053]
In the embodiments (1) to (6) of the packet determination unit 30 described below, in the embodiments (1) to (3), the accumulation amount monitoring unit 20 determines whether the packet processing unit 40 Is an embodiment in which the amount of packets stored in the memory 80 as received packets to be processed is monitored.
[0054]
In the embodiments (4) to (6), the storage amount monitoring unit 20 monitors the storage amount of the packet stored in the memory 80 as the received packet to be processed by the packet processing unit 40 for each source address of the packet. This is an embodiment in the case of performing the above.
Packet judgment unit 30 Example of (1) : Figure 3
FIG. 3 shows a case where the number of received packets is limited, as an embodiment (1) of the packet determination unit 30. The packet determination unit 30 includes a passage control unit 31 and a passage number management unit 32 as illustrated.
[0055]
The number-of-passes management unit 32 receives the status display signal I from the storage amount monitoring unit 20.₁Is always given. This status indication signal I₁Indicates whether the amount of packets stored in the memory 80 by the packet storage unit 10 is less than a predetermined threshold.
The number-of-passes management unit 32 outputs the status display signal I₁As a result, the state display signal I indicates that the packet storage amount has returned to below the predetermined threshold value again from the point in time when it is detected that the packet storage amount has increased and exceeded the predetermined threshold value.₁Until is indicated, the reception packet is thinned by giving an instruction to the passage control unit 31 so as to permit the passage of the reception packet at a fixed ratio (for example, 5: 1) as described above.
[0056]
That is, when thinning out the received packets, the passage number management unit 32 provides the passage control unit 31 with signals of non-permission and permission at a ratio of, for example, 5: 1 with respect to the count C of the received packets. The passage control unit 31 allows the received packet to pass through the packet storage unit 10 only when receiving the permission signal, and discards the received packet while receiving the non-permission signal.
[0057]
The ratio of permitting the passage of the received packet (5: 1 in the above example) may be set to a fixed value. If the processing capacity of the packet processing unit 40 fluctuates, it may be changed according to the processing capacity. You may make it changeable.
Similarly, the above-mentioned predetermined threshold value for monitoring the amount of accumulated packets may be changed at any time according to the processing capacity of the packet processing unit 40.
[0058]
Packet judgment unit 30 Example of (2) : Figure 4
FIG. 4 shows, as an embodiment (2) of the packet determination unit 30, a case where the passage of a received packet is restricted by time. The packet determination unit 30 has a passage control unit 31 and a timer unit 33 as shown.
[0059]
In the embodiment (2), the status display signal I from the accumulation amount monitoring unit 20 is provided to the timer unit 33 instead of the passage number management unit 32 in the above embodiment (1).₁Is given.
The timer unit 33 outputs the status display signal I₁As a result, the state display signal I indicates that the packet storage amount has returned to below the predetermined threshold value again from the point in time when it is detected that the packet storage amount has increased and exceeded the predetermined threshold value.₁Until indicated by, the passing of the received packet is limited by the time and the number of packets permitted to pass at one time, thereby thinning out the received packet.
[0060]
That is, when thinning out the received packets, the timer unit 33 gives a signal of rejection to the passage control unit 31 for a predetermined time after starting the timing, and sends a permission signal after a predetermined time elapses to the passage control unit 31. To give to.
The pass control unit 31 discards the received packet while receiving the non-permission signal, passes the received packet to the packet storage unit 10 by a predetermined number only when receiving the permission signal, To the timer unit 33.
[0061]
The timer unit 33 starts counting again according to the passage notification N from the passage control unit 31, and thereafter, discards and passes the packet by the passage control unit 31 based on the disapproval and permission signals from the timer unit 33. The operation of measuring the time by the timer unit 33 based on the passage notification N from the passage control unit 31 is repeated.
[0062]
The predetermined time during which the reception packet is not permitted to pass and the number of packets permitted to pass at one time may be set as fixed values. If the processing capacity of the packet processing unit 40 fluctuates, the processing is performed. You may make it change at any time according to ability.
Packet judgment unit 30 Example of (3) : Figure 5
FIG. 5 shows, as an embodiment (3) of the packet determination unit 30, a case in which only packets protected by IPsec among received packets are restricted from passing. The packet judging unit 30 has a passage control unit 31 as shown in FIG.₁Is directly provided to the passage control unit 31 in the difference from the above embodiments (1) and (2).
[0063]
Further, the passage control unit 31 in the embodiment (3) has a packet analysis function, and the state display signal I₁From the time when it is detected that the accumulated amount of packets has changed from less than the predetermined threshold to more than the threshold, the state indication signal I indicates again that the accumulated amount of packets has become less than the predetermined threshold.₁Until indicated, it is analyzed whether or not AH or ESP which is an extension header indicating that the packet is protected by IPsec is added to the IP header of the packet, and only the packet to which the extension header is added is passed. By permitting, received packets are thinned out.
[0064]
That is, the passage control unit 31 discards the received packet to which the extension header is not added, and allows the packet storage unit 10 to pass only the received packet to which the extension header is added.
A packet protected by IPsec can be regarded as a high-priority packet transmitted from a highly reliable partner device exchanging a key for decrypting IPsec with itself. In addition, thinning can be performed in consideration of the priority of the received packet.
[0065]
Also, even if the received packet is protected by IPsec, if the packet is from a partner device that has not exchanged keys, the packet is discarded by the IPsec processing unit (not shown), so that the own device is adversely affected. Has no effect.
Packet judgment unit 30 Example of (4) : Figure 6
FIG. 6 shows, as an embodiment (4) of the packet determination unit 30, a case in which when performing the thinning-out process, the reception packet from a specific IP address is restricted so as to be discarded. .
[0066]
The packet judging unit 30 of the embodiment (4) shown in the figure has a passage control unit 31 having a packet analysis function, like the packet judging unit 30 of the embodiment (3) shown in FIG.
However, in the embodiment (4), unlike the embodiment (3), the passage control unit 31 sends the status display signal I₁Instead of the state indication signal I indicating the state of the packet storage amount for each IP address.₂Is provided from the storage amount monitoring unit 20.
[0067]
This state display signal I₂This is common to not only the present embodiment (4) but also embodiments (5) and (6) of the packet judging unit 30 to be described later, and stores the packets stored in the memory 80 by the packet storing unit 10. Regarding the amount, it indicates, for each source IP address of the packet, whether or not the packet storage amount for each source IP address is less than a predetermined threshold.
[0068]
That is, in the embodiments (4) to (6), the accumulation amount monitoring unit 20 determines whether or not the packet accumulation amount for each IP address accumulated in the memory 80 by the packet accumulation unit 10 is less than a predetermined threshold. Status display signal I₂Is output as
In the embodiment (4), the status display signal I₂Thus, for each IP address, from the point of time when it is detected that the packet storage amount has exceeded the predetermined threshold, it is determined that the packet storage amount has returned to below the predetermined threshold again.₂Until, the received packets are discarded by discarding all the received packets from the target IP address.
[0069]
Packet judgment unit 30 Example of (5) : Figure 7
FIG. 7 shows an embodiment (5) of the packet determination unit 30 when the thinning process is performed and the state display signal I₂This shows a case where the number of packets received from an IP address for which it has been confirmed that the packet storage amount for each IP address exceeds a predetermined threshold is limited in the same manner as in the embodiment (1).
[0070]
The packet determination unit 30 of the embodiment (5) shown in FIG. 7 is composed of a passage control unit 31 and a passage management unit 32 as in the embodiment (1) shown in FIG. 31 has a packet analysis function, and a signal provided from the storage amount monitoring unit 20 to the passage management unit 32 is a state display signal I indicating the state of the packet storage amount for each IP address.₂Is different from the embodiment (1).
[0071]
In the operation, the passage number management unit 32 and the passage control unit 31 of the embodiment (5) perform the state display signal I₂The thinning process at a fixed rate similar to that of the embodiment (1) is performed only for the packets having the transmission source of the IP address for which it is confirmed that the packet storage amount for each IP address exceeds the predetermined threshold value. Do.
[0072]
Packet judgment unit 30 Example of (6) : Figure 8
FIG. 8 shows an embodiment (6) of the packet determination unit 30 when the thinning process is performed and the state display signal I₂In the same way as in the embodiment (2), the time and the number of packets permitted to pass at one time are limited for the received packets from the IP addresses for which it has been confirmed that the packet storage amount for each IP address exceeds the predetermined threshold value. FIG.
[0073]
The packet judging unit 30 of the embodiment (6) shown in FIG. 8 includes a passage control unit 31 and a timer unit 33 as in the embodiment (2) shown in FIG. Has a packet analysis function, and a signal provided from the storage amount monitoring unit 20 to the timer unit 33 is a state display signal I indicating the state of the packet storage amount for each IP address.₂Is different from the embodiment (2).
[0074]
In the operation, the timer unit 32 and the passage control unit 31 of the embodiment (6) are connected to the state display signal I.₂The thinning process similar to that of the embodiment (2) is performed only on the packet having the source address as the IP address for which the packet storage amount for each IP address exceeds the predetermined threshold value.
[0075]
As described above, in the above-described embodiments (4) to (6) of the packet determination unit 30, the packet storage unit 10 determines the storage amount of the packet stored in the memory 80 by the storage amount management unit 20 for each IP address. Need to be managed.
Since a normal server needs to process packets received from an unspecified number of devices, it is expected that a huge amount of memory will be required to monitor the storage amount for each IP address. Are limited to packets received from the mobile node to be controlled, so that the amount of memory can be set to a necessary and sufficient value.
[0076]
Further, since the IP address of the mobile node to be controlled by the home agent is managed by the binding cache of the CAM 70 as described above, the management of each IP address is easily performed by adding a parameter to the binding cache. It is also possible.
(Appendix 1)
Whether the packet storage amount of the memory for temporarily storing the packets to be processed by the packet processing device to be protected is less than a predetermined threshold set so as not to exceed the processing capacity limit of the packet processing device A first step of monitoring whether or not
A second step of storing all received packets in the memory when the packet storage amount is less than the predetermined threshold;
When the packet storage amount is equal to or more than the predetermined threshold, the received packet is discarded based on a predetermined thinning condition corresponding to the processing capacity, and only the received packet not discarded is stored in the memory. The third step,
A DoS attack defense method comprising:
(Appendix 2)
Each transmission is performed so that the packet storage amount of all the source addresses of the packet in the memory for temporarily storing the packet to be processed by the packet processing device to be protected does not exceed the processing capability of the packet processing device. A first step of monitoring whether or not the packet storage amount for each source address is less than a predetermined threshold set;
A second step of storing all received packets from the source address corresponding to the packet storage amount that is less than the predetermined threshold in the memory;
Discards received packets from the source address corresponding to the packet storage amount that is equal to or greater than the predetermined threshold based on a predetermined thinning condition corresponding to the processing capacity, and only the received packets that have not been discarded are discarded. A third step of storing in the memory;
A DoS attack defense method comprising:
(Supplementary Note 3) In Supplementary note 1 or 2,
The DoS attack defense method, wherein the predetermined thinning condition is a ratio of a packet amount to be stored to a received packet amount determined according to the processing capability of the packet processing device.
(Supplementary Note 4) In Supplementary Note 1 or 2,
The predetermined thinning condition is characterized in that an amount of packets permitted to be stored in the memory at one time and a time interval at which the storage is permitted are determined in accordance with the processing capability of the packet processing apparatus. DoS attack defense method.
(Supplementary Note 5) In Supplementary Note 1,
The DoS attack defense method, characterized in that the predetermined thinning condition is set so as to permit accumulation of only packets protected by a predetermined security function.
(Supplementary Note 6) In Supplementary note 2,
A DoS attack defense method, wherein the predetermined thinning condition is a condition that all the received packets are discarded.
(Appendix 7)
A packet storage unit for temporarily storing packets to be processed by the packet processing device to be protected in a memory;
A storage amount monitoring unit that monitors whether the packet storage amount of the memory is less than a predetermined threshold set so as not to exceed the processing capacity limit of the packet processing device;
When the packet storage amount is less than the predetermined threshold value, it is determined that all received packets are stored in the memory, and when the packet storage amount is equal to or more than the predetermined threshold value, according to the processing capacity. A packet determining unit that discards the received packet based on the predetermined thinning condition and that stores only the received packet that has not been discarded in the memory;
A DoS attack defense device comprising:
(Appendix 8)
A packet storage unit for temporarily storing packets to be processed by the packet processing device to be protected in a memory;
The packet storage amount of all source addresses of the packet in the memory is less than a predetermined threshold set for the packet storage amount of each source address so as not to exceed the processing capacity limit of the packet processing device. A storage amount monitoring unit for monitoring whether or not
It is determined that all received packets from the source address corresponding to the packet storage amount that is less than the predetermined threshold are stored in the memory, and the packet storage amount that is equal to or more than the predetermined threshold is determined. A packet judging unit for discarding a received packet from the corresponding source address based on a predetermined thinning condition corresponding to the processing capability, and determining that only the received packet not discarded is stored in the memory; ,
A DoS attack defense device comprising:
(Supplementary Note 9) In Supplementary note 7 or 8,
The DoS attack defense device, wherein the predetermined thinning condition is a ratio of a packet amount to be stored to a received packet amount determined according to the processing capability of the packet processing device.
(Supplementary Note 10) In Supplementary note 7 or 8,
The predetermined condition is characterized in that the amount of packets permitted to be stored in the memory at one time and the time interval for permitting the storage are determined in accordance with the processing capability of the packet processing device. DoS attack defense device.
(Supplementary Note 11) In Supplementary Note 7,
The DoS attack defense device, wherein the predetermined thinning condition is set so as to permit accumulation of only packets protected by a predetermined security function.
(Supplementary Note 12) In Supplementary Note 8,
The DoS attack defense device, wherein the predetermined thinning condition is a condition that all the received packets are discarded.
[0077]
【The invention's effect】
As described above, according to the DoS attack prevention method and apparatus according to the present invention, the packet storage amount of the memory for temporarily storing the packet to be processed by the packet processing apparatus to be protected is determined by the processing capability of the packet processing apparatus. When the number of received packets is less than a predetermined threshold set so as not to exceed the limit, all received packets are stored in the memory. Since the received packet is discarded based on a predetermined thinning condition, and only the received packet which is not discarded is stored in the memory, the packet processing device to be protected even in the event of a DoS attack can be protected. It is possible to continue operation without causing a system down.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an example of the principle configuration of a DoS attack defense method and device according to the present invention.
FIG. 2 is a block diagram showing an embodiment of a DoS attack defense method and apparatus according to the present invention.
FIG. 3 is a block diagram illustrating an embodiment (1) of a packet determination unit 30 in the DoS attack prevention method and apparatus according to the present invention.
FIG. 4 is a block diagram showing an embodiment (2) of the packet determination unit 30 in the DoS attack defense method and device according to the present invention.
FIG. 5 is a block diagram illustrating an embodiment (3) of the packet determination unit 30 in the DoS attack prevention method and apparatus according to the present invention.
FIG. 6 is a block diagram illustrating an embodiment (4) of the packet determination unit 30 in the DoS attack prevention method and apparatus according to the present invention.
FIG. 7 is a block diagram illustrating an embodiment (5) of the packet determination unit 30 in the DoS attack prevention method and apparatus according to the present invention.
FIG. 8 is a block diagram illustrating an embodiment (6) of the packet determination unit 30 in the DoS attack prevention method and apparatus according to the present invention.
[Explanation of symbols]
10 Packet storage unit
20 Storage amount monitoring unit
30 Packet judgment unit
40 packet processing unit
50 packet receiver
60 packet transmitter
70 CAM
80 memory
100 home agent
200 Network interface
300 body
400 PCI bus
In the drawings, the same reference numerals indicate the same or corresponding parts.

Claims (3)

Whether the packet storage amount of the memory for temporarily storing the packets to be processed by the packet processing device to be protected is less than a predetermined threshold set so as not to exceed the processing capacity limit of the packet processing device A first step of monitoring whether or not
A second step of storing all received packets in the memory when the packet storage amount is less than the predetermined threshold;
When the packet storage amount is equal to or more than the predetermined threshold, the received packet is discarded based on a predetermined thinning condition corresponding to the processing capacity, and only the received packet not discarded is stored in the memory. The third step,
A DoS attack defense method comprising: In claim 1,
The DoS attack protection method, wherein the predetermined thinning condition is a ratio of a packet amount to be stored to a received packet amount determined according to the processing capability of the packet processing device. A packet storage unit for temporarily storing packets to be processed by the packet processing device to be protected in a memory;
A storage amount monitoring unit that monitors whether the packet storage amount of the memory is less than a predetermined threshold set so as not to exceed the processing capacity limit of the packet processing device;
When the packet storage amount is less than the predetermined threshold value, it is determined that all received packets are stored in the memory, and when the packet storage amount is equal to or more than the predetermined threshold value, it is determined according to the processing capacity. A packet determining unit that discards the received packet based on the predetermined thinning condition and that stores only the received packet that has not been discarded in the memory;
A DoS attack defense device comprising:

Images