JP2004265122A - Security ensuring method and strategy in private communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent unauthorized use, theft of inner data, alteration, destruction and the like from occurring by disabling cracking act of a third party against a privately operated server which can be used only by limited clients. <P>SOLUTION: In the case that a client 2 in a CUG requests connection for accompanying a CUG service to the server 1, line connection is made with a port number calculated by using a first function for varying in a certain period of as a port number for CUG of a server 1. In the case of re-connecting the server 1 and the client 2, line connection is made with a port number calculated by using a second function for varying according to a sequence number of service data immediately before line release as the port number for CUG of the server 1. In addition, in the case of reconnecting, if un-connected states continues for a predetermined period of time, line connection is made with a port number calculated by using the first function as the port number for CUG of the server 1. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

【００７６】
また、変数Ｚも第三者に盗聴されないようにするため、サーバー側コンピュータ１、クライアント側コンピュータ２の両方が独自に知り得る値、例えば年月日や時刻などを初期値として二次的に計算して求められる方法を用いる。式１での例として年月日から求まる数字Ｚ＝（ＹＹ＋ＭＭ＋ＤＤ）〔例えば、２００３年５月１日であると、Ｚ＝２００３＋０５＋０１＝２００９〕を用いると、ポート番号最大値６５５３５の引き算値（例えば、「Ｘ」＝６５５３５−２００９＝６３５２６）をＣＵＧ対応のポート番号とする方法である。
【００７７】
ここで関数ｆｎ、変数Ｚ、ＭＯＤについては実際にＣＵＧを運用する管理者が適宜決めることが相応しく、あくまでも上記内容は例である。
【００７８】
このようにサーバー側コンピュータ１のＴＣＰ処理部１２、クライアント側コンピュータ２のＴＣＰ処理部２２が共通のポート番号演算方法を知っているため、自由使用できるポート番号範囲のあるポート番号「Ｘ」で仮想回線接続を開始することが可能となる。すなわち、関数ｆｎは、サーバー側コンピュータ１とクライアント側コンピュータ２との間で同期した時間を基に変動値（１０２４〜６５５３５の値）になるように構成されていることになる。
【００７９】
次にサーバー側コンピュータ１とクライアント側コンピュータ２と間でＴＣＰ／ＩＰ通信をすでに実行していて再接続する場合の動作について以下に述べる。
【００８０】
ポート番号をＴＣＰ／ＩＰ通信ごとに可変させる方式であるが、第三者にポート番号の盗聴防止のため、可変させる契機についてもサーバー側コンピュータ１、クライアント側コンピュータ２が新たなポート番号を確認するための何らかの通信を行わなくても判定できる方法を実施する。
【００８１】
図２に示すようにクライアント側コンピュータ２からサーバー側コンピュータ１へ仮想回線接続要求が確立した後、サーバー側コンピュータ１からクライアント側コンピュータ２に要求したデータが送信されるが、このときサーバー側コンピュータ１からのデータ転送のバイト数を確認するためにシーケンス番号（ＳＱ番号）が必ずクライアント側コンピュータ２に送信され、通信が行なわれる間は、サーバー側コンピュータ１とクライアント側コンピュータ２が同じ内容を保有することが可能である。
【００８２】
このシーケンス番号の意味は、サーバー側コンピュータ１においては送信したデータのバイト数を示し、クライアント側コンピュータ２においては受信すべきデータのバイト数を表している。従って図５に示す様に仮想回線における通信過程で常に含まれている情報となる。
【００８３】
このシーケンス番号を用いてポート番号可変動作を行わせる。尚、これは通常のＴＣＰ／ＩＰ通信手順を一切の変更無く利用して行うことが可能である。また改めて可変したポート番号を連絡する通信を行う必要が無いため、第三者に可変させるポート番号を盗聴されることがない。
【００８４】
このシーケンス番号を利用して、ポート番号を可変させる方法としてはＴＣＰ／ＩＰ通信が終了した時点で示されたＳＱ番号を元に両者が予め知っているＣＵＧ内で定義された変換式ｆｘに当てはめ、新たなポート番号を算定する。
【００８５】
例えば変換式ｆｘの一例として、新しいポート番号を「Ｙ」とすると、「Ｙ」＝ｆｘとなる。すなわち、サーバー側コンピュータ１のアプリケーション、クライアント側コンピュータ２のＣＵＧアプリケーションが共通して下記の変換式を知っている為、式２で求めることが出来る。なお、ＩＮＴは、週数点以下を切り捨て整数化する関数であり、ＭＯＤは、引き算を示す。
【００８６】
【数２】

【００８７】
ＳＱ番号（シーケンス番号）はバイト数を表しており、式２の中のＳＱはＫＢ換算（端数は切り上げとする）する。例として２０５０バイトであれば、３ＫＢとなり、ポート番号最大値６５５３５からの引き算値（例えば、「Ｙ」＝６５５３５−３＝６５５３２）を新ポート番号とする方法である。ここで関数ｆｘ、変数ＳＱ、ＭＯＤについては実際にＣＵＧを運用する管理者が適宜決めることが相応しく、あくまでも上記内容は例である。
【００８８】
ここで変換式については実際にＣＵＧを運用する管理者が適宜決めることが相応しく、あくまでも上記内容は例である。すなわち、関数ｆｘは、仮想回線開放直前のサービスデータ（アプリケーション部１１とアプリケーション２１との間で転送される最後のデータ）のシーケンス番号を基に変動値（１０２４〜６５５３５の値）となるように構成されていることになる。以上の点を考慮したのが、図６のフローチャートである。
【００８９】
次に図６を中心に説明する。なお、接続し、アプリケーションレベルでデータのやり取りを行う動作については、上記の図２と図６の説明で説明した通りであるが、サーバー側コンピュータ１からの仮想回線開放要求の動作は以下のようになる。
【００９０】
サーバー側コンピュータ１のアプリケーション部１１からクライアント側アプリケーション部２１への仮想回線開放要求があると、ＴＣＰ処理部１２は、ＩＰ処理部１３、ネットワーク９００を介して、クライアント側コンピュータ２に送信する（ステップＳ２０３）。
【００９１】
ＩＰ処理部２３を介して仮想回線開放要求を受信したクライアント側コンピュータ２のＴＣＰ処理部２２は、開放通知をアプリケーション部２１に通知し、回線開放直前のＳＱ番号からサーバー側コンピュータ１の新しい番号を変換式ｆｘで算出すると共に、アプリケーション部２１からのサーバー側コンピュータ１への仮想回線開放要求をＩＰ処理部２３、ネットワーク９００を介して、サーバー側コンピュータ１に送信する（図６のステップＳ４０３）。
【００９２】
ＩＰ処理部１３を介して仮想回線開放要求を受信したサーバー側コンピュータ１のＴＣＰ処理部１２は、仮想回線開放通知をアプリケーション部１１に通知し、回線開放直前のＳＱ番号からサーバー側コンピュータ１の新しいＣＵＧポート番号を変換式ｆｘで算出する（ステップＳ２０４）。
【００９３】
更に、ＴＣＰ処理部１２は、ステップＳ２０４で算出した新しいポート番号、タイムスタンプ（「０」値）、接続状態（ＯＦＦ）をデータベース１４内の開放するクライアントＩＰアドレスとクライアントポート番号とをキーとした接続状態エリアに登録し終了する（ステップＳ２０５）。
【００９４】
一方、クライアント側コンピュータ２のＴＣＰ処理部２２は、ステップＳ４０３で算出した新しいＣＵＧポート番号、タイムスタンプ（「０」値、接続状態（ＯＦＦ）をデータベース２４内の開放するサーバーＩＰアドレスとクライアントポート番号とをキーとした接続状態エリアに登録し終了する（ステップＳ２０５）。
【００９５】
すなわち、算出した新しいＣＵＧポート番号「Ｙ」は、サーバー側およびクライアント側のそれぞれのデータベースに通信相手のＩＰアドレスとクライアントポート番号と共に記憶させることになる。
【００９６】
但しこのＣＵＧポート番号「Ｙ」の値を保持し続けるとデータベース１４のメモリ容積を圧迫するため、一定時間経過後までに新しいＴＣＰ／ＩＰ通信が実施されない場合にＣＵＧポート番号「Ｙ」をクリアするためのタイマ機能をサーバー側コンピュータ１、クライアント側コンピュータ２の両方に持たせる。その場合の動作を以下に示す。
【００９７】
予め決められた時間間隔（例えば、１分）で割り込みを発生する図示していないタイマにより、割り込みが発生すると、サーバー側コンピュータ１のＴＣＰ処理部１２は、データベース１４内で、接続状態が「ＯＦＦ」になっているＩＰアドレスのタイムスタンプを＋１カウントアップする（図１０のステップＳ７０１）。
【００９８】
ＴＣＰ処理部１２は、カウントアップしたタイムスタンプが予め決められた値（規定値）以上かの確認を行う（ステップＳ７０２，Ｓ７０３）。
【００９９】
ステップＳ７０３において、規定値以上であれば、ＴＣＰ処理部１２は、規定値以上であれば、規定値以上になったクライアントＩＰアドレスとクライアントポート番号をキーとした行を削除（データベース１４から該当するＩＰアドレス１行削除）して終了し、規定値以上でなければ、そのまま終了する（ステップＳ７０４）。
【０１００】
一方、クライアント側コンピュータ２でも予め決められた時間間隔（例えば、１分）で割り込みを発生する図示していないタイマにより、割り込みが発生すると、クライアント側コンピュータ２のＴＣＰ処理部２２は、データベース２４内で、接続状態が「ＯＦＦ」になっているＩＰアドレスのタイムスタンプを＋１カウントアップする（図１１のステップＳ８０１）。
【０１０１】
ＴＣＰ処理部２２は、カウントアップしたタイムスタンプが予め決められた値（規定値）以上かの確認を行う（ステップＳ８０２，Ｓ８０３）。
【０１０２】
ステップＳ８０３において、規定値以上であれば、ＴＣＰ処理部２２は、規定値以上になったサーバーＩＰアドレスとクライアントポート番号とをキーとした行を削除（データベース２４から該当するＩＰアドレス１行削除）して終了し、規定値以上でなければ、そのまま終了する（ステップＳ８０４）。
【０１０３】
従ってタイムスタンプの値が規定値以上になると、それぞれのデータベースに登録されている通信相手のＩＰアドレスとクライアントポート番号をキーとする行がクリアされることになり、次回クライアント側コンピュータ２がＣＵＧサービスを受ける場合、年月日から演算により求めたＣＵＧポート番号「Ｘ」が使用されることになる。
【０１０４】
従って本方式でのＴＣＰ／ＩＰ通信において利用するＣＵＧポート番号は、下記の２通りとなる。
【０１０５】
ＣＵＧポート番号クリアタイマ未動作（タイムスタンプが規定以上でない）の場合の場合は、式２による（ポート番号「Ｙ」）。
【０１０６】
ＣＵＧポート番号クリアタイマ動作（タイムスタンプが規定以上でない）の場合には、式１による（ポート番号「Ｘ」）。
【０１０７】
次に、図３を参照すると、ＣＵＧサービスの継続処理のために再接続してサーバー側コンピュータ１とクライアント側コンピュータ２との間でＴＣＰ／ＩＰ通信を開始する場合、図１のサーバー側コンピュータ１に対してクライアント側コンピュータ２が接続要求してアプリケーションレベルでデータの通を行うまでの状態遷移を示した状態遷移概略図である。両者間はＴＣＰ／ＩＰを用いたクライアント・サーバー通信を行っている。この図３、図６、図７、および図８を中心に、ＣＵＧサービスの継続処理のために再接続してサーバー側コンピュータ１とクライアント側コンピュータ２との間でＴＣＰ／ＩＰ通信を開始する場合の動作を以下に説明する。
【０１０８】
ＣＵＧ内のクライアント側コンピュータ２からサーバー側コンピュータ１へアプリケーションによる通信を行う場合、クライアント側コンピュータ２のアプリケーション部２１からＴＣＰ処理部２２に内部通信経路６１が作られる。このときＴＣＰ処理部２２は、データベース２４にアクセスするサーバー側コンピュータ１のＩＰアドレスが登録されているかを確認すると、登録されているのでデータベース２４に登録されているクライアントポート番号の中で接続状態が「ＯＦＦ」になっているものが存在するか（すなわち、現在使用されていないものが存在するか）を確認する（図８のステップＳ３０１〜Ｓ３０３，Ｓ３０５）。未使用があれば、ＴＣＰ処理部２２は、先に抽出したものを優先してデータベース２４からＣＵＧポート番号「Ｙ」と送信元のクライアントポート番号であるＰＯＲＴａとを抽出し、ＴＣＰヘッダに設定し、内部通信経路６２を経由してＩＰ処理部２３へ通信メッセージ（この場合ＴＣＰパケット）を転送する（ステップＳ３０６）。ステップＳ３０５において、未使用のものが存在しなければ、ＴＣＰ処理部２２は、データベース２４からＣＵＧポート番号「Ｙ」を抽出すると共に送信先のクライアントポート番号をランダムに算出してＴＣＰヘッダに設定し、内部通信経路６２を経由してＩＰ処理部２３へ通信メッセージ（この場合ＴＣＰパケット）を転送する（ステップＳ３０７）。その後ＩＰ処理部２３により、送信元のＩＰアドレス、送信先のＩＰアドレス等のＩＰヘッダを通信メッセージ（この場合ＴＣＰパケット）に付加することでＩＰレベルの通信メッセージ（この場合、ＩＰパケット）を作成して、クライアント側コンピュータ２から仮想回線確立要求７２が通信路（ネットワーク９００）を経由してサーバー側コンピュータ１に伝達される（図６のステップＳ４０１）。（図３−１の途中）。
【０１０９】
サーバー側コンピュータ１では、クライアント側コンピュータ２で経由した全く逆の流れに従ってサーバー側コンピュータ１のＴＣＰ処理部１２に定められているサーバー側待ち受けポート番号であるＹに内部通信経路６２を経て接続する。この場合、サーバー側ＴＣＰ処理部１２は、データベース１４に仮想回線接続要求のあったクライアントコンピュータ２のＩＰアドレス（受信したＩＰヘッダから抽出）が登録されているかを確認すると、登録されているので、データベース１４に確認したＩＰアドレスのエリアに仮想回線接続要求おけるＴＣＰヘッダから抽出したＣＵＧポート番号が登録されているかを確認する（図７のステップＳ１０１〜Ｓ１０４）。ステップＳ１０４で登録済みである（一致するＣＵＧポート番号が存在する）ので、ＴＣＰ処理部１２は、仮想回線接続要求メッセージのＴＣＰヘッダから抽出した送信元であるクライアント側ポート番号とデータベース１４に確認したＩＰアドレスのエリアのクライアントポート番号とが同じ（一致する）かを、確認する（ステップＳ１０５，Ｓ１０６）。ステップＳ１０６において、一致すれば、ＴＣＰ処理部１２は、仮想回線接続処理（アプリケーション１１への通知等）を行い、図６のステップＳ２０１へ進み、同じでなければ、ステップＳ１０６で一致したＩＰアドレスとステップＳ１０４で一致したクライアントポート番号とをキーとする行をデータベース１４から削除して、切断処理を行い、終了する（ステップＳ１０７，Ｓ１１１，Ｓ１１２）。このようにして受信処理で接続要求のポート番号の正当性を確認することで、正しくサーバー側待ち受けポート番号「Ｙ」を指定したクライアント側コンピュータ２からの通信のみがサーバー側アプリケーション１１に接続される。更に、サーバー側コンピュータ１のＴＣＰ処理部１２は、ＩＰ処理部１３を介して仮想回線確立応答７３をクライアント側コンピュータ２に返信する。すると、クライアント側コンピュータ２のＩＰ処理部２３は、内部通信経路６２、６１を介してアプリケーション部２１にサーバー側コンピュータ１との通信パスが確立したことを通知する。すなわち、クライアント・サーバー通信が成り立つ。この場合、サーバー１コンピュータから応答を受信したクライアント側コンピュータ２のＴＣＰ処理部２２は、接続情報（接続したサーバーＩＰアドレス、クライアントポート番号、ＣＵＧポート番号をキーとし、登録していなければ新たに登録し、そのキーに該当するタイムスタンプを「０」、接続状態を「ＯＮ」に設定：なお再接続の場合は登録済み）をデータベース２４に登録する（ステップＳ２０１，Ｓ４０２）。（図３−１の状態）。
【０１１０】
上記のステップＳ３０７をＴＣＰ処理部２２が実行する場合は、ＣＵＧサービスをサーバー側コンピュータ１から受ける場合でも１台のクライアントから複数の通信パス（複数の仮想回線）を張ることができる。
【０１１１】
上記の一連の処理の実行後、他のＣＵＧのクライアント側コンピュータ２との通信を待ち受けるために、サーバー側コンピュータ１のＴＣＰ処理部１２は、コネクション確立後クライアントコンピュータ２のポート番号「ＰＯＲＴａ」と接続していることを認識するためにサーバー側のポート番号としてＹ，ＰＯＲＴａを新たに定義してデータベース１４内の接続先のクライアント側コンピュータ２のＩＰアドレスに登録し、その該当するタイムスタンプエリアを「０」、接続状態を「ＯＮ」にすることになるが、既に登録されている場合は、該当するタイムスタンプエリアを「０」、接続状態のエリアを「ＯＮ」にし、管理する（ステップＳ２０２）。この場合、論理的には、サーバー側待ち受けポート番号「Ｙ」を開放してポート番号「Ｙ，ＰＯＲＴａ」に接続し直したのと同等の処理になる。この状態で、サーバー側コンピュータ１とクライアント側コンピュータ２との間でアプリケーションデータ要求７２、アプリケーションデータ応答７３が伝播され所定の通信が実施される（ステップＳ５００）。（図３−２の状態）。
【０１１２】
切断処理に関しては、初めての動作の場合に説明した場合の動作と同じなので説明を省略する。
【０１１３】
この場合の再接続に伴う動作シーケンスを示すと、図５のようになる。
【０１１４】
以上説明したように、制限されたクライアントコンピュータ２（ＣＵＧ）とのプライベート通信において、ＲＦＣ１０６０で公にされたウェルノウンサービス対応ポート番号を使用せずにＩＥＴＦが示している自由使用できるポート番号範囲の１０２４番以降６５５３５番までの中で、ＣＵＧ内独自に定めたサービス対応ポート番号を通信ごとに動的に可変して制定、利用してクライアント・サーバー型通信を実施するようにしているため、ＣＵＧ以外は利用することが出来ない非公開通信となると共に、悪意の第三者 が動的に変化するサービス対応ポート番号を盗聴できないようにすることが可能となる。
【０１１５】
また、独自に定めたサービス対応ポート番号を動的にサーバー側コンピュータ１で可変させる運用を行うことで、ＣＵＧのクライアントコンピュータ２それぞれ独立に非公開通信を利用できると共に、悪意の第三者 が動的に変化するサービス対応ポート番号を盗聴できないようにすることが可能となる。尚、サーバー側コンピュータ１のサービス対応ポート番号が動的に可変するため、クライアント側コンピュータ２では可変するポート番号に自動的に追従する動作を行う。
【０１１６】
また、サーバー側コンピュータ１のサービス対応ポート番号が動的に変化したことをＴＣＰ／ＩＰ通信またはＵＤＰ／ＩＰ通信を用いてサーバー側コンピュータ１からクライアント側コンピュータ２に対して一切通知しない運用を行う（このサービス対応ポート番号が変化したことを通知しない）ことにより、悪意の第三者 が動的に変化するサービス対応ポート番号を盗聴できないようにすることが可能となる。
【０１１７】
このように、動的に可変させ独自制定したサーバー側コンピュータ１のサービス対応ポート番号でＣＵＧのクライアント・サーバー型通信で運用させるため、悪意の第三者による連続ポートスキャン操作が行なわれた場合でも容易にＣＵＧサーバー側コンピュータ１のサービス対応ポート番号を見出すことが出来なくなり、クラッキング行為を早く諦めさせることが可能となる。加えて、クラッキング操作による無意味なデータ伝播量が減少し、ネットワークの帯域を正しい通信目的のためだけ利用できる。
【０１１８】
【発明の効果】
本発明は、サーバー側コンピュータの待ち受けポート番号に固定的なウェルノウンポート番号を使用せず、ＣＵＧ内部のクライアント側コンピュータだけが可変するサーバー側の待ち受けポート番号を知ることが出来る機構を有しているため、ＴＣＰ／ＩＰを用いたクライアント・サーバー型通信において制限したクライアント側コンピュータのみ利用可能なプライベート運用を行うサーバー側コンピュータを実現し、悪意の第三者によるクラッキング行為を無効にさせ、不正使用、内部データの盗用、改竄、破壊等々の発生を防止できるという効果がある。
【０１１９】
また、本発明は、一旦ＣＵＧのクライアント・サーバー型通信が開始されるとサーバー側コンピュータのポート番号が動的に可変され、クライアント側コンピュータも自動的にサーバー側コンピュータのポート番号に追従する機構を有しているため、悪意の第三者からポートスキャン操作等のクラッキング行為によるポート番号探査が行われても固定的なポート番号が見つけ出されず、クラッキング行為をより早く諦めさせることが出来るという効果がある。これによりクラッキング目的の不正パケット数が減少し、該当するサーバー側コンピュータが置かれるネットワークのトラフィック量を下げ帯域幅を正しい目的のために利用できる効果をもたらすことも可能となる。
【図面の簡単な説明】
【図１】本発明の実施の形態のシステムの構成を示すブロック図である。
【図２】本発明における初めてＣＵＧに伴う仮想回線確立から仮想回線確立の完了までの動作を示す状態遷移概略図である。
【図３】本発明における通信中の仮想回線再確立から仮想回線確立が完了するまでの動作を示す状態遷移概略図である。
【図４】本発明における初めて行う仮想回線確立、開放時におけるメッセージのやり取りの動作を示す動作シーケンス図である。
【図５】本発明における通信中の仮想回線再確立、開放時におけるメッセージのやり取りの動作を示す動作シーケンス図である。
【図６】図１のクライアント側コンピュータのアプリケーション部から仮想接続要求があった場合のクライアント側コンピュータおよびサーバー側コンピュータそれぞれのＴＣＰ処理部の動作を示すフローチャートである。
【図７】図６のサーバー側コンピュータの仮想回線接続受信処理の動作を示すサブルーチンのフローチャートである。
【図８】図６のクライアント側コンピュータの仮想回線接続要求処理の動作を示すサブルーチンのフローチャートである。
【図９】日付変更が発生した場合のサーバー側コンピュータのＴＣＰ処理部の動作を示すフローチャートである。
【図１０】タイマ割り込みが発生した場合のサーバー側コンピュータ１のＴＣＰ処理部の動作を示すフローチャートである。
【図１１】タイマ割り込みが発生した場合のクライアント側コンピュータ２のＴＣＰ処理部の動作を示すフローチャートである。
【図１２】本発明におけるサーバー側コンピュータ１のデータベースの構成例の概略を示す構成概略図である。
【図１３】本発明におけるクライアント側コンピュータ２のデータベースの構成例の概略を示す構成概略図である。
【図１４】サービスリストの一例を示すファイルの中身である。
【符号の説明】
１ サーバー側コンピュータ
２ クライアント側コンピュータ
１１，２１ アプリケーション部
１２，２２ ＴＣＰ処理部
１３，２３ ＩＰ処理部
１４，２４ データベース
６１，６２ 内部通信経路
７０ 仮想回線確立要求
７１ 仮想回線確立応答
７２ アプリケーションデータ要求
７３ アプリケーションデータ応答
９００ ネットワーク[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a method and system for securing security in private communication based on the TCP / IP protocol, and in particular, to a method and system for securing security in closed communication in a closed user group (CUG) that performs communication between a client and a server. About.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, in client / server communication using TCP / IP, a fixed identifier such as a port number is given to a server to uniquely distinguish a service (application) requested from a client to the server. ing. The port number in this system is publicly known as a well-known service compatible port number specified in RFC (Request for Comments) 1060 from IETF (The Internet Engineering Task Force). The port number corresponding to the well-known service defined in RFC 1060 in this case is held as data in an operating system (OS) installed in each client and server.
[0003]
A method of connecting the server / client by changing the port number after using such a fixed port number is disclosed in, for example, JP-A-6-301616.
[0004]
Now, when one of a plurality of clients requests an application to the server (executes a TCP / IP communication connection attempt), the client sets a fixed port number corresponding to the other application to the server. A communication path is established between the server and the client by transmitting the set port number in an IP packet. In addition, the server generates a new port number that is different from the fixed port number and notifies the connected client so that it can connect to other clients. Use
[0005]
[Patent Document 1]
JP-A-6-301616
[0006]
[Problems to be solved by the invention]
However, in the conventional server / client system using TCP / IP, a fixed identifier such as a port number is always given to the server so that the service (application) requested from the client to the server can be uniquely distinguished. In this case, a malicious third party can deprive the server of the root authority of the server by a cracking action such as a port scanning operation on the publicized port number on the server side. There is a problem that there is a possibility. Further, as a result, there is a problem that the server may suffer from disadvantages such as unauthorized use by a third party, theft, falsification, and destruction of internal data.
[0007]
The problem is that the same level of danger exists regardless of the server that performs public operations and the server that performs private operations permitted only to restricted clients (CUG).
[0008]
In the method disclosed in Japanese Patent Application Laid-Open No. Hei 6-301616, in which a new port number is notified after connecting to a fixed port number of the server, if a malicious third party monitors the network, In this case, a new port number will be known to the user, and the risk that a security hole is pierced through the known port number and the root authority of the server is deprived by a third party through the known port number similarly to the above problem. There is a problem.
[0009]
SUMMARY OF THE INVENTION In view of the above problems, it is an object of the present invention to disable a third-party cracking act on a server that performs private operation that can be used only by restricted clients in client-server communication using TCP / IP. , Unauthorized use, theft of internal data, falsification, destruction, and the like.
[0010]
Further, another object of the present invention is to invalidate a cracking action such as a port scan operation, thereby making it possible for a malicious third party to give up the action, reducing the number of packets for cracking purposes. The effect of this is to reduce the amount of traffic on the network where the server is located and to use the bandwidth for the correct purpose.
[0011]
[Means for Solving the Problems]
In order to achieve the above object, a first security securing method in private communication according to the present invention is a security securing method in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol. When the client in the CUG makes a connection request for the CUG service to the server, a first specific port number different from the well-known port number is calculated using a predetermined first function. The first specific port number thus calculated is connected to the server as a port number corresponding to the CUG of the server.
[0012]
Further, in the first security assurance method in the above-mentioned private communication, when reconnecting between the server and the client, a variable value is provided based on a sequence number of service data immediately before the line is released. The second specific port number calculated by using the obtained second function is connected as a CUG-compatible port number of the server.
[0013]
Further, in the security securing method in the first private communication described above, when reconnecting between the server and the client, if the unconnected state continues for a predetermined time, the first specific A line is connected to a port number as a port number corresponding to the CUG of the server.
[0014]
Further, a second security securing method in private communication according to the present invention is a security securing method in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol, wherein the client is A line is connected by using a first connection destination CUG port number calculated using a first function predetermined at the time of a CUG line connection request to the server, and a line is opened with the server. Is performed, the second connection destination CUG port number calculated using the second function configured to be a variation value based on the sequence number of the service data immediately before the line release is used as the connection destination server IP Register in that row in the first database so that the address and your client port number to open are keys, and connect to the server When performing again, the connection is made by using the second connection destination CUG port number registered in the first database, and the server extracts the TCP connection header extracted from the TCP header when receiving the connection request from the client. When the line connection is established by confirming the validity of the connection destination CUG port number of 1 with the first receiving CUG port number calculated by the first function, and the line is opened with the client. The second receiving CUG port number calculated using the second function is registered in that line in the second database such that the client IP address of the connection release destination and the client port number are used as keys. And confirming the validity of the second connection destination CUG port number extracted from the TCP header when receiving the reconnection request from the client. It is characterized in that the line connection by matching the registered in the second database the second receiving-side CUG port number.
[0015]
Further, in the above-mentioned security securing method in the above-mentioned second private communication, the client is connected to the second connection destination CUG registered in the first database using the server IP address and the client port number as keys. If the port number is not used for a predetermined period of time without being connected, a line using the server IP address and the client port number as keys is deleted from the first database, and the server sets the client IP When the second receiving port number registered in the first database using the address and the client port number as keys has not been used for a predetermined period of time without being connected, the second database is sent from the second database. Applicable client IP address and client port number It is characterized in that to remove the line and key.
[0016]
Further, in the security securing method in the above-mentioned second private communication, if the client does not have a CUG port number registered as a destination in the first database at the time of line connection including reconnection, the client The first connection destination port number calculated by the function 1 and the client port number calculated at random are set as the transmission source client port number, and the CUG port number of the destination is registered in the first database; If any of the registered client port numbers is not currently used, the CUG port number extracted from the first database is used as the second connection destination CUG port number and extracted from the first database. The client port number of the destination is the client port number of the destination, and If the CUG port number of the other party is registered in the first database, and if there is no currently used client port number among the registered client port numbers, the CUG port number extracted from the first database is replaced with the CUG port number. 2 and the client port number calculated at random and the client port number of the transmission source.
[0017]
Further, in the security securing method in the first or second secret communication described above, the first function is configured to have a variable value based on a time synchronized between the server and the client. It is characterized by being a function.
[0018]
Further, the first security assurance method in the non-public communication of the present invention is a security assurance method in the non-public communication for performing communication between a plurality of clients and a server based on a TCP / IP protocol, wherein the client is A first connection means for performing a line connection by using a first connection destination CUG port number calculated by using a predetermined first function at the time of a CUG line connection request to the server; The second connection destination CUG port number calculated using the second function configured to be a variable value based on the sequence number of the service data immediately before the line is released when the line is released between First registration means for registering a server IP address of a connection release destination and a client port number to be released as a key; Is characterized by having a a first re-connection means for line connection by using said second connection destination CUG port number registered in the first database when performing reconnect.
[0019]
Further, in the above-mentioned security securing method in the first private communication, the server confirms the validity of the first connection destination CUG port number extracted from the TCP header when receiving the connection request from the client. The second function is used when the line is opened between the client and the second connection means that matches the first receiving side CUG port number calculated by the function 1 and the client. Second registration means for registering the second receiving-side CUG port number calculated in such a manner that the client IP address of the connection release destination and the client port number are used as keys, and a TCP when receiving a reconnection request from the client. Confirmation of the validity of the second connection destination CUG port number extracted from the header is performed by the second database registered in the second database. It is characterized by having a second re-connection means for line connection by matching the second receiving-side CUG port number.
[0020]
Further, a second security assurance method in private communication of the present invention is a security assurance method in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol, wherein the server is When the connection request from the client is received, the line connection is established by checking the validity of the CUG port number extracted from the TCP header with the first receiving-side CUG port number calculated by a predetermined first function. When the line is opened between the second connection means and the client, the calculation is performed using the second function configured to be a variable value based on the sequence number base of the service data immediately before the line is released. The second receiving side CUG port number is set so that the client IP address of the connection release destination and the client port number serve as keys. Second registration means for registering the CUG port number extracted from the TCP header upon receipt of the reconnection request from the client, and confirming the validity of the CUG port number extracted from the TCP header by the second receiving CUG registered in the second database. It is characterized by having second reconnecting means for connecting to a line by matching the port number.
[0021]
Further, in the above-mentioned security securing system in the first private communication, the client is connected to the second connection destination registered by the first registration unit using the server IP address and the client port number as keys. If the CUG port number is not used for a predetermined period of time without being connected, a line using the corresponding server IP address and client port number as keys registered by the first registration means is deleted. It is characterized by having deletion means.
[0022]
Further, in the above-mentioned first or second security assurance method in private communication, the server may be configured to register the second IP address and the client port number registered by the second registration unit using the second IP address and the client port number as keys. If the receiving port number has not been used for a predetermined period of time without being connected, the line with the corresponding client IP address and the client port number registered by the second registration unit as a key is deleted. And a second deleting means for performing the operation.
[0023]
Further, in the above security securing system in the first private communication, the first connection means may include a CUG port number which is a destination registered by the first registration means at the time of line connection including reconnection. Means for making a line connection request to the server with the first connection destination port number calculated by the first function if not present, and the client port number calculated at random as a source client port number. The first connection means has a destination CUG port number registered by the first registration means at the time of a line connection including a reconnection, and a current CUG port number among the registered client port numbers. If there is an unused CUG port number, the CUG port number extracted from the first database is used as the second connection destination CUG port number. Means for making a line connection request to the server using the client port number extracted from the first registration means as the client port number of the transmission destination; and a CUG port to be a destination registered by the first registration means If a number exists and there is no registered client port number that is not currently being used, the CUG port number extracted from the first registration means is used as the second connection destination CUG port number. Means for making a line connection request to the server using the client port number calculated at random as the source client port number.
[0024]
Further, in the above-mentioned security securing method in the first or second secret communication, the first function is configured to be a variable value based on a time synchronized between the server and the client. It is characterized by being a function.
[0025]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
[0026]
Referring to FIG. 1, the embodiment of the present invention includes at least one server computer 1, a plurality of client computers 2, and a network 900. The server-side computer 1 and the client-side computer 2 each have an interface unit (not shown) connected to the network 900. The communication between the server-side computer 1 and the client-side computer 2 is performed by the respective interface units and This is performed via the network 900 under the IP protocol.
[0027]
The server-side computer 1 in FIG. 1 is a computer that operates under program control by a processor (CPU) (not shown). When the computer executes an application of a closed user group (CUG), TCP / The functional blocks in the computer when the program according to the IP protocol is executed include an application unit 11 which is an application execution unit of the CUG, a TCP processing unit 12, an IP processing unit 13, and a database 14. . Further, the server-side computer 1 provides a CUG service. The CUG is an information service in which only members of a specific group can use the server.
[0028]
The client-side computer 2 in FIG. 1 is a computer that operates under program control by a processor (CPU) (not shown), and shows functional blocks in the computer when the computer executes a program according to the TCP / IP protocol. , An application unit 21, a TCP processing unit 22, and an IP processing unit 23.
[0029]
Referring to FIG. 12, the configuration of the database 14 of the server-side computer 1 is shown, which is used by the TCP processing unit 12 to manage port numbers corresponding to CUG. The database 14 is allocated to an area in a storage unit (for example, a non-volatile magnetic disk device, a volatile RAM, or the like) (not shown). For each IP address of the computer 2 on the client side, the database 14 A port number consisting of a port number corresponding to the CUG and a port number on the client side, a time stamp for managing an undisconnected time, and a connection state indicating a connection state (connection: ON, disconnection: OFF or “0” value) And First, when the client computer 2 is connected to a CUG-compatible port number and disconnected from the server, the client computer 2 is registered in the area of each item corresponding to the IP address of the client computer 2. If the previously used IP address is registered after being reconnected from the client computer 2, it is used to check the validity of the port number included in the received packet based on the port number registered in the database 14. Is done.
[0030]
Referring to FIG. 13, the configuration of the database 24 of the client-side computer 2 is shown, which is used by the TCP processing unit 22 to manage port numbers corresponding to CUG. The database 24 is allocated to an area in a storage unit (for example, a non-volatile magnetic disk device, a volatile RAM, or the like) not shown, and stores the IP address of the server-side computer 1 A port number consisting of a CUG-compatible port number and a port number of the client-side computer 2, a time stamp for managing the time during which the connection has not been disconnected, and the connection status (connection: ON, disconnection: OFF or “0” value) are shown. Connection status. First, when the client computer 2 is connected to a port corresponding to the CUG and disconnected from the server computer 1, it is registered in the area of each item corresponding to the IP address of the server computer 1. If the IP address used last time is registered when reconnecting from the client computer 2, the port number registered in the database 24 is used as the TCP port number mounted on the transmission packet.
[0031]
Next, the operation of the embodiment of the present invention will be described with reference to FIGS.
[0032]
First, referring to FIG. 2, after the procedure relating to the CUG service is completed between the server computer 1 and the client computer 2, the CUG service is firstly communicated between the server computer 1 and the client computer 2 by TCP / IP. FIG. 3 is a schematic state transition diagram showing a state transition from when a client computer 2 requests a connection to a server computer 1 in FIG. 1 to perform data communication at an application level when communication is started. A client / server communication using TCP / IP is performed between the two. 2 and 8, after the procedure related to the CUG service is completed between the server computer 1 and the client computer 2, the server computer 1 and the client computer 2 execute the CUG service for the first time. The operation when starting IP communication will be described.
[0033]
When performing communication by an application from the client computer 2 to the server computer 1 in the CUG, an internal communication path 61 is created from the application unit 21 of the client computer 2 to the TCP processing unit 22. At this time, the TCP processing unit 22 defines the port number PORTa of the transmission source client computer 2 and the port number corresponding to the CUG of the transmission destination server computer 1, and the IP processing unit via the internal communication path 62. 23, a communication message (in this case, a TCP packet) is transferred. Thereafter, the IP processing unit 23 creates an IP packet by adding an IP header, such as a source IP address and a destination IP address, to the communication message (in this case, a TCP packet). Is transmitted to the server-side computer 1 via the communication path (network 900) (steps S300 and S401 in FIG. 6). (In the middle of Fig. 2-1).
[0034]
In the server-side computer 1, via the internal communication path 62, the port number X corresponding to the server-side standby CUG defined in the TCP processing unit 12 of the server-side computer 1 follows the completely opposite flow via the client-side computer 2. Connecting. In this case, by confirming the validity of the port number corresponding to the CUG of the virtual circuit establishment request in the reception processing of the server-side TCP processing unit 12, the client-side computer 2 that correctly designated the server-side listening port number "X" Only communication is connected to the server side application unit 11. Further, the server-side TCP processing unit 12 returns a virtual line establishment response 71 to the client-side computer 2 via the IP processing unit 13. Then, the IP processing unit 23 of the client computer 2 notifies the application unit 21 via the internal communication paths 62 and 61 that the communication path with the server computer 1 has been established. That is, client-server communication is established. In this case, the TCP processing unit 22 of the client computer 2 receiving the response from the server 1 computer registers the connection information (the connected server IP address, the client port number, and the CUG port number, sets the time stamp to “0”, The state is set to “ON”) is registered in the database 24 (steps S100, S201, S402) (state in FIG. 2-1). In the following description, the line establishment request may be called a virtual line connection request.
[0035]
After this processing, in order to wait for communication with the client computer 2 of another CUG, the TCP processing unit 12 of the server computer 1 is connected to the port number “PORTTa” of the client computer 2 after the connection is established. X and PORTa are newly defined as port numbers of the server-side computer 1 in order to recognize the IP address of the client-side computer 2 to be connected in the database 14 and the port number area corresponding to the IP address is registered in the port number area. After registration, the time stamp area is set to "0" and the connection state is set to "ON" for management (step S202). In this case, the processing is logically equivalent to opening the port number “X” corresponding to the server-side standby CUG and reconnecting to the port number “X, PORTa”. In this state, the application data request 72 and the application data response 73 are propagated between the server-side computer 1 and the client-side computer 2, and predetermined communication is performed (step S500). (State of FIG. 2-2).
[0036]
In the TCP processing unit in step S500, when transmitting while exchanging with the respective application units and the IP processing unit, when transmitting, the port number (server side: X, client Side: PORTa), a sequence number (increases in byte units), an acknowledgment number, etc. are set, and when receiving, they operate while extracting and confirming (checking the sequence number, etc.).
[0037]
The processing in step S100 when the TCP processing unit 12 of the server-side computer 1 receives the virtual line connection request from the client-side computer 2 in step S401 will be described mainly with reference to FIG.
[0038]
The TCP processing unit 12 checks whether or not the IP address of the client-side computer 2 that has requested the virtual circuit connection is registered in the database 14 (in this case, extracted from the received IP header) (steps S101 and S102 in FIG. 7). .
[0039]
In step S102, since it is the first and thus not registered, the port number corresponding to the server-side CUG extracted from the TCP header of the virtual circuit connection request message and the CUG port number registered in the service list are the same (match). Is confirmed (steps S108 and S109). In the following description, the port number corresponding to the CUG of the server-side computer 1 may be abbreviated as a CUG port number.
[0040]
In step S109, if they match, the TCP processing unit 12 performs virtual line connection processing (notification to the application 11, etc.), proceeds to step S201 in FIG. 6, and if not, performs disconnection processing and ends ( Steps S108, S109, S107).
[0041]
In step S102, if the IP address is registered, the TCP processing unit 12 checks the CUG port number of the transmission destination extracted from the TCP header of the virtual circuit connection request message and the CUG port number in the area of the IP address confirmed in the database 14. It is confirmed whether the port numbers are the same (match) (steps S103 and S104).
[0042]
If they match in step S104, the TCP processing unit 12 determines that the client port number as the transmission source extracted from the TCP header of the virtual circuit connection request message and the client port number in the area of the IP address confirmed in the database 14 are the same (match). ) Is confirmed (steps S105 and S106).
[0043]
In step S106, if they match, the TCP processing unit 12 performs virtual line connection processing (notification to the application 11, etc.), and proceeds to step S201 in FIG. 6 (step S107).
[0044]
If they do not match in step S106, the TCP processing unit 12 ends in step S102 (steps S111 and S112).
[0045]
If there is no match in step S104, the TCP processing unit 12 deletes the line of the IP address that matches in step S102 from the database 14, and ends (steps S110 and S112).
[0046]
In the above description, after the CUG port numbers match in step S104, the TCP processing unit 12 checks the client port number in steps S105 and S106, but the client computer 2 uses a new client port number. Then, in order to determine that the connection has been made to receive the CUG service, the TCP processing unit 12 may perform the processing of the virtual circuit connection without performing the processing of steps S105 and S106.
[0047]
The virtual line connection request processing in step S300 is as follows.
[0048]
Upon receiving the connection request from the application unit 21, the TCP processing unit 22 of the client computer 2 checks whether the CUG port number is registered in the database 24 (Steps S301 and S302 in FIG. 8).
[0049]
Since the first communication is not registered in the database 24, the TCP processing unit 22 calculates the CUG port number on the server side using the function fn (described below), and further calculates the port number on the client side. The CUG port number, the port number of the client-side computer 2 and the like respectively calculated and set in the TCP header are set in the TCP header, and the subroutine ends (step S304). In this case, even in the case of reconnection, if there is a case where the database 24 is not registered, the TCP processing unit 22 executes step S304, and operates in the same manner as in the first communication.
[0050]
In the TCP / IP communication, if the communication is not logically connected at all times and the request from the client computer 2 is completed by the response from the server computer 1, the virtual circuit between them is released. However, if the connection is re-established within a certain period of time, the server computer 1 holds the communication history of the client computer 2 in the database 14 and receives a virtual circuit establishment request 70 transmitted from the client computer 2 later. In the present invention, the server-side computer 1 and the client-side computer 2 do not independently perform any advance notification or change notification so that a malicious third party does not recognize the server-side listening port number X. The communication is performed by calculating the standby port number “X”.
[0051]
As described above, the functions and operations of the client-server communication according to the present method are summarized as follows.
[0052]
In this system, since the mechanism in the ordinary TCP / IP is followed, the basic communication operation using the IP address and the port number (creation of the TCP / IP packet and exchange of the packet between the client and the server) is performed. Is not different.
[0053]
As shown in FIG. 2, in the server-side computer 1, a port number corresponding to a CUG for receiving a virtual circuit connection from the client-side computer 2 is outside a public port number range defined in RFC1060 and dynamically changes. It is "X". Naturally, the IP address at the time of the connection request is based on the assumption that the IP address of the server computer 2 is correct.
[0054]
The port number “X” is, for example, a port number “80” in the conventional TCP / IP communication, which indicates that HTTP is used as an application.
[0055]
As described above, in the conventional method, public use is possible by specifying a public port number. However, if the purpose is to use only the parties in the CUG, communication cannot be kept private.
[0056]
As an improvement of this problem, the feature of this method is that the port number corresponding to the CUG of the virtual line connection reception of the server-side computer 1 is not disclosed except for the CUG, and that the CUG port number is the TCP / IP communication. Provide a function to dynamically change each time. This makes it impossible for a third party other than the CUG to make a determination.
[0057]
FIG. 2B shows a port number state after the server-side computer 1 receives a virtual circuit connection from the client-side computer 2. When the virtual circuit is connected, a new port number “X, PORTa” is provided in the server computer 1 and TCP / IP communication with the client computer 2 is performed. "X, PORTa" is recognized as "PORTa" port number communication connected by "X" port number.
[0058]
In the case of communication using only a port number, when a plurality of client computers 2 are present, there may be duplication of port numbers. Therefore, the server-side computer 1 identifies the IP address of each CUG client computer 2 at the same time and uniquely identifies each client communication. Distinction.
[0059]
Next, the operation of the message sequence will be described with reference to the sequence diagram of FIG. The sequence operation in FIG. 4 includes an operation period for connecting a virtual line (sequence A110), an application communication period for exchanging application data (sequence A120), and an operation period for disconnecting the virtual line (sequence A130). An operation period for connecting a virtual circuit period will be described.
[0060]
A SYN message (SYN) indicating a virtual circuit connection request having a parameter of “PORTa” as the port number of the start point (client side computer 2) and “X” as the CUG port number of the end point (server side computer 1) from the client side computer 2 The packet is transmitted to the server-side computer 1 (sequence A101 in FIG. 4).
[0061]
Server-side computer 1 transmits a SYN, ACK message (SYN, ACK packet) indicating that the virtual circuit connection request reception is valid to client-side computer 2 as a response to the SYN message (sequence A102). At this time, the CUG port number of the start point (server-side computer 1) is “X”, and the port number of the end point (client-side computer 2) is “PORTa”.
[0062]
Finally, the client computer 2 transmits an ACK message (ACK packet) indicating the validity of the reception confirmation to the server computer 1 as a response to the SYN, ACK message. At this time, the CUG port number of the end point (server side computer 1) is "X", and the port number of the start point (client side computer 2) is "PORTa" (sequence A103).
[0063]
Regarding the operation period for disconnecting the virtual circuit period, the CUG port number of the start point (server side computer 1) from the server side computer 1 has the parameter "X", and the port number of the end point (client side computer 2) has the parameter "PORTa". A FIN message (FIN packet) indicating the virtual line disconnection request is transmitted to the client computer 2 (sequence A131).
[0064]
The client-side computer 2 transmits an ACK message (ACK packet) indicating that the virtual circuit disconnection request has been received to the server-side computer 1 as a response to the FIN message (sequence A132). At this time, the port number of the start point (client computer 2) is "PORTa", and the CUG port number of the end point (server computer 1) is "X". This means that the virtual line from the server computer 1 has been disconnected.
[0065]
Since TCP / IP is a full-duplex communication, it is necessary to disconnect the virtual circuit from the client computer 2 as well, so that the port number of the start point (client computer 2) from the client computer 2 is "PORTa" and the end point is A FIN message indicating a virtual line disconnection request having a parameter of “X” for the CUG port number of (server-side computer 1) is transmitted to server-side computer 1 (sequence A133).
[0066]
Server-side computer 1 transmits an ACK message indicating that the virtual circuit disconnection request has been received to the client-side computer 2 as a response to the FIN message (sequence A134). At this time, the CUG port number of the start point (server-side computer 1) is “X”, and the port number of the end point (client-side computer 2) is “PORTa”. As a result, the virtual line from the client-side computer 2 is disconnected, and all the double lines are disconnected, and the communication between the server-side computer 1 and the client-side computer 2 ends.
[0067]
Next, how the CUG-compatible dynamic variable port number “X” of the server-side computer 1 described in the text is determined and how it is variable for each TCP / IP communication will be described.
[0068]
After the procedure related to the CUG service is completed between the server computer 1 and the client computer 2, the CUG service starts the TCP / IP communication between the server computer 1 and the client computer 2 for the first time. The method of calculating the port number is described below.
[0069]
Assuming that the CUG port number of the server-side computer 1 is "X", the method of determining the CUG-compatible port number "X" of the server-side computer 1 is determined by the TCP processing unit 12 of the server-side computer 1 and the TCP processing unit of the client-side computer 2. 22 independently determines.
[0070]
The calculation method of the server-side computer 1 of the CUG-compatible port number “X” of the server-side computer 1 is determined when the date is changed in FIG. That is, it operates as follows.
[0071]
When the date is changed, the TCP processing unit 12 calculates a new CUG port number, registers the calculated CUG port number in the service file (replaces the previous CUG port number with the calculated CUG port number), and ends. (Steps 601 and S602 in FIG. 9).
[0072]
The client-side calculation method of the CUG-compliant port number “X” of the server-side computer 1 is calculated at the time of the virtual line connection request processing in step S300 in FIG. 6, that is, in step S304 in FIG.
[0073]
In the above description, both the TCP processing unit 12 of the server-side computer 1 and the TCP processing unit 22 of the client-side computer 2 make the determination using the function fn of “X” = fn (Z).
[0074]
The definition of the function fn is determined so that the operation result is in the range of 1024 to 65535 of the port number that can be freely used. For example, Equation 1 is used. Note that INT is a function that rounds down the decimal part to an integer value, and MOD indicates subtraction.
[0075]
(Equation 1)

[0076]
Also, in order to prevent the third party from eavesdropping on the variable Z, a value which can be independently known by both the server-side computer 1 and the client-side computer 2, for example, the date, time, etc., is calculated as an initial value. Use the method required. As an example in Expression 1, if the number Z = (YY + MM + DD) obtained from the date (for example, on May 1, 2003, Z = 2003 + 05 + 01 = 2009), the subtraction value of the port number maximum value 65535 (for example, , “X” = 65535-2009 = 63526) are used as CUG-compatible port numbers.
[0077]
Here, it is appropriate that the function fn, the variable Z, and the MOD are appropriately determined by an administrator who actually operates the CUG, and the above contents are only examples.
[0078]
As described above, since the TCP processing unit 12 of the server-side computer 1 and the TCP processing unit 22 of the client-side computer 2 know the common port number calculation method, the TCP processing unit 12 virtually uses the port number “X” having a port number range that can be used freely. It is possible to start line connection. That is, the function fn is configured to be a fluctuation value (a value of 1024 to 65535) based on the time synchronized between the server-side computer 1 and the client-side computer 2.
[0079]
Next, an operation in the case where TCP / IP communication has already been executed between the server-side computer 1 and the client-side computer 2 and reconnection is performed will be described below.
[0080]
In this method, the port number is changed for each TCP / IP communication. In order to prevent a third party from eavesdropping on the port number, the server-side computer 1 and the client-side computer 2 confirm a new port number also when changing the port number. A method that can be determined without performing any kind of communication.
[0081]
As shown in FIG. 2, after a virtual circuit connection request is established from the client computer 2 to the server computer 1, the requested data is transmitted from the server computer 1 to the client computer 2. At this time, the server computer 1 A sequence number (SQ number) is always transmitted to the client computer 2 in order to confirm the number of bytes for data transfer from the server 1. During communication, the server computer 1 and the client computer 2 have the same contents. It is possible.
[0082]
The meaning of the sequence number indicates the number of bytes of transmitted data in the server-side computer 1, and indicates the number of bytes of data to be received in the client-side computer 2. Therefore, as shown in FIG. 5, the information is always included in the communication process on the virtual line.
[0083]
A port number variable operation is performed using this sequence number. Note that this can be performed using a normal TCP / IP communication procedure without any change. Further, since there is no need to perform communication for notifying the changed port number again, there is no eavesdropping on the changed port number by a third party.
[0084]
A method of making the port number variable using this sequence number is to apply the conversion formula fx defined in the CUG that both parties know in advance based on the SQ number indicated at the end of the TCP / IP communication. , Calculate the new port number.
[0085]
For example, as an example of the conversion formula fx, if a new port number is “Y”, “Y” = fx. That is, since the application of the server-side computer 1 and the CUG application of the client-side computer 2 commonly know the following conversion formula, the conversion formula can be obtained by the formula 2. Note that INT is a function that rounds down a number of weeks or less to an integer, and MOD indicates subtraction.
[0086]
(Equation 2)

[0087]
The SQ number (sequence number) represents the number of bytes, and the SQ in Expression 2 is converted into KB (fractions are rounded up). For example, if the size is 2050 bytes, it becomes 3 KB, and the subtraction value (for example, “Y” = 65535-3 = 65532) from the maximum value of the port number 65535 is used as the new port number. Here, it is appropriate that the function fx, the variables SQ, and the MOD are appropriately determined by the administrator who actually operates the CUG, and the above contents are only examples.
[0088]
Here, it is appropriate that the manager who actually operates the CUG appropriately decides the conversion formula, and the above contents are only examples. That is, the function fx becomes a variable value (a value of 1024 to 65535) based on the sequence number of the service data (the last data transferred between the application unit 11 and the application 21) immediately before releasing the virtual circuit. It will be configured. The flowchart of FIG. 6 takes into consideration the above points.
[0089]
Next, a description will be given mainly with reference to FIG. The operation of connecting and exchanging data at the application level is as described in the above description of FIGS. 2 and 6, but the operation of the virtual line release request from the server-side computer 1 is as follows. become.
[0090]
When there is a virtual circuit release request from the application unit 11 of the server-side computer 1 to the client-side application unit 21, the TCP processing unit 12 transmits the request to the client-side computer 2 via the IP processing unit 13 and the network 900 (step). S203).
[0091]
The TCP processing unit 22 of the client-side computer 2 that has received the virtual circuit release request via the IP processing unit 23 notifies the application unit 21 of the release notification, and replaces the SQ number immediately before the line release with the new number of the server-side computer 1. In addition to the calculation using the conversion formula fx, a virtual line release request from the application unit 21 to the server-side computer 1 is transmitted to the server-side computer 1 via the IP processing unit 23 and the network 900 (step S403 in FIG. 6).
[0092]
The TCP processing unit 12 of the server-side computer 1 that has received the virtual line release request via the IP processing unit 13 notifies the application unit 11 of a virtual line release notification, and a new SQ number of the server-side computer 1 based on the SQ number immediately before the line release. The CUG port number is calculated using the conversion formula fx (step S204).
[0093]
Further, the TCP processing unit 12 sets the new port number, the time stamp (“0” value), and the connection state (OFF) calculated in step S204 in the database 14 with the client IP address and the client port number to be released as keys. It registers in the connection state area and ends (step S205).
[0094]
On the other hand, the TCP processing unit 22 of the client-side computer 2 sends the new CUG port number, time stamp (“0” value, connection state (OFF), connection state (OFF), server IP address and client port number to be released in the database 24 calculated in step S403. Is registered in the connection state area using the key as a key (step S205).
[0095]
That is, the calculated new CUG port number “Y” is stored in the respective databases on the server side and the client side together with the IP address of the communication partner and the client port number.
[0096]
However, if the value of the CUG port number “Y” is kept held, the memory capacity of the database 14 will be reduced, and the CUG port number “Y” will be cleared when new TCP / IP communication is not performed until a certain time has elapsed. Timer function for both the server-side computer 1 and the client-side computer 2. The operation in that case is described below.
[0097]
When an interrupt is generated by a timer (not shown) that generates an interrupt at a predetermined time interval (for example, one minute), the TCP processing unit 12 of the server-side computer 1 sets the connection state to “OFF” in the database 14. The time stamp of the IP address of "" is incremented by +1 (step S701 in FIG. 10).
[0098]
The TCP processing unit 12 checks whether the counted up time stamp is equal to or greater than a predetermined value (specified value) (steps S702 and S703).
[0099]
In step S703, if the value is equal to or more than the specified value, the TCP processing unit 12 deletes the line using the client IP address and the client port number that are equal to or more than the specified value as keys (if the value is equal to or more than the specified value) (One line of the IP address is deleted), and the processing is terminated.
[0100]
On the other hand, when the client computer 2 generates an interrupt by a timer (not shown) that generates an interrupt at a predetermined time interval (for example, one minute), the TCP processing unit 22 of the client computer 2 Then, the time stamp of the IP address whose connection state is "OFF" is incremented by +1 (step S801 in FIG. 11).
[0101]
The TCP processing unit 22 checks whether the counted up time stamp is equal to or larger than a predetermined value (specified value) (Steps S802 and S803).
[0102]
In step S803, if the value is equal to or more than the specified value, the TCP processing unit 22 deletes the line using the server IP address and the client port number that are equal to or more than the specified value as keys (deletes one line of the corresponding IP address from the database 24). If the value is not equal to or more than the specified value, the process is terminated (step S804).
[0103]
Therefore, when the value of the time stamp becomes equal to or more than the specified value, the line using the IP address and the client port number of the communication partner registered in the respective databases as keys is cleared, and the client computer 2 next time uses the CUG service. , The CUG port number “X” calculated from the date is used.
[0104]
Therefore, the following two CUG port numbers are used for TCP / IP communication in this method.
[0105]
In the case where the CUG port number clear timer is not operating (the time stamp is not equal to or greater than the specified value), Expression 2 is used (port number “Y”).
[0106]
In the case of the CUG port number clear timer operation (the time stamp is not equal to or greater than the specified value), Expression 1 is used (port number “X”).
[0107]
Next, referring to FIG. 3, when reconnecting to start the TCP / IP communication between the server computer 1 and the client computer 2 for the continuous processing of the CUG service, the server computer 1 of FIG. FIG. 9 is a state transition schematic diagram showing state transition from when the client-side computer 2 requests connection to pass data at the application level. A client / server communication using TCP / IP is performed between the two. A case where TCP / IP communication is started between the server-side computer 1 and the client-side computer 2 by reconnecting for continuation processing of the CUG service, centering on FIGS. 3, 6, 7 and 8 Will be described below.
[0108]
When performing communication by an application from the client computer 2 to the server computer 1 in the CUG, an internal communication path 61 is created from the application unit 21 of the client computer 2 to the TCP processing unit 22. At this time, the TCP processing unit 22 checks whether the IP address of the server-side computer 1 accessing the database 24 is registered, and when the IP address is registered, the connection state is changed among the client port numbers registered in the database 24. It is checked whether or not there is an “OFF” (that is, whether or not there is an unused one) (steps S301 to S303 and S305 in FIG. 8). If unused, the TCP processing unit 22 extracts the CUG port number “Y” and the client port number PORTa of the transmission source from the database 24 with priority given to the previously extracted one, and sets it in the TCP header. The communication message (in this case, a TCP packet) is transferred to the IP processing unit 23 via the internal communication path 62 (step S306). In step S305, if there is no unused one, the TCP processing unit 22 extracts the CUG port number “Y” from the database 24, calculates the client port number of the transmission destination at random, and sets it in the TCP header. The communication message (in this case, a TCP packet) is transferred to the IP processing unit 23 via the internal communication path 62 (step S307). Thereafter, the IP processing unit 23 adds an IP header such as a source IP address and a destination IP address to the communication message (in this case, a TCP packet) to create an IP-level communication message (in this case, an IP packet). Then, the virtual circuit establishment request 72 is transmitted from the client computer 2 to the server computer 1 via the communication path (network 900) (Step S401 in FIG. 6). (In the middle of FIG. 3-1).
[0109]
The server-side computer 1 connects to the server-side standby port number Y defined in the TCP processing unit 12 of the server-side computer 1 via the internal communication path 62 according to a completely opposite flow via the client-side computer 2. In this case, if the server-side TCP processing unit 12 confirms whether the IP address (extracted from the received IP header) of the client computer 2 that has made the virtual circuit connection request is registered in the database 14, it is registered. It is confirmed whether or not the CUG port number extracted from the TCP header in the virtual circuit connection request is registered in the area of the confirmed IP address in the database 14 (steps S101 to S104 in FIG. 7). Since the registration has been completed in step S104 (there is a matching CUG port number), the TCP processing unit 12 confirms with the database 14 and the client-side port number as the transmission source extracted from the TCP header of the virtual circuit connection request message. It is confirmed whether the client port number in the area of the IP address is the same (coincides) (steps S105 and S106). In step S106, if they match, the TCP processing unit 12 performs virtual line connection processing (notification to the application 11, etc.) and proceeds to step S201 in FIG. The line using the client port number that matches in step S104 as a key is deleted from the database 14, a disconnection process is performed, and the process ends (steps S107, S111, S112). By confirming the validity of the port number of the connection request in the reception process in this way, only communication from the client-side computer 2 that correctly specifies the server-side listening port number “Y” is connected to the server-side application 11. . Further, the TCP processing unit 12 of the server-side computer 1 returns a virtual line establishment response 73 to the client-side computer 2 via the IP processing unit 13. Then, the IP processing unit 23 of the client computer 2 notifies the application unit 21 via the internal communication paths 62 and 61 that the communication path with the server computer 1 has been established. That is, client-server communication is established. In this case, the TCP processing unit 22 of the client-side computer 2 that has received the response from the server 1 computer uses the connection information (the connected server IP address, client port number, and CUG port number as a key. Then, the time stamp corresponding to the key is set to "0" and the connection state is set to "ON": registered in the case of reconnection (registered in the case of reconnection) in the database 24 (steps S201 and S402). (State of FIG. 3-1).
[0110]
When the above-described step S307 is executed by the TCP processing unit 22, a plurality of communication paths (a plurality of virtual lines) can be established from one client even when the CUG service is received from the server-side computer 1.
[0111]
After executing the above-described series of processing, the TCP processing unit 12 of the server-side computer 1 establishes a connection with the port number “PORTTa” of the client computer 2 after establishing a connection in order to wait for communication with the client-side computer 2 of another CUG. Y and PORTa are newly defined as server-side port numbers and registered in the IP address of the client computer 2 of the connection destination in the database 14, and the corresponding time stamp area is set to " 0 "and the connection state is set to" ON ". If the connection is already registered, the corresponding time stamp area is set to" 0 "and the connection state area is set to" ON "and managed (step S202). . In this case, it is logically the same processing as releasing the server-side standby port number “Y” and reconnecting to the port number “Y, PORTa”. In this state, the application data request 72 and the application data response 73 are propagated between the server-side computer 1 and the client-side computer 2, and predetermined communication is performed (step S500). (State of FIG. 3-2).
[0112]
The disconnection processing is the same as the operation described in the case of the first operation, and thus the description is omitted.
[0113]
FIG. 5 shows an operation sequence accompanying the reconnection in this case.
[0114]
As described above, in the private communication with the restricted client computer 2 (CUG), the port number in the freely usable port number range indicated by IETF without using the well-known service compatible port number published by RFC 1060 is 1024. Since the service port number uniquely defined in the CUG is dynamically changed and established for each communication from among the numbers 65535 to 65535, client-server type communication is implemented by using it, so other than CUG Is a private communication that cannot be used, and it is possible to prevent malicious third parties from eavesdropping on the dynamically changing service corresponding port numbers.
[0115]
In addition, by operating the server-side computer 1 to dynamically change the service-corresponding port number uniquely defined, the CUG client computers 2 can use private communication independently of each other, and a malicious third party can operate. It is possible to prevent eavesdropping on a service corresponding port number that changes dynamically. Since the service-compatible port number of the server-side computer 1 dynamically changes, the client-side computer 2 performs an operation of automatically following the variable port number.
[0116]
Also, an operation is performed in which the server-side computer 1 does not notify the client-side computer 2 at all using TCP / IP communication or UDP / IP communication that the service corresponding port number of the server-side computer 1 has dynamically changed ( By not reporting that the service corresponding port number has changed), it becomes possible to prevent a malicious third party from eavesdropping on the dynamically changing service corresponding port number.
[0117]
As described above, since the CUG client-server type communication is operated using the service corresponding port number of the server-side computer 1 which is dynamically changed and uniquely established, even if a malicious third party performs a continuous port scan operation, The service corresponding port number of the computer 1 on the CUG server side cannot be easily found, and it is possible to give up the cracking action quickly. In addition, the amount of meaningless data propagation due to the cracking operation is reduced, and the bandwidth of the network can be used only for correct communication purposes.
[0118]
【The invention's effect】
The present invention does not use a fixed well-known port number as the listening port number of the server computer, but has a mechanism that allows only the client computer inside the CUG to know the variable server listening port number. Therefore, a server-side computer that performs private operation that can be used only by a client-side computer restricted in a client-server type communication using TCP / IP is realized, and a cracking act by a malicious third party is invalidated. This has the effect of preventing plagiarism, falsification, destruction, and the like of internal data.
[0119]
Further, the present invention provides a mechanism in which the port number of the server-side computer is dynamically changed once the CUG client-server type communication is started, and the client-side computer automatically follows the port number of the server-side computer. Therefore, even if a malicious third party searches for a port number by a cracking action such as a port scan operation, a fixed port number is not found, and the cracking action can be given up earlier. is there. As a result, the number of illegal packets for the purpose of cracking is reduced, and the amount of traffic on the network in which the corresponding server-side computer is placed is reduced, so that the bandwidth can be used for the correct purpose.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a system according to an embodiment of the present invention.
FIG. 2 is a schematic state transition diagram showing an operation from the establishment of a virtual circuit accompanying the CUG for the first time to the completion of the establishment of a virtual circuit in the present invention.
FIG. 3 is a schematic state transition diagram showing an operation from reestablishment of a virtual line during communication to completion of virtual line establishment during communication in the present invention.
FIG. 4 is an operation sequence diagram showing an operation of exchanging messages when a virtual circuit is established and released for the first time in the present invention.
FIG. 5 is an operation sequence diagram showing an operation of exchanging messages at the time of reestablishment and release of a virtual circuit during communication in the present invention.
6 is a flowchart showing the operation of each of the TCP processing units of the client computer and the server computer when a virtual connection request is issued from the application unit of the client computer of FIG. 1;
FIG. 7 is a flowchart of a subroutine showing an operation of a virtual line connection receiving process of the server-side computer of FIG. 6;
FIG. 8 is a flowchart of a subroutine showing an operation of a virtual line connection request process of the client-side computer of FIG. 6;
FIG. 9 is a flowchart illustrating an operation of a TCP processing unit of the server-side computer when a date change occurs.
FIG. 10 is a flowchart illustrating an operation of a TCP processing unit of the server-side computer 1 when a timer interrupt occurs.
FIG. 11 is a flowchart illustrating an operation of a TCP processing unit of the client computer 2 when a timer interrupt occurs.
FIG. 12 is a schematic configuration diagram illustrating an outline of a configuration example of a database of the server-side computer 1 according to the present invention.
FIG. 13 is a schematic configuration diagram illustrating an outline of a configuration example of a database of the client-side computer 2 according to the present invention.
FIG. 14 shows the contents of a file indicating an example of a service list.
[Explanation of symbols]
1 server side computer
2 Client computer
11, 21 application section
12,22 TCP processing unit
13,23 IP processing unit
14,24 database
61, 62 Internal communication path
70 Virtual circuit establishment request
71 Virtual circuit establishment response
72 Application data request
73 Application data response
900 network

Claims (14)

A method for securing security in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol,
When the client in the CUG issues a connection request for the CUG service to the server, a first specific port number different from the well-known port number is calculated using a predetermined first function, and the calculation is performed. A method for ensuring security in non-public communication, wherein the first specific port number is connected as a CUG-compatible port number of the server. When reconnecting between the server and the client, a second specification calculated using a second function configured to be a variable value based on a sequence number of service data immediately before the line is released. 2. The method for securing security in private communication according to claim 1, wherein the port number is connected as a CUG-compatible port number of the server. When reconnecting between the server and the client, if the unconnected state continues for a predetermined time, the first specific port number is connected as a CUG-compatible port number of the server. 3. The method for securing security in private communication according to claim 1 or 2, wherein: A method for securing security in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol,
The client connects to the line by using a first connection destination CUG port number calculated by using a predetermined first function at the time of a CUG line connection request to the server,
A second connection destination CUG calculated using a second function configured to be a variable value based on the sequence number of service data immediately before the line is released when the line is opened with the server. Register the port number in that line in the first database so that the server IP address of the connection release destination and the client port number of the client to be released are the keys,
When reconnecting to the server, a line connection is made using the second connection destination CUG port number registered in the first database,
The server checks whether the first connection destination CUG port number extracted from the TCP header at the time of receiving the connection request from the client is valid with the first receiving side CUG port number calculated by the first function. To connect to the line,
When releasing the line with the client, the second receiving-side CUG port number calculated using the second function is used as a key between the client IP address of the connection release destination and the client port number. Register in that row in the second database as
Checking the validity of the second connection destination CUG port number extracted from the TCP header at the time of receiving the reconnection request from the client is performed by checking the second receiving side CUG port number registered in the second database with the second reception side CUG port number. A method for ensuring security in non-public communication, characterized in that a connection is made by matching. The client must use the second connection destination CUG port number registered in the first database using the server IP address and the client port number as a key for a predetermined time without being connected. For example, delete the line using the corresponding server IP address and client port number as keys from the first database,
The server is configured to use the client IP address and the client port number as keys when the second receiving port number registered in the first database is not used for a predetermined period of time without being connected; 5. The method according to claim 4, further comprising: deleting a line using the client IP address and the client port number as keys from the second database. If the CUG port number of the other party is not registered in the first database at the time of line connection including reconnection, the client uses the first connection destination port number calculated by the first function. And the client port number calculated at random as the source client port number,
If the CUG port number of the other party is registered in the first database and if there is a registered client port number that is not currently used, the CUG port number extracted from the first database is used as the CUG port number. 2, and the client port number extracted from the first database as the destination client port number,
The CUG port number of the destination is registered in the first database, and if there is no registered client port number that is not currently used, the CUG port number extracted from the first database is used as the client port number. 6. The security ensuring method according to claim 4, wherein a client port number calculated at random and a client port number calculated at random are set as a second connection destination CUG port number. The non-transitory computer-readable storage medium according to claim 1, wherein the first function is a function configured to have a variable value based on a time synchronized between the server and the client. How to ensure security in public communications. A security assurance method in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol,
A first connection unit configured to perform a line connection by using a first connection destination CUG port number calculated using a first function predetermined at the time of a CUG line connection request to the server;
A second connection destination CUG calculated using a second function configured to be a variable value based on the sequence number of service data immediately before the line is released when the line is opened with the server. First registering means for registering a port number such that a server IP address of a connection release destination and a client port number of the client to be released are used as keys;
A first reconnection means for connecting to the line by using the second connection destination CUG port number registered in the first database when reconnecting to the server. Security assurance method for private communications. The server checks whether the first connection destination CUG port number extracted from the TCP header at the time of receiving the connection request from the client is valid with the first receiving side CUG port number calculated by the first function. Second connection means for connecting the line by
When releasing the line with the client, the second receiving-side CUG port number calculated using the second function is used as a key between the client IP address of the connection release destination and the client port number. Second registration means for registering
Checking the validity of the second connection destination CUG port number extracted from the TCP header at the time of receiving the reconnection request from the client is performed by checking the second receiving side CUG port number registered in the second database with the second reception side CUG port number. 9. The security assurance method in a non-public communication according to claim 8, further comprising a second reconnecting means for connecting the line by matching. A security assurance method in private communication in which communication is performed between a plurality of clients and a server based on a TCP / IP protocol,
The server confirms the validity of the CUG port number extracted from the TCP header at the time of receiving the connection request from the client by matching with the first receiving-side CUG port number calculated by the first function determined in advance. Second connection means for line connection;
A second receiving CUG port calculated using a second function configured to have a variable value based on a sequence number base of service data immediately before the line is released when the line is released with the client; Second registration means for registering a number such that the client IP address of the connection release destination and the client port number are used as keys;
When the validity of the CUG port number extracted from the TCP header at the time of receiving the reconnection request from the client is matched with the second receiving CUG port number registered in the second database, the line connection is established. And a second reconnecting means for performing security in private communication. The client uses the second connection destination CUG port number registered by the first registration means, using the server IP address and the client port number as keys, for a predetermined period of time without being connected. 10. The method according to claim 8, further comprising a first deletion unit that deletes a line using the server IP address and the client port number registered as keys in the first registration unit. Security assurance method for private communication. The server has not been used for more than a predetermined time while the second receiving port number registered by the second registration unit using the client IP address and the client port number as keys is not connected. 11. The method according to claim 9, further comprising a second deletion unit that deletes a line using the client IP address and the client port number registered as keys in the second registration unit. The security assurance method in the above-mentioned closed communication. The first connection means, at the time of line connection including reconnection, if there is no CUG port number to be a destination registered by the first registration means, the first connection calculated by the first function. A means for making a line connection request to the server as a client port number of a transmission source and a client port number randomly calculated as a connection destination port number,
The first connection means has a destination CUG port number registered by the first registration means at the time of line connection including reconnection, and is currently used in the registered client port numbers. If none exists, the CUG port number extracted from the first database is used as the second connection destination CUG port number, and the client port number extracted from the first registration unit is used as the transmission destination client port number. Means for making a line connection request to the server as
If there is a destination CUG port number registered by the first registration unit and there is no currently used client port number among the registered client port numbers, it is extracted from the first registration unit. Means for making a line connection request to the server using a CUG port number as the second connection destination CUG port number and a client port number calculated at random as the transmission source client port number. 10. The security ensuring method in the secret communication according to claim 9. 14. The function according to claim 8, wherein the first function is a function configured to have a variable value based on a time synchronized between the server and the client. Security assurance method for private communication of the Internet.

Images