JP2004320461A - Method, device, and program for preventing attack on network, and recording medium having program recorded therein - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique for preventing attacks using wrong packets, on servers or the like present on a network. <P>SOLUTION: The inspection result of an inspection program for checking a wrong program used for attacks on the network, which is installed in a transmission source device is acquired, and the priority of a packet sent from the transmission source device is determined on the basis of the inspection result, and a priority identifier is given to the packet sent from the transmission source device in accordance with a determination result. The packet is forwarded to a transmission destination device in accordance with the priority according to the the given priority identifier. Priorities of packets transmitted from terminals which do not have attack programs are raised by this configuration, so that the communication is preferentially conducted to invalidate attacks even when a communication path is congested with packets which are used for attacks highly probably. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a network attack prevention method and apparatus for preventing an attack using an unauthorized packet performed on a server or the like existing on a network, and a network attack prevention method used for realizing the network attack prevention method. The present invention relates to a program and a recording medium on which the program is recorded.
[0002]
Recently, a DoS attack on a server has made it difficult for other users to access the server.
[0003]
"DoS attack (Denial of Service attack: Denial of service attack)" is a method in which an attacker sends an unauthorized communication packet to a server accessible from an unspecified number of users on the Internet or the like, thereby causing the server or communication path to fail. This attack has an adverse effect such as consuming resources (processing capacity and transferable bandwidth) of the above device, and makes it difficult for other users to access the server.
[0004]
[Prior art]
DoS attacks can be broadly classified into the following three types.
[0005]
(A) By transmitting a packet in an abnormal format from the transmission source device to the server, the process of the transmission destination device and the device on the communication path may be abnormally performed, making it difficult to continue the service of the server. One (abnormal packet format transmission type DoS attack).
[0006]
(B) By transmitting a large amount of packets in a normal format to a server from a single or a small number of transmission source devices, respectively, the resources of the server and the line bandwidth on the route are consumed, and it is difficult for an authorized user to access the server. (Mass packet transmission type DoS attack).
[0007]
(C) A small number of packets in a normal format are transmitted from a large number of source devices to a server, and as a result a large amount of attack packets are transmitted to the server, thereby consuming server resources and line bandwidth on a route. And makes it difficult for authorized users to access (highly distributed DoS attack).
[0008]
Next, the related art of the countermeasure regarding (A) and the related art of the countermeasure regarding (B) will be described.
[0009]
As a countermeasure for (A), a method of improving or correcting a server or a device on a communication path by performing a system version upgrade or a correction program so as to prevent processing errors from occurring due to abnormally formatted packets. There is a method of discarding an abnormally formatted packet in a server or in a device on a communication path between a server and a transmission source device. In the latter case, the determination that the packet format is abnormal is mainly performed by pattern matching.
[0010]
As a countermeasure against (B), the amount of transmitted packets is compared for each packet transmission source, and a packet from a transmission source that transmits a larger amount of packets than other users is blocked or the transmission amount is restricted. There is a method to do it. In some cases, the source is specified by the source IP address in the packet header. However, if the IP address is forged, the source cannot be correctly specified only by the IP address. A method of embedding information for identifying the above packet transfer device in the packet header, or measuring the amount of packet transmission to the target server for each device on the path, to identify a device close to the transmission source And so on.
[0011]
As a conventional technique provided as a countermeasure against a DoS attack, there is a technique described in Non-Patent Document 1 below.
[0012]
[Non-patent document 1]
FloodGuard [April 4, 2003 search], Internet <URL: http: // www. reactivenetwork. com / products / floorguard2point1. pdf>
[0013]
[Problems to be solved by the invention]
As described above, the countermeasure relating to (A) and the countermeasure relating to (B) have been provided in the related art.
[0014]
However, as a countermeasure for (C), there has been no sufficient countermeasure in the past.
[0015]
The reason is that when an attack is performed by a large number of source devices, the amount of attack packets sent by one source device may not be different from the amount sent by a legitimate user. This is because it is difficult to specify the source, and because packets in a normal format are used for an attack, it is not possible to specify an attacking packet by pattern matching.
[0016]
As described above, in reality, there is no sufficient countermeasure against a highly distributed DoS attack. The target of the highly distributed DoS attack is the server in the normal case, but it is also conceivable that a specific client terminal is the target of the attack.
[0017]
The present invention has been made in view of such circumstances, and an object of the present invention is to provide a new network attack prevention technology that can protect a public server or the like from a highly distributed DoS attack.
[0018]
[Means for Solving the Problems]
In order to achieve this object, the network attack prevention apparatus according to the present invention transmits (1) packet transmission in order to prevent an attack using an illegal packet performed on an attack target apparatus existing on the network. Acquiring means for acquiring an inspection result of a malicious program in the source device; and (2) assigning a priority identifier corresponding to the inspection result acquired from the packet transmission source device to a packet delivered from the packet transmission source device. On the delivery route of the packet, (3) a transfer control means for performing priority transfer control on the packet in accordance with a priority identifier assigned to the packet is provided.
[0019]
When configured in this way, the assigning means may assign a priority identifier to the packet in a form that takes into account the degree of detail of the inspection.
[0020]
Further, the obtaining means establishes an encrypted communication path with the packet transmission source device to prevent the inspection result obtained from the packet transmission source device from being falsified or forged by a third party, In some cases, an inspection result is obtained from a packet transmission source device using a route.
[0021]
Also, in order to prevent the packet delivered from the source device from being falsified or forged by a third party, the packet delivered to the packet destination device is transmitted from the packet source device using this encrypted communication path. There may be a receiving means for receiving.
[0022]
Also, when transferring a packet that has been subjected to priority transfer control to a packet destination device, the priority identifier assigned to the packet is deleted in order to conceal the priority of the source device that sent the packet. In some cases, a deletion unit is provided.
[0023]
The network attack prevention method of the present invention realized by the operation of each of the above processing means can be realized by a computer program. This computer program can be provided by being recorded on a recording medium such as a semiconductor memory or provided on a network. Can be provided via
[0024]
In the network attack prevention device of the present invention configured as described above, the inspection result of the inspection program for inspecting the malicious program used for the network attack installed in the transmission source device is obtained, and based on the acquired result, The priority of the packet transmitted from the transmission source device is determined, and a priority identifier is assigned to the packet transmitted from the transmission source device according to the determination result.
[0025]
More specifically, a priority identifier is assigned so that the priority of a transmission source device that is reported to have a program likely to be used in an attack embedded therein is set to be low, and is used for the attack. A priority identifier is assigned so as to increase the priority of the transmission source device which is reported that a program with a high possibility is not embedded.
[0026]
Further, the priority (priority identifier) may be changed depending on how much detailed inspection has been performed.
[0027]
For example, when a check is performed based on the latest virus information, a higher priority identifier may be assigned than when a check is performed based on old virus information.
[0028]
Further, when a test is performed using a high-performance test program, a higher priority identifier may be assigned than when a test is performed using a low-performance test program.
[0029]
In addition, since a report from the inspection program cannot be received from a transmission source device on which the inspection program for the malicious program is not installed, a relatively low priority identifier is assigned to a packet transmitted from the transmission source device. Will be.
[0030]
When the priority identifier is assigned to the packet in this way, the transfer control unit that manages the priority transfer control transfers the packet to the destination device according to the priority according to the assigned priority identifier.
[0031]
According to this configuration, according to the network attack prevention device of the present invention, it becomes possible to protect a public server or the like from a highly distributed DoS attack.
[0032]
Specifically, an attacker of a distributed DoS attack often distributes an attack program to a large number of hosts in the form of a computer virus and embeds the attack program in order to secure a large number of attack hosts. .
[0033]
This attack program can often be detected by an inspection program such as a virus scan in the terminal. Conversely, if an attack program is not detected as a result of an inspection program such as a virus scan in a terminal, it can be said that the terminal is unlikely to be used for an attack. Therefore, by increasing the priority of the packet sent from the terminal, even if the communication path is congested with packets that are more likely to be used in the attack, the priority of the communication will prevent the attack Will be invalidated.
[0034]
Thus, according to the present invention, it becomes possible to protect a public server or the like from a highly distributed DoS attack.
[0035]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described in detail according to embodiments.
[0036]
FIG. 1 shows an embodiment of a main apparatus 1 for realizing the present invention.
[0037]
As shown in this figure, a main device 1 for realizing the present invention is provided with a priority control transfer unit 10 for transferring a packet at the center, and at a connection boundary between the priority control transfer unit 10 and the outside. , The inspection units 11-1 to 11-6 and the priority identifier assigning units 12-1 to 12-12, or only the priority identifier assigning units 12-1 to 12-12.
[0038]
The inspection unit 11-i and the priority identifier assignment unit 12-i are connected by at least one channel. One of the channels between the inspection unit 11-i and the priority identifier assigning unit 12-i is for transmitting an uninspected packet (a packet transmitted from the uninspected transmission source device 3-i). And is referred to as an “untested packet channel”. Channels other than the uninspected packet channel are established for each transmission source device 3-i that has passed the inspection unit 11-i.
[0039]
Each channel is assigned a priority. The priority for the packet transmitted from the transmission source device 3-i for which the inspection has not been performed is assigned to the channel for the uninspected packet.
[0040]
The priority identifier assigning unit 12-i that is not connected to the inspection unit 11-i is connected to the outside only by the channel for the uninspected packet.
[0041]
The main device 1 having the above configuration is installed between the transmission destination device 2 and the transmission source devices 3-1 to 3-7, and protects the transmission destination device 2 from a highly distributed DoS attack.
[0042]
A plurality of devices that can be a transmission source and a transmission destination may be connected to the same inspection unit 11-i or the same priority identifier assignment unit 12-i. Further, a connection in which the transmission source device 3-i sends a packet to the main device 1 via the external networks 4-1 to 4-3 is also possible.
[0043]
Note that the main device 1 in the present invention does not necessarily have to be integrally realized as one device, but may be realized by a plurality of device elements arranged in a distributed manner.
[0044]
Hereinafter, how each component in FIG. 1 functions will be described with reference to FIG. 2 based on the flow of a packet.
[0045]
Here, in FIG. 1, the packet transmitted by the transmission source device 3-i is described as “transmission source device 3-i → inspection unit 11-i / priority identifier assigning unit 12-i → priority control transfer unit 10 → priority identifier assignment. It is assumed that the data is delivered to the destination device 2 through a route of “part 12-1 → destination device 2”.
[0046]
First, a packet is transmitted from the transmission source device 3-i (step 201). This packet is delivered to the destination device 2 via the main device 1 of the present invention. At this time, the packet is sent to the inspection unit 11-i of the main device 1 and the priority identifier assigning unit of the main device 1. There are two cases where the message is sent directly to 12-i (step 202). In the former case, the packet is subjected to the processing of the inspection unit 11-i (step 203).
[0047]
In the inspection unit 11-i, the processing shown in FIG. 3 is performed.
[0048]
Here, some of the packets sent to the inspection unit 11-i are for establishing a secure communication path between the inspection unit 11-i and the transmission source device 3-i. This secure communication path is established in order to guarantee that the packet is transmitted from the transmission source device 3-i. The transmission source device 3-i is connected to the inspection unit 11-i. Use this secure channel to prevent forgery of packets between. The communication path is established by using an encryption communication technique such as IPsec. When there is a low possibility that a packet is forged by a third party, such as when the transmission source device 3-i and the main device 1 are connected by a dial-up connection, the encryption communication path is not always necessary.
[0049]
If the processing of the inspection unit 11-i is described with reference to FIG. 3, when the inspection unit 11-i starts processing by receiving a packet (step 301), it receives a packet for establishing a secure communication path. Is determined (step 302). If it is determined in this determination that a packet for establishing a secure communication path has been received, the secure communication path with the transmission source device 3-i is determined. Is established (step 303).
[0050]
Then, the result of the malicious program check (the check result of the presence or absence of the malicious program) in the source device 3-i that has established the route is received (step 304), and the priority of the source device 3-i is determined according to the check result. Is determined (step 305). Further, an individual channel is established with the priority identifier assigning unit 12-i for each route (step 306), and the previously determined priority is assigned to this channel (step 307). Thereafter, the processing of the inspection unit 11-i ends (Step 313).
[0051]
On the other hand, if it is determined in step 302 that the received packet is not for establishing a secure communication path, then it is determined whether the packet has been received through the already established secure communication path. (Step 308). In this determination, when it is determined that the packet has been received through the already established secure communication path, the packet is sent to the priority identifier assigning unit 12-i through the channel prepared for the path (step 309). Thereafter, the processing of the inspection unit 11-i ends (Step 313).
[0052]
On the other hand, if it is determined in step 308 that the received packet has been sent without passing through the secure communication channel, then the received packet is sent from the priority identifier assigning unit 12-i. Is determined (step 301). In this determination, when it is determined that the received packet is not the one transmitted from the priority identifier providing unit 12-i, the packet is transmitted to the priority identifier providing unit 12-i through the channel for the unchecked packet (step 312). ). Thereafter, the processing of the inspection unit 11-i ends (step 314).
[0053]
On the other hand, if it is determined in step 310 that the received packet has been sent from the priority identifier assigning unit 12-i, the packet is transmitted to the path toward the destination device 2 (step 311). Thereafter, the processing of the inspection unit 11-i ends (step 314).
[0054]
Returning to the description of the processing in FIG. 2 again.
[0055]
When the processing of the inspection unit 11-i is completed (step 203) and the destination of the packet is addressed to the inspection unit 11-i (step 204), the packet is determined to have arrived at the transmission destination. The processing along the flow of the packet ends (step 210).
[0056]
On the other hand, if the destination of the packet is not addressed to the checking unit 11-i, the packet is sent to the priority identifier assigning unit via the channel established between the checking unit 11-i and the priority identifier assigning unit 12-i. It arrives at 12-i (step 205). Also, when the transmission source device 3-i is connected to the main device 1 without passing through the inspection unit 11-i (step 202), the packet is transmitted through the channel connecting the outside and the priority identifier assignment unit 12-i. It directly arrives at the priority identifier assigning unit 12-i (step 205).
[0057]
In the priority identifier assigning unit 12-i, the processing shown in FIG. 4 is performed.
[0058]
Describing the process of the priority identifier assigning unit 12-i with reference to FIG. 4, when the priority identifier assigning unit 12-i starts processing by receiving a packet (step 401), the priority packet is transferred to the priority control transfer unit. It is determined whether or not the data has been sent from the server 10 (step 402).
[0059]
In this determination, when it is determined that a packet is received not via the priority control transfer unit 10 but via the inspection unit 11-i or a channel connected to the outside, the input packet is A priority identifier indicating the priority transmitted when establishing the channel through which the packet has passed is assigned (step 403), and the packet is sent to the priority control transfer unit 10 (step 404). Thereafter, the priority identifier assigning unit 10 ends the processing (Step 406).
[0060]
On the other hand, if it is determined in step 402 that the input packet has been sent from the priority control transfer unit 10, the priority identifier attached to the input packet is deleted, and then the destination The packet is transmitted through the channel directed to the device 2 (step 405). Thereafter, the priority identifier assigning unit 10 ends the processing (Step 406).
[0061]
Returning to the description of the processing in FIG. 2 again.
[0062]
When the processing (step 205) of the priority identifier assigning unit 12-i ends, the packet is sent from the priority identifier assigning unit 12-i to the priority control transfer unit 10, where the processing of the priority control transfer unit 10 is performed (step 205). 206).
[0063]
Upon receiving the packet, the priority control transfer unit 10 transfers the packet internally to the channel connected to the destination device 2 indicated in the packet, as shown in FIG. At that time, the transfer is preferentially performed according to the priority identifier assigned to the packet. That is, transfer control is performed such that packets with higher priority are transferred preferentially.
[0064]
In this way, according to the processing of the priority control transfer unit 10, the packet is sent to the nearest priority identifier assigning unit 12-1 (in FIG. 1, as the nearest priority identifier assigning unit of the destination device 2 in FIG. 1). (See section 2-1), processing by the priority identifier assigning section 12-1 is performed (step 207).
[0065]
In this process, if the destination device 2 is connected to the main device 1 without passing through the inspection unit 11-i (step 208), the packet is transmitted via the channel connected to the destination device 2 to the main device 1. , And in response to this, the packet leaves the main device 1 and is delivered to the destination device 2 and arrives at the destination device 2 (step 210).
[0066]
On the other hand, when the transmission destination device 2 is connected to the main device 1 via the inspection unit 11-i (step 208), the processing of the inspection unit 11-i is performed (step 209), and the If there is a secure communication path connected to the destination apparatus 2, the packet is transmitted via the secure communication path. If there is no secure communication path, the packet is connected to the destination apparatus 2. (Step 311 in FIG. 3). Thereafter, the packet arrives at the destination device 2 (step 210).
[0067]
Hereinafter, specific examples of the components of the present invention will be described.
[0068]
The priority identifier is not limited to adopting a new packet format for the priority identifier, but may be an existing packet identification method, that is, a TOS field (Type Of Service field) in an IP header, a DS field (Differentiated Service field), IEEE 802.1Q labels, MPLS (Multi Protocol Label Switching) labels, and the like can be used.
[0069]
As the priority control transfer unit 10, a device that performs priority control according to the content of the priority identifier is used. For example, a device that performs priority control according to the value of the TOS field is used.
[0070]
The priority control function of the priority control transfer unit 10 not only performs priority control according to the value of the priority identifier, but also performs the first packet (such as a TCP SYN packet) for establishing a communication connection. It is desirable to introduce a type that can specify the maximum bandwidth and perform priority control according to the priority identifier within that bandwidth, but it is preferable to introduce priority control according to the contents of the priority identifier without distinguishing the type of packet. It is permissible to introduce a device for performing this.
[0071]
The priority control transfer unit 10 can use the backbone of the IP network in which the priority control device is installed. This may be provided by one ISP or carrier, but may be provided by a plurality of ISPs or carriers. Forgery of the priority identifier by a third party, for example, by directly or through a VPN or the like. Need to be prevented.
[0072]
Although the present invention has been described according to the illustrated embodiment, the present invention is not limited to this. For example, in the embodiment, the present invention has been described with a specific example of preventing a DoS attack performed on a public server, but the present invention is not limited to such a case. For example, the present invention can be applied as it is even when preventing a DoS attack performed on a specific user terminal.
[0073]
【The invention's effect】
With the explosion of Internet users, in recent years, there has been an active movement to provide services on the Internet where communication quality is important, such as online securities trading services and online banking services.
[0074]
However, on the Internet, it is easy to disguise the source of a packet, and it is possible to transmit a large amount of packets at low cost. There is a threat of DoS attack that sends out. Therefore, how to prevent this DoS attack is an issue.
[0075]
As described above, various methods for preventing DoS attacks have been proposed, but a small number of packets in a normal format are sent from a large number of transmission apparatuses to a server, and as a result, a large number of attack packets are transmitted. Sufficient countermeasures have not been provided for highly distributed DoS attacks that send to servers.
[0076]
The present invention provides a countermeasure against such a highly distributed DoS attack that was difficult to prevent by the conventional method.
[0077]
In particular, the present invention is directed to a highly distributed type in which an attacker embeds a malicious program in a large number of devices in advance and sends a large amount of packets to a target server using the malicious program. This is a DoS attack, and many highly distributed DoS attacks correspond to this. Therefore, according to the present invention, it is possible to take effective measures against a highly distributed DoS attack.
[0078]
According to the present invention, even when an attacker sends a large number of packets to a target server using a large number of malicious programs, it is necessary to use a device that is guaranteed by the malicious program detection system to have no malicious program installed. Packet is preferentially delivered by the present invention, so that it is not affected by an attack.
[0079]
The measures according to the present invention are also effective against a large packet transmission type DoS attack using an unauthorized program embedded in an attack source device.
[0080]
The device equipped with the present invention is introduced by, for example, an ISP (Internet Service Provider), and the ISP provides a server operator and a user accessing the server with an Internet connection service capable of preventing a highly distributed DoS attack. It is possible to do.
[0081]
The server connected to the device equipped with the present invention, while being open to the public on the Internet, protects the user connected to the device equipped with the present invention from the effects of the highly distributed DoS attack using the malicious program. Can be eliminated.
[Brief description of the drawings]
FIG. 1 is a diagram showing an embodiment of a main device for realizing the present invention.
FIG. 2 is a diagram showing a flow of processing on a packet.
FIG. 3 is a diagram showing processing of an inspection unit.
FIG. 4 is a diagram illustrating processing of a priority identifier assigning unit.
FIG. 5 is a diagram illustrating processing of a priority control transfer unit.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Main apparatus 2 Destination apparatus 3 Source apparatus 4 External network 10 Priority control transfer part 11 Inspection part 12 Priority identifier provision part

Claims (12)

What is claimed is: 1. A network attack prevention method for preventing an attack using an illegal packet performed on an attack target device existing on a network,
Obtaining a check result for a malicious program in a packet transmission source device;
Assigning a priority identifier corresponding to the inspection result obtained from the packet transmission source device to a packet delivered from the packet transmission source device;
Performing, on a packet delivery route, priority transfer control for the packet in accordance with the priority identifier given to the packet,
Characteristic network attack prevention method. The method for preventing a network attack according to claim 1,
In the assigning step, assigning a priority identifier to the packet taking into account the degree of detail of the inspection,
Characteristic network attack prevention method. The method for preventing a network attack according to claim 1 or 2,
In the obtaining step, establishing an encrypted communication path with the packet transmission source apparatus, and using the encrypted communication path to obtain the inspection result from the packet transmission source apparatus,
Characteristic network attack prevention method. The network attack prevention method according to claim 3,
Using the encrypted communication path, receiving a packet delivered to the packet destination device from the packet source device,
Characteristic network attack prevention method. The method for preventing a network attack according to any one of claims 1 to 4,
Comprising a step of deleting a priority identifier assigned to the packet subjected to the priority transfer control delivered to the packet destination device,
Characteristic network attack prevention method. A network attack prevention device for preventing an attack using an unauthorized packet performed on an attack target device existing on a network,
Means for obtaining an inspection result for a malicious program in a packet transmission source device;
Means for assigning a priority identifier corresponding to the inspection result obtained from the packet transmission source device to a packet delivered from the packet transmission source device,
Means for performing priority transfer control on the packet delivery route in accordance with the priority identifier given to the packet,
Characteristic network attack prevention device. The network attack prevention device according to claim 6,
The assigning means assigns a priority identifier to the packet in a form considering the degree of detail of the inspection,
Characteristic network attack prevention device. The network attack prevention device according to claim 6 or 7,
The acquiring means establishes an encrypted communication path with the packet transmission source apparatus, and acquires the inspection result from the packet transmission source apparatus using the encrypted communication path.
Characteristic network attack prevention device. The network attack prevention device according to claim 8,
Means for receiving, from the packet transmission source device, a packet delivered to the packet transmission destination device using the encrypted communication path,
Characteristic network attack prevention device. The network attack prevention device according to any one of claims 6 to 9,
Comprising a means for deleting a priority identifier assigned to a packet subjected to the priority transfer control delivered to a packet destination device,
Characteristic network attack prevention device. A network attack prevention program for causing a computer to execute a process used to implement the network attack prevention method according to any one of claims 1 to 5. A recording medium recording a network attack prevention program for causing a computer to execute a process used for implementing the network attack prevention method according to claim 1.

Images