JP2005031720A - High multiple user housing firewall device corresponding to high speed retrieval - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a high multiple user housing firewall device corresponding to high speed retrieval, capable of realizing the high speed retrieval of a filtering rule having the same value as a filtering ID applied to a packet. <P>SOLUTION: In the high multiple user housing firewall device corresponding to high speed retrieval, the rule itself and address information showing a position where a filtering rule to be retrieved next is stored, are described in each filtering rule configuring each filtering policy of a filtering table, and rule retrieval is executed to the filtering rule on the basis of a filtering ID applied to a packet. When the rule is matched with a rule condition, the rule retrieval is ended, and the packet applied with the filtering ID is made to pass or abandoned according to an operation mentioned in the rule, and when the rule is not matched with the rule condition, the rule retrieval is executed to the filtering rule stored at the position shown by the address information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a highly multi-user accommodating firewall apparatus, and more particularly to a firewall apparatus for protecting users connected to the Internet.
[0002]
[Prior art]
As the number of constantly connected users increases and the need for security increases, it is required to provide a security service that solves the lack of skills at a low cost to users with insufficient security knowledge.
As a method of providing a firewall device that solves this problem, a method of deploying a firewall device on the network side can be considered. That is, this method is expected to be economical due to the aggregation of accommodated users and to reduce user operations due to outsourcing.
However, it is necessary to provide a security policy for each user, and the firewall device according to the present method requires an architecture for constructing a virtual firewall for each user in one physical firewall device.
Allocation between a user terminal or server and a virtual firewall is usually realized by associating a user ID (user IP address) with a virtual firewall ID.
When the virtual firewall is applied to the always-on service, the user IP address is assigned for the first time when a connection between the user terminal and the network is established, specifically, when a PPP (Point to Point Protocol) session is established. In addition, since the user IP address is generally variable, the correspondence between the user IP address and the virtual firewall ID cannot be registered in advance.
[0003]
As a conventional technique for dynamically associating a user IP address and a virtual firewall ID in accordance with such PPP establishment, for example, there is one described in Patent Document 1 below.
The prior art described in the following Patent Document 1 will be described below with reference to FIGS. 3 and 4.
As shown in FIG. 3, the firewall apparatus 100 includes virtual firewalls (102, 103,..., 104) for each user.
In the distribution management table 101, user names and virtual firewall IDs that can be set in advance are registered.
Here, the security policy defined by the user #a is stored in the virtual firewall 102, and the security policy defined by the user #b is stored in the virtual firewall 103. The distribution management table 101 stores the user name #a and the virtual firewall ID (102). ), The association between the user name #b and the virtual firewall ID (103) is registered.
However, since the user IP address serving as the user ID of each user terminal has not been determined, it cannot be registered at this point.
Unless the user IP address is registered in the distribution management table 101, packets from each user cannot be distributed to the respective virtual firewalls.
[0004]
Hereinafter, the operation of the firewall device shown in FIG. 3 will be described with reference to FIG. FIG. 4 is a sequence diagram showing the operation of the firewall device shown in FIG.
First, as a network connection request from the user terminal 111, LCP (Link Control Protocol) information is exchanged between the user terminal 111 and the firewall 100 (139 in FIG. 4).
When receiving the authentication information for network connection from the user terminal (140 in FIG. 4), the firewall apparatus 100 holds the user name described in the authentication information (processing point 150 in FIG. 4).
Then, the authentication information (user name and password) is notified to the RADIUS server 130 as the authentication server (141 in FIG. 4).
When authenticated by the RADIUS server 130 and receiving the response (142 in FIG. 4), the firewall apparatus 100 holds the user IP address to be assigned to the user terminal described in the response.
Then, this user IP address is registered in the distribution management table 101 using the user name as a search key (the processing point 151 in FIG. 4 and the state of the distribution management table 101-2 in FIG. 4).
[0005]
After the connection between the user terminal 111 and the network is established, the distribution management table 101 is searched for the packet 121 transmitted from the user terminal 111 using the transmission source IP address as a search key, and the transmission source IP address The associated virtual firewall ID is extracted, and the packet 121 is distributed to the virtual firewall 102 specified by the virtual firewall ID (processing point 152 in FIG. 4).
Further, the distribution management table 101 is searched for the packet 122 transmitted from the communication partner terminal 113 of the user terminal 111 using the destination IP address as a search key, and the virtual firewall ID associated with the destination IP address is obtained. The packet 122 is extracted and distributed to the virtual firewall 102 specified by the virtual firewall ID (processing point 153 in FIG. 4).
With the above operation, the user IP address and the virtual firewall ID are dynamically used by using the authentication information for network connection from the user terminal for the communication mode in which the user IP address and the virtual firewall ID cannot be associated in advance. And filtering rules according to the security policy defined by the user can be applied to packets transmitted or received by the user terminal.
[0006]
The architecture for constructing a virtual firewall for each user in one physical firewall device as described above is mainly applied to a data center at first, and the number of accommodated users is assumed to be several hundred to several thousand. ing.
Currently, many of the highly reliable virtual firewall devices that have been implemented as devices and have been introduced as services have been developed for data centers, and the actual number of users that can be accommodated is, as described above, hundreds to thousands. ing.
On the other hand, in the case of the always-on service, the number of accommodated users is far greater than in the case of application to the data center. As an assumed scale, the number of accommodated users is on the order of tens of thousands to hundreds of thousands.
Although the scale of the number of accommodated users is different, when developing a virtual firewall device for always-on services, development and additional development based on the virtual firewall device for data centers is used from the viewpoint of development efficiency and utilization of existing technologies. This technique is extremely effective.
Therefore, the problem for providing a virtual firewall device for always-on services is to improve the number of multiplexed users.
In addition, since the always-on service has a large number of multiplexed users, when ensuring serviceability that provides an independent security policy for each user, the total number of filtering rules is also proportional to the number of multiplexed users.
However, in fact, the filtering rules of each user include rules that are common to many users, and therefore, when viewed from the viewpoint of the entire firewall apparatus, the rules overlap and are inefficient. As a result, the amount of filtering table increases.
[0007]
As described above, in order to develop a virtual firewall device for always-on services, improvement of the number of multiplexed users and efficiency of the filtering table are problems.
As a prior art for solving this problem, for example, there is one described in Patent Document 2 below.
The prior art described in Patent Document 2 below will be described below with reference to FIGS. 2, 5, 6, and 7.
In this conventional technique, a filtering ID is introduced, and a filtering policy for each user is identified by the filtering ID.
In FIG. 2, the firewall apparatus 300 includes a plurality of virtual firewalls (302, 303,..., 304) as in the above-described conventional technology.
In the distribution management table 301, in addition to the user name and virtual firewall ID managed in the virtual firewall technology described in FIG. 3, a filtering ID is registered as a presettable parameter.
Further, as shown in FIG. 5, each virtual firewall stores a filtering table for each filtering ID, and according to the distribution management table 301 described above, the security policy of which filtering table in each virtual firewall is determined by each user. It is decided whether to apply.
[0008]
Here, the security policy defined by user #a and user #b is stored in the virtual firewall 302, the security policy defined by user #d is stored in the virtual firewall 303, and the user #a is stored in the virtual firewall 302. The security policy is stored in the filtering table 561 with filtering ID = α, the user #b is in the filtering table 562 with filtering ID = β, and the user #d is in the filtering table 563 with filtering ID = γ in the virtual firewall 303. Are listed.
Therefore, the distribution management table 301 includes the correspondence between the user name #a, the virtual firewall ID 302 and the filtering ID α, the correspondence between the user name #b, the virtual firewall ID 302 and the filtering ID β, the user name #d, the virtual firewall ID 303 and the filtering ID γ. Correspondence is registered.
However, since the user IP address serving as the user ID of each user terminal has not been determined, it cannot be registered at this point.
Unless the user IP address is registered in the distribution management table 101, packets from each user cannot be distributed to the respective virtual firewalls.
[0009]
The operation from receiving authentication information for network connection from the user terminal to registering the user IP address assigned to the user terminal in the distribution management table 301 is the same as the technique shown in FIG.
After the connection between the user terminal and the network is established, in FIG. 2, the distribution management table 301 is searched for the packet 321 transmitted from the user terminal 311 using the transmission source IP address as a search key, and the transmission source IP address Are extracted, and the packet 321 is distributed to the virtual firewall (302 in FIGS. 2 and 5) having the virtual firewall ID and the filtering ID (FIG. 2, FIG. 2). 5).
As shown in FIG. 5, the packet 322 to which the filtering ID is assigned is passed or discarded in accordance with the filtering policy described in the filtering table specified by the filtering ID in the virtual firewall.
For the packet 323 transmitted from the communication partner terminal 313 of the user terminal, in the case of the packet 321 transmitted from the user terminal 311 except that the search key used for searching the distribution management table 301 is the destination user ID. This is the same as the process.
As described above, by introducing the filtering ID, a plurality of independent filtering policies can be managed in each virtual firewall, and the number of multiplexed users can be improved.
In addition, since the search range of the packet for each user is limited to a table that matches the value of the assigned filtering ID, the search processing time is prevented from becoming unnecessarily long.
[0010]
Next, a prior art method for avoiding an increase in the amount of filtering tables and improving efficiency will be described below.
This method is realized by further dividing the above-mentioned filtering ID into an individual filtering ID and a common filtering ID.
Accordingly, the filtering policy for each user is described in the individual filtering table, and the filtering policy that can be shared by a plurality of users is described in the common filtering table.
As shown in FIG. 6, the distribution management table 601 manages user names, virtual firewall IDs, individual filtering IDs, and common filtering IDs.
After the connection between the user terminal and the network is established, as shown in FIG. 2, the distribution management table 601 is searched for the packet 321 transmitted from the user terminal 311 using the transmission source IP address as a search key. A virtual firewall ID, an individual filtering ID, and a common filtering ID associated with the transmission source IP address are extracted, and the packet 321 is distributed to the virtual firewall (302 in FIG. 2) having the virtual firewall ID. A filtering ID is assigned.
[0011]
As shown in FIG. 7, the packet 322 to which the individual filtering ID and the common filtering ID are assigned follows the filtering policy described in the individual filtering table specified by the individual filtering ID (661 in FIG. 7) in the virtual firewall. Passing or discarding is performed.
If there is no rule to be applied to the filtering policy described in the individual filtering table, the packet 322 is then filtered according to the common filtering table identified by the common filtering ID (571 in FIG. 7). Passing or discarding is performed according to the policy.
For the packet 323 transmitted from the communication partner terminal 313 of the user terminal 311, the search key used for searching the distribution management table 601 is the destination user ID, except that the packet 321 transmitted from the user terminal 311 This is the same as the processing in the case.
As described above, in this method, the filtering policy that can be shared by a plurality of users is described in the common filtering table.
So, for example, if 10 users are using two same filtering rules, if this method is not used, a total of 20 rules are listed in the filtering table, whereas according to this method, 2 rules Only need to be described in the filtering table. That is, filtering policy management becomes efficient by introducing a common filtering ID and a common filtering table.
[0012]
As prior art documents related to the invention of the present application, there are the following.
[Patent Document 1]
Japanese Patent Application No. 2003-027828
"Firewall device for dynamic user identifier"
[Patent Document 2]
Japanese Patent Application No. 2003-045222
"High multi-user firewall system"
[0013]
[Problems to be solved by the invention]
As described above, in the prior art, the packet is passed or discarded according to the filtering policy described in the filtering table specified by the filtering ID. That is, in the virtual firewall, it is necessary to search for a filtering rule having this filtering ID using the filtering ID assigned to the packet as a search key.
This search process is usually performed by a binary search method or the like in order to find a filtering rule with a perfect match between the filtering ID given to the packet and the filtering ID described in the filtering table.
Further, the binary search method is usually used for the process of comparing the packet header information and the information described in the filtering rule after finding the filtering rule.
Further, if the found filtering rule does not match the condition, a search process using the filtering ID as a search key is similarly performed to search for the next filtering rule, and the filtering condition matches or the filtering ID is changed. The above-described process is repeated until all the filtering rules that have are searched.
[0014]
For this reason, the binary search method is used for both (1) the search for the filtering rule with the matching filtering ID and (2) the comparison process between the information in the packet header and the information described in the filtering rule. May decrease the search processing speed.
Since the process (2) is information comparison, the alternative process of the binary search method is difficult. Therefore, speeding up the process (1) becomes an issue, and improvement of the process is expected.
The present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to realize a high-speed search for a filtering rule having the same value as the filtering ID assigned to the packet. An object of the present invention is to provide a high-multiple user accommodation firewall device that supports high-speed search.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.
[0015]
[Means for Solving the Problems]
Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
In order to solve the above-mentioned problem, in the present invention, as information described in each filtering rule constituting the filtering policy of the filtering table, (1) a rule describing packet header information to be compared and operation (passing or discarding) In addition to itself, (2) a memory address for storing a rule to be searched next is introduced.
According to the present invention, when the packet to be filtered does not match the condition with a certain filtering rule, the next filtering rule can be directly found by the described memory address. Searching for matching filtering rules is significantly faster than the prior art.
[0016]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.
[Embodiment 1]
FIG. 1 is a diagram showing a configuration of a filtering rule according to Embodiment 1 of the present invention.
FIG. 2 is a block diagram showing a schematic configuration of the high-speed search-capable high-multiple user accommodation firewall apparatus according to the present embodiment, and FIG. 5 is a concept of a filtering table in the virtual firewall applied in the present embodiment. FIG. 2 and 5 are also used in the prior art.
In this embodiment, the network connection method from the user is PPP (Point to Point Protocol), and the authentication communication is RADIUS.
The firewall device 300 includes a plurality of virtual firewalls (302, 303,..., 304).
Furthermore, as shown in FIG. 5, each virtual firewall (302, 303) has a plurality of filtering tables (561, 562, 563) specified by the filtering ID, and each filtering table (561, 562). , 563) describes an independent filtering policy for each user.
[0017]
In the present embodiment, the security policy determined by the user #a and the user #b is stored in the virtual firewall 302, and the security policy determined by the user #d is stored in the virtual firewall 303.
Further, the user #a is in the virtual firewall 302, the filtering ID is α in the filtering table 561, the user #b is in the filtering table 562 in which the filtering ID is β, and the user #d is in the virtual firewall 303, the filtering ID Each security policy is described in the filtering table 563 of γ.
Here, the reason why the user #a and the user #b are accommodated in the same virtual firewall 302 is that, for example, the virtual firewall is constructed for each Internet provider, and the user #a and the user #b belong to the same Internet provider. Reasons such as cases may be mentioned.
However, the filtering tables (561, 562, 563) shown in FIG. 5 are conceptual, and the actual filtering table has a configuration as shown in FIG.
[0018]
Each filtering rule (11, 12, 21, 22, 23,...) Has rules (rules 1, 2, 3, 4, 5,...) Describing packet header information to be compared and operation (pass or discard). And a next rule memory address (address information) representing a memory address where a filtering rule to be searched next is stored.
The filtering head rule management table 31 manages the correspondence between the filtering ID and the memory address where the head filtering rule of each filtering table is stored.
Further, the next rule memory address column is not described (NULL in FIG. 1) for the last filtering rule of each filtering table, thereby identifying that this filtering rule is the last filtering rule.
To summarize the above description, for example, the filtering table 561 with the filtering ID α in FIG. 5 is the row in which the filtering ID (α) of the filtering head rule management table 31 is managed, the filtering rule 11, and the filtering rule 12. The filtering table 562 whose filtering ID is β is composed of a row in which the filtering ID (β) of the filtering head rule management table 31 is managed, the filtering rule 21, the filtering rule 22, and the filtering rule 23. Will be.
[0019]
FIG. 8 is a sequence diagram illustrating the operation of the firewall device according to the present embodiment. Hereinafter, the operation of the firewall device of the present embodiment will be described with reference to FIG.
In the distribution management table 301, user names, virtual firewall IDs, and filtering IDs that can be set in advance are registered.
That is, in the distribution management table 301, user name #a, virtual firewall ID (302) and filtering ID (α) are associated, and user name #b, virtual firewall ID (302) and filtering ID (β) are associated. , The association of the user name #d, the virtual firewall ID (303), and the filtering ID (γ) is registered.
However, since the user IP address serving as the user ID of each user terminal has not been determined, it cannot be registered at this time (the state of the distribution management table 301-1 shown in FIG. 8).
Unless the user IP address is registered in the distribution management table 301, packets from each user cannot be distributed to the respective virtual firewalls and filtering IDs cannot be assigned.
[0020]
In the present embodiment, it is assumed that the terminal 311 of the user #a is connected to the Internet 310 and then performs IP communication with the connection partner terminal 313.
First, as a network connection request from the user terminal 311, LCP (Link Control Protocol) information is exchanged between the user terminal 311 and the firewall device 300 (839 in FIG. 8).
By the exchange of authentication information performed thereafter (840 in FIG. 8), the firewall apparatus 300 extracts the user name #a transmitted from the user terminal 311 and holds the user name #a (processing point 850 in FIG. 8). .
Then, the authentication information (user name and password) is notified to the RADIUS server 330 (841 in FIG. 8).
When authenticated by the RADIUS server 330 and receiving the response (842 in FIG. 8), the firewall device 300 holds the user IP address to be assigned to the user terminal described in the response 842. This user IP address is changed to [a. a. a. a].
Then, using the user name #a as a search key, the user IP address [a. a. a. a] is registered (processing point 851 in FIG. 8, state of distribution management table 301-2 in FIG. 8).
[0021]
At the same time, the firewall apparatus 300 exchanges NCP (Network Control Protocol) information between the user terminal 311 and the firewall apparatus 300 (843 in FIG. 8), and the user IP address [a. a. a. a] to the user terminal 311, and the user terminal 311 has its own user IP address [a. a. a. a].
After the NCP ends, a PPP connection is established between the user terminal and the network.
After that, when the firewall apparatus 300 receives a packet 321 transmitted from the user terminal 311 to the connection partner terminal 313, it is described as the transmission source IP address [a. a. a. a] as a search key, the distribution management table 301-2 is searched, and [a. a. a. a] is extracted, the virtual firewall ID (ID = 302) and the filtering ID (ID = α) are extracted, the packet 321 is distributed to the virtual firewall 302, and the α filtering ID is assigned to the packet 321. (Processing point 852 in FIG. 8).
As shown in FIG. 5, the packet 322 to which the filtering ID is assigned follows the filtering rule according to the security policy of the user #a described in the filtering table 561 whose filtering ID is α in the distributed virtual firewall 302. Pass-through or disposal treatment is applied.
[0022]
As described above, the filtering table 561 having the filtering ID α is actually configured as shown in FIG.
Therefore, actually, when the packet 322 to which the filtering ID (α) is given arrives in the virtual firewall 302, first, from the filtering head rule management table 31, the head rule memory address ( pppp) is extracted.
Then, the information described in rule 1 described in the memory area of the extracted memory address pppp is compared with the information in the packet header.
As a result of the comparison, when the packet header information matches the condition of rule 1, the packet 322 is passed or discarded according to the operation described in rule 1.
On the other hand, if the packet header information does not match the conditions of rule 1 as a result of comparison, the memory address described in the next rule memory address of rule 1 is referred to, and the rule described in the memory area of the referenced memory address pppa 2 is compared with the information in the packet header.
As a result of the comparison, when the packet header information matches the condition of rule 2, the packet 322 is passed or discarded according to the operation described in rule 2.
[0023]
On the other hand, as a result of the comparison, if the packet header information does not match the condition of rule 2, the next rule memory address of rule 2 is referred to, but since there is no description (NULL), rule 2 is the final rule of filtering table 561 And processing when the condition does not match any filtering rule. In the case of a firewall, discarding is common.
When the firewall apparatus 300 receives a packet 323 transmitted from the communication partner terminal 313 to the user terminal 311, it is described as the destination IP address [a. a. a. a] as a search key, the distribution management table (301-2 in FIG. 8) is searched, and [a. a. a. a], the virtual firewall ID (ID = 302) and the filtering ID (ID = α) are extracted, the packet 323 is distributed to the virtual firewall 302, and the α filtering ID is assigned to the packet 323. (Processing point 853 in FIG. 3).
The packet 324 to which the filtering ID is assigned is passed or discarded in accordance with the filtering rule according to the security policy of the user #a described in the filtering table 561 whose filtering ID is α in the distributed virtual firewall 302. The
[0024]
Similar to the packet 322 transmitted from the user terminal 311 to the connection partner terminal 313, the packet is actually written in the process of extracting the head rule memory address from the filtering head rule management table 31 and the memory area of the extracted memory address. Comparison processing with the rule is performed.
Even when the terminal 312 of the user #b is connected to the Internet 310 and performs IP communication with the connection partner terminal 313, packets transmitted and received by the terminal 312 are distributed to the virtual firewall 302 by the same procedure, and then filtered. Passing or discarding processing is applied according to the filtering rule according to the security policy of user #b described in table 562.
As described above, in the present embodiment, the next rule to be searched can be found directly from the memory address, so that the search for the next rule can be speeded up.
[0025]
[Embodiment 2]
The high-speed search-capable high-multiple user accommodation firewall apparatus according to the second embodiment of the present invention is different from the firewall apparatus according to the first embodiment described above in that it does not include a virtual firewall.
Hereinafter, the firewall device of the present embodiment will be described focusing on differences from the firewall device of the first embodiment.
In this embodiment, the network connection method from the user is PPP, and the authentication communication is RADIUS.
FIG. 9 is a block diagram showing a schematic configuration of the high-speed search-capable high-multiple user accommodation firewall apparatus according to the second embodiment of the present invention.
As shown in FIG. 9, the firewall device 300 according to the present embodiment has a plurality of filtering tables (561, 562) specified by the filtering ID, and each filtering table has an independent filtering policy for each user. be written.
In this embodiment, the security policy is described in the filtering table 561 whose filtering ID is α for the user #a, and in the filtering table 562 whose filtering ID is β for the user #b.
FIG. 10 is a sequence diagram illustrating the operation of the firewall device according to the present embodiment. Hereinafter, the operation of the firewall device of the present embodiment will be described with reference to FIG.
[0026]
In the distribution management table 301, user names and filtering IDs that can be set in advance are registered.
That is, in the distribution management table 301, the association between the user name #a and the filtering ID α and the association between the user name #b and the filtering ID β are registered.
However, since the user IP address serving as the user ID of each user terminal has not been determined, it cannot be registered at this time (the state of the distribution management table 301-1 shown in FIG. 10).
Unless the user IP address is registered in the distribution management table 301, a filtering ID cannot be assigned to a packet from each user.
In the present embodiment, it is assumed that the terminal 311 of the user #a is connected to the Internet 310 and then performs IP communication with the connection partner terminal 313.
The LCP information is exchanged between the user terminal 311 and the firewall apparatus 300, and the NCP information is exchanged between the user terminal 311 and the firewall apparatus 300 from the exchange of authentication information (839 in FIG. 10) (FIG. 10). The operations up to 843) are the same as those in the first embodiment, and thus the description thereof will be omitted.
After the NCP ends, a PPP connection is established between the user terminal and the network.
[0027]
After that, when the firewall apparatus 300 receives a packet 321 transmitted from the user terminal 311 to the connection partner terminal 313, it is described as the transmission source IP address [a. a. a. a] as a search key, the distribution management table (301-2 in FIG. 10) is searched, and [a. a. a. The filtering ID (ID = α) described in the line a] is extracted, and the filtering ID α is assigned to the packet 321 (processing point 852 in FIG. 10).
The packet 322 to which the filtering ID is assigned is subjected to a passing or discarding process according to the filtering rule according to the security policy of the user #a described in the filtering table 561 whose filtering ID is α.
As in the first embodiment, the filtering table 561 whose filtering ID is α actually has the configuration shown in FIG.
FIG. 11 is a diagram showing a configuration of a filtering rule according to the second embodiment of the present invention.
Therefore, in practice, the packet 322 to which the filtering ID (α) is assigned first extracts the head rule memory address (pppp) associated with the filtering ID (α) from the filtering head rule management table 31.
[0028]
Then, the information described in rule 1 described in the memory area of the extracted memory address pppp is compared with the information in the packet header.
As a result of the comparison, when the packet header information matches the condition of rule 1, the packet 322 is passed or discarded according to the operation described in rule 1.
On the other hand, if the packet header information does not match the conditions of rule 1 as a result of comparison, the memory address described in the next rule memory address of rule 1 is referred to, and the rule described in the memory area of the referenced memory address pppa 2 is compared with the information in the packet header.
As a result of the comparison, when the packet header information matches the condition of rule 2, the packet 322 is passed or discarded according to the operation described in rule 2.
On the other hand, as a result of the comparison, if the packet header information does not match the condition of rule 2, the next rule memory address of rule 2 is referred to, but since there is no description (NULL), rule 2 is the final rule of filtering table 561 And processing when the condition does not match any filtering rule. In the case of a firewall, discarding is common.
[0029]
When the firewall apparatus 300 receives the packet 323 transmitted from the communication partner terminal 313 to the user terminal 311, it is described as the destination IP address [a. a. a. a] as a search key, the distribution management table (301-2 in FIG. 10) is searched, and [a. a. a. The filtering ID (ID = α) described in the line a] is extracted, and the filtering ID of α is assigned to the packet 323 (processing point 853 in FIG. 10).
The packet 324 given the filtering ID is subjected to a passing or discarding process according to the filtering rule according to the security policy of the user #a described in the filtering table 561 whose filtering ID is α.
Similar to the packet 322 transmitted from the user terminal 311 to the connection partner terminal 313, the packet is actually written in the process of extracting the head rule memory address from the filtering head rule management table 31 and the memory area of the extracted memory address. Comparison processing with the rule is performed.
Even when the terminal 312 of the user #b is connected to the Internet 310 and then performs IP communication with the connection partner terminal 313, the packet transmitted and received by the terminal 312 is similar to the user # described in the filtering table 562. The pass or discard process is applied according to the filtering rule according to the security policy of b.
As described above, in the present embodiment, the next rule to be searched can be found directly from the memory address, so that the search for the next rule can be speeded up.
[0030]
[Embodiment 3]
The firewall device according to the third embodiment of the present invention is different from the firewall device according to the first embodiment described above in that the filtering ID is divided into an individual filtering ID and a common filtering ID.
Hereinafter, the firewall device of the present embodiment will be described focusing on differences from the firewall device of the first embodiment.
The schematic configuration of the firewall device according to the third embodiment of the present invention is the same as that shown in FIG. Also in this embodiment, the network connection method from the user is PPP, and the authentication communication is RADIUS.
In the firewall device of the present embodiment, the filtering ID of the first embodiment is further divided into an individual filtering ID and a common filtering ID, each user's individual filtering policy is described in an individual filtering table, and a plurality of users Filtering policies that can be made common in are described in the common filtering table.
Therefore, in this embodiment, the distribution management table 301 shown in FIG. 2 and the distribution management table (301-1) shown in FIG. 8 are replaced with the distribution management table 601 shown in FIG. 301-2) is replaced with the distribution management table 1101 of FIG.
[0031]
FIG. 7 is a diagram showing the concept of the filtering table in the virtual firewall of the firewall device of the present embodiment.
The firewall device 300 of this embodiment includes a plurality of virtual firewalls (302, 303,..., 304).
Furthermore, as shown in FIG. 7, each virtual firewall (302, 303) has a plurality of filtering tables (661, 662, 663) specified by individual filtering IDs and a plurality of filtering tables specified by common filtering IDs. There are filtering tables (571, 572).
The filtering policy for each user is described in the individual filtering table (661, 662, 663), and the filtering policy that can be shared by a plurality of users is described in the common filtering table (571, 572).
Accordingly, as shown in FIG. 6, the distribution management table 601 manages user names, virtual firewall IDs, individual filtering IDs, and common filtering IDs.
[0032]
In the present embodiment, the security policy determined by the user #a and the user #b is stored in the virtual firewall 302, and the security policy determined by the user #d is stored in the virtual firewall 303.
Furthermore, the individual filtering policy of user #a is stored in the individual filtering table 661 whose filtering ID is α in the virtual firewall 302, and the individual filtering policy of user #b is stored in the individual filtering table 662 whose filtering ID is β in the user #d. The individual filtering policy is described in the individual filtering table 663 whose filtering ID is γ in the virtual firewall 303.
The filtering policy described in the common filtering table 571 whose filtering ID is I is also applied to the user #a and the user #b.
Similarly, the filtering policy described in the common filtering table 572 whose filtering ID is II is also applied to the user #d.
However, the individual filtering tables (661, 662, 663) and the common filtering table (571, 572) shown in FIG. 7 are conceptual, and each actual filtering table has a configuration as shown in FIG. Yes.
[0033]
FIG. 13 is a diagram showing a configuration of a filtering rule according to the third embodiment of the present invention.
The individual filtering rule (41, 42,...) Stores a filtering rule (rule 6, 7,...) Describing packet header information to be compared and an operation (pass or discard), and a filtering rule to be searched next. The next rule memory address representing the memory address being written is described.
Further, the individual filtering head rule management table 32 manages the correspondence between the individual filtering ID and the memory address storing the head filtering rule of each individual filtering table.
Further, the next rule memory address column is not described (NULL in FIG. 1) for the final filtering rule of each individual filtering table, thereby identifying that the filtering rule is the final rule.
Similarly, common filtering rules (51, 52,...) Include rules (rules 8, 9,...) Describing packet header information to be compared and operations (passing or discarding), and filtering to be searched next. The next rule memory address indicating the memory address where the rule is stored is described.
The common filtering head rule management table 33 manages the correspondence between the common filtering ID and the memory address where the head filtering rule of each common filtering table is stored.
Further, the next rule memory address column is not described (NULL in FIG. 1) for the final filtering rule of each common filtering table, thereby identifying that the filtering rule is the final rule.
[0034]
When the above description is arranged, for example, the filtering table 661 with the individual filtering ID α in FIG. 7 includes the row in which the individual filtering ID (α) of the individual filtering head rule management table 32 is managed, the filtering rule 41, and The filtering rule 42 is used.
As for the common filtering ID, for example, the filtering table 571 with the common filtering ID I is the row in which the common filtering ID (I) of the common filtering head rule management table 33 is managed, the common filtering rule 51 and the common filtering ID. The filtering rules 52 are included.
Hereinafter, the operation of the firewall device of the present embodiment will be described with reference to FIG.
In the distribution management table 601, user names, virtual firewall IDs, individual filtering IDs, and common filtering IDs that can be set in advance are registered.
That is, the distribution management table 601 includes user name #a, virtual firewall ID (302), individual filtering ID (α) and common filtering ID (I), user name #b, virtual firewall ID (302), The association between the individual filtering ID (β) and the common filtering ID (I), the user name #d, the virtual firewall ID (303), the association between the individual filtering ID (γ) and the common filtering ID (II) are registered.
[0035]
However, since the user IP address serving as the user ID of each user terminal is not determined, it cannot be registered at this time (the state of the distribution management table 601 in FIG. 6).
Unless the user IP address is registered in the distribution management table 601, the packets from each user cannot be distributed to the respective virtual firewalls, and the individual filtering ID and the common filtering ID cannot be assigned.
In the present embodiment, it is assumed that the terminal 311 of the user #a is connected to the Internet 310 and then performs IP communication with the connection partner terminal 313.
The operations from the exchange of LCP information between the user terminal 311 and the firewall device 300 to the exchange of NCP information between the user terminal 311 and the firewall device 300 are the same as in the first embodiment. The description will not be repeated.
After the NCP ends, a PPP connection is established between the user terminal and the network.
After that, as shown in FIG. 2, when the firewall apparatus 300 receives a packet 321 transmitted from the user terminal 311 to the connection partner terminal 313, it is described as the transmission source IP address [a. a. a. a] as a search key, the distribution management table 1101 is searched, and [a. a. a. a], the virtual firewall ID = 302, individual filtering ID = α and common filtering ID = I are extracted, the packet 321 is distributed to the virtual firewall 302, the individual filtering ID of α, and I A common filtering ID is assigned (processing point 852 in FIG. 8).
[0036]
As shown in FIG. 7, the packet 322 to which the individual filtering ID and the common filtering ID are assigned is filtered in the virtual firewall 302 according to the security policy of the user #a described in the individual filtering table 661 with the individual filtering ID = α. According to this, passing or disposal processing is performed.
As described above, the individual filtering table 661 having the individual filtering ID α is actually configured as shown in FIG.
Therefore, in actuality, when the packet 322 to which the individual filtering ID (α) is assigned arrives in the virtual firewall 302, first, the first rule associated with the individual filtering ID (α) is first retrieved from the individual filtering first rule management table 32. A memory address (pppp) is extracted.
Then, the information described in the rule 6 described in the memory area of the extracted memory address pppp is compared with the information in the packet header.
As a result of the comparison, if the information in the packet header matches the condition of rule 6, the packet 322 is passed or discarded according to the operation described in rule 6.
On the other hand, if the packet header information does not match the conditions of rule 6 as a result of comparison, the memory address described in the next rule memory address of rule 6 is referred to, and the rule described in the memory area of the referenced memory address pppa 7 is compared with the information in the packet header.
As a result of the comparison, when the information in the packet header matches the condition of rule 7, the packet 322 is passed or discarded according to the operation described in rule 7.
[0037]
On the other hand, as a result of comparison, when the packet header information does not match the conditions of rule 7, the next rule memory address of rule 7 is referred to, but since there is no description (NULL), rule 7 is the last in the individual filtering table 661. Recognize that it is a rule.
If there is no rule to be applied to the filtering policy described in the individual filtering table 661, the packet 322 is then passed or discarded according to the filtering policy described in the common filtering table 571 with the common filtering ID = I. Processing is performed.
Similar to the processing for the individual filtering table 661, the common filtering table 571 having the common filtering ID I is actually configured as shown in FIG.
Therefore, in practice, the packet 322 to which the common filtering ID (I) is assigned extracts the head rule memory address [rrrr] associated with the common filtering ID (I) from the common filtering head rule management table 33. Then, the information described in the rule 8 described in the memory area of the extracted memory address [rrrr] is compared with the packet header information.
As a result of the comparison, when the information in the packet header matches the condition of rule 8, the packet 322 is passed or discarded according to the operation described in rule 8.
On the other hand, if the packet header information does not match the conditions of rule 8 as a result of comparison, the memory address described in the next rule memory address of rule 8 is referred to and written in the memory area of the referenced memory address [rrra]. The information described in the rule 9 is compared with the packet header information.
As a result of the comparison, when the information in the packet header matches the condition of rule 9, the packet 322 is passed or discarded according to the operation described in rule 9.
[0038]
On the other hand, if the packet header information does not match the conditions of rule 9 as a result of comparison, the next rule memory address of rule 9 is referred to, but since there is no description (NULL), rule 9 is the last in the common filtering table 571. Recognize that it is a rule, and perform processing when the condition does not match any filtering rule. In the case of a firewall, discarding is common.
When the firewall apparatus 300 receives the packet 323 transmitted from the communication partner terminal 313 to the user terminal 311, it is described as the destination IP address [a. a. a. a] as a search key, the distribution management table 1101 is searched, and [a. a. a. a), the virtual firewall ID (ID = 302), the individual filtering ID (ID = α), and the common filtering ID (ID = I) are extracted, and the packet 323 is distributed to the virtual firewall 302. An individual filtering ID of α and a common filtering ID of 1 are assigned (processing point 853 in FIG. 8).
The packet 324 to which the individual filtering ID and the common filtering ID are assigned is passed or discarded according to the filtering rule according to the security policy of the user #a described in the individual filtering table 661 whose individual filtering ID is α.
If there is no rule to be applied to the filtering policy described in the individual filtering table 661, the packet 324 is then passed or discarded according to the filtering policy described in the common filtering table 571 whose common filtering ID is I. Is done.
[0039]
Similar to the packet 322 transmitted from the user terminal 311 to the connection partner terminal 313, in practice, the process of extracting the head rule memory address from each of the individual filtering head rule management table 32 and the common filtering head rule management table 33, The comparison processing with the rule described in the memory area of the extracted memory address is performed.
When the terminal 312 of the user #b is connected to the Internet 310 and then performs IP communication with the connection partner terminal 313, packets transmitted and received by the terminal 312 are distributed to the virtual firewall 302 by the same procedure, and then individually. Passing or discarding processing is applied according to the filtering rule according to the security policy of user #b described in the filtering table 662 and the filtering rule described in the common filtering table 571.
As described above, in the present embodiment, the next rule to be searched can be found directly by the memory address, so that the search for the next rule can be speeded up.
Although the invention made by the present inventor has been specifically described based on the above-described embodiment, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. Of course.
[0040]
【The invention's effect】
The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, the information to be described in each filtering rule constituting the filtering policy of the filtering table is the rule to be searched next in addition to the rule itself describing the packet header information to be compared and the operation (passing or discarding). Since the next filtering rule is directly indicated by the address information, it is possible to speed up the search for the next filtering rule.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of a filtering rule according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a schematic configuration of the high-speed search-capable high-multiple user accommodation firewall device according to the first embodiment of the present invention.
FIG. 3 is a block diagram showing a schematic configuration of a conventional firewall device.
4 is a sequence diagram showing an operation of the firewall device shown in FIG. 3. FIG.
FIG. 5 is a diagram showing a concept of a filtering table in the virtual firewall applied in the first embodiment of the present invention.
FIG. 6 is a diagram showing a configuration of a distribution management table that manages individual filtering IDs and common filtering IDs.
FIG. 7 is a diagram showing the concept of an individual filtering table and a common filtering table in a virtual firewall.
FIG. 8 is a sequence diagram showing an operation of the firewall device according to the first embodiment of the present invention.
FIG. 9 is a block diagram showing a schematic configuration of a high-speed search capable high-multiple user accommodation firewall apparatus according to the second embodiment of the present invention;
FIG. 10 is a sequence diagram showing an operation of the firewall device according to the second embodiment of the present invention.
FIG. 11 is a diagram showing a configuration of a filtering rule according to the second embodiment of the present invention.
FIG. 12 is a diagram showing a configuration of a distribution management table that manages individual filtering IDs and common filtering IDs in which user IP addresses are registered.
FIG. 13 is a diagram showing a configuration of a filtering rule according to the third embodiment of the present invention.
[Explanation of symbols]
10, 12, 21, 22, 23, 41, 42, 51, 52 ... filtering rules, 31 ... filtering head rule management table, 32 ... individual filtering head rule management table, 33 ... common filtering head rule management table, 100, 300 ... Firewall apparatus, 101, 301, 1101 ... Distribution management table, 102, 103, 104, 302, 303, 304 ... Virtual firewall, 110, 310 ... Internet, 111, 112, 113, 114, 115, 211, 212, 213 , 311, 312, 313, 314, 315... Terminal, 121, 122, 321, 322, 323, 324 ... packet, 130, 330. I filter ring table.

Claims (8)

A distribution management table that manages user names, user IDs, and filtering IDs in association with each other;
A filtering table identified by the filtering ID and having an independent filtering policy;
Means 1 for receiving authentication information in which a user name is issued issued from a user terminal at the time of starting a network connection and holding the user name;
Means 2 for notifying the authentication server of the authentication information;
Means 3 for receiving an authentication response from the authentication server and holding a user ID to be given to the user terminal described in the authentication response;
Means 4 for registering the user ID in the distribution management table using the user name as a search key;
After the connection between the user terminal and the network is established, the distribution management table is searched for the packet transmitted from the user terminal using the transmission source user ID as a search key and corresponds to the transmission source user ID Means 5 for extracting a filtering ID to be attached and giving the extracted filtering ID to a packet transmitted from the user terminal;
For the packet transmitted from the communication partner terminal of the user terminal, the distribution management table is searched using the destination user ID as a search key, the filtering ID associated with the destination user ID is extracted, and the user terminal Means 6 for assigning the extracted filtering ID to a packet transmitted from a communication partner terminal;
High-speed search compatible high-multiplexing comprising: a means for passing or discarding a packet to which a filtering ID is assigned by the means 5 or 6 according to a filtering policy described in a filtering table specified by the assigned filtering ID A user-accommodating firewall device,
Each filtering policy of the filtering table is composed of at least one filtering rule, and each filtering rule describes the rule itself and address information indicating a position where a filtering rule to be searched next is stored,
The means 7 performs a rule search for the filtering rule based on the filtering ID assigned to the packet, and ends the rule search when the packet to which the filtering ID is assigned matches the rule condition. In accordance with the operation described in the rule, the filtering rule stored in the position represented by the address information when the packet with the filtering ID is passed or discarded and when the condition of the rule is not met A high-multiple-user-accommodating firewall apparatus capable of high-speed search, wherein rule search is performed on A distribution management table for managing a user name, a user ID, an individual filtering ID, and a common filtering ID in association with each other;
At least one individual filtering table having a filtering policy specified by the individual filtering ID and prepared independently for each user name;
At least one common filtering table identified by a common filtering ID, grouping a plurality of user names, and having a filtering policy prepared independently for each group;
Means 1 for receiving authentication information in which a user name is issued issued from a user terminal at the time of starting a network connection and holding the user name;
Means 2 for notifying the authentication server of the authentication information;
Means 3 for receiving an authentication response from the authentication server and holding a user ID to be given to the user terminal described in the authentication response;
Means 4 for registering the user ID in the distribution management table using the user name as a search key;
After the connection between the user terminal and the network is established, the distribution management table is searched for the packet transmitted from the user terminal using the transmission source user ID as a search key and corresponds to the transmission source user ID Means 5 for extracting an individual filtering ID and a common filtering ID to be attached, and giving the extracted individual filtering ID and common filtering ID to a packet transmitted from the user terminal;
For the packet transmitted from the communication partner terminal of the user terminal, the distribution management table is searched using the destination user ID as a search key, and the individual filtering ID and the common filtering ID associated with the destination user ID are extracted. , Means 6 for assigning the extracted individual filtering ID and common filtering ID to the packet transmitted from the communication partner terminal of the user terminal;
The filtering policy described in the individual filtering table specified by the assigned individual filtering ID, the packet to which the individual filtering ID and the common filtering ID are assigned by the means 5 or 6, and the assigned common According to the filtering policy described in the common filtering table specified by the filtering ID, a high-multiple user accommodating firewall device corresponding to a high-speed search comprising means 7 for passing or discarding,
Each filtering policy of the individual filtering table and the common filtering table is composed of at least one filtering rule, and each filtering rule has an address representing the rule itself and a position where the filtering rule to be searched next is stored. Information is described,
The means 7 performs a rule search for the filtering rule based on the individual filtering ID and the common filtering ID assigned to the packet, and the packet to which the individual filtering ID and the common filtering ID are assigned When the condition is met, the rule search is terminated, and the packet with the individual filtering ID and the common filtering ID is passed or discarded according to the operation described in the rule, and does not meet the rule condition. In this case, a high-speed search-capable high-multiple user accommodation firewall apparatus that performs a rule search for a filtering rule stored at a position represented by the address information. A distribution management table for managing a user name, a user ID, a virtual firewall ID, and a filtering ID in association with each other;
A filtering table identified by the filtering ID and having an independent filtering policy;
A plurality of virtual firewalls identified by the virtual firewall ID and having at least one filtering table identified by the filtering ID;
Means 1 for receiving authentication information in which a user name is issued issued from a user terminal at the time of starting a network connection and holding the user name;
Means 2 for notifying the authentication server of the authentication information;
Means 3 for receiving an authentication response from the authentication server and holding a user ID to be given to the user terminal described in the authentication response;
Means 4 for registering the user ID in the distribution management table using the user name as a search key;
After the connection between the user terminal and the network is established, the distribution management table is searched for the packet transmitted from the user terminal using the transmission source user ID as a search key and associated with the transmission source user ID. The virtual firewall ID and filtering ID to be extracted, and the packet transmitted from the user terminal is distributed to the virtual firewall specified by the extracted virtual firewall ID, and the packet transmitted from the user terminal is Means 5 for assigning the extracted filtering ID;
For the packet transmitted from the communication partner terminal of the user terminal, search the distribution management table using the destination user ID as a search key, and extract a virtual firewall ID and a filtering ID associated with the destination user ID, The packet transmitted from the communication partner terminal of the user terminal is distributed to the virtual firewall specified by the extracted virtual firewall ID, and the extracted filtering is performed on the packet transmitted from the communication partner terminal of the user terminal. Means 6 for assigning an ID;
Means for passing or discarding the packet to which the filtering ID is assigned by the means 5 or 6 according to the filtering policy described in the filtering table specified by the assigned filtering ID in the assigned virtual firewall. 7 and a high-multiple user accommodation firewall device compatible with high-speed search,
Each filtering policy of the filtering table is composed of at least one filtering rule, and each filtering rule describes the rule itself and address information indicating a position where a filtering rule to be searched next is stored,
The means 7 performs a rule search for the filtering rule based on the filtering ID assigned to the packet, and ends the rule search when the packet to which the filtering ID is assigned matches the rule condition. In accordance with the operation described in the rule, the filtering rule stored in the position represented by the address information when the packet with the filtering ID is passed or discarded and when the condition of the rule is not met A high-multiple-user-accommodating firewall apparatus capable of high-speed search, wherein rule search is performed on A distribution management table for managing a user name, a user ID, a virtual firewall ID, an individual filtering ID, and a common filtering ID in association with each other;
At least one individual filtering table having a filtering policy specified by the individual filtering ID and prepared independently for each user name;
At least one common filtering table identified by a common filtering ID, grouping a plurality of user names, and having a filtering policy prepared independently for each group;
A plurality of virtual firewalls identified by the virtual firewall ID and having at least one individual filtering table identified by the individual filtering ID and at least one common filtering table identified by the common filtering ID;
Means 1 for receiving authentication information in which a user name is issued issued from a user terminal at the time of starting a network connection and holding the user name;
Means 2 for notifying the authentication server of the authentication information;
Means 3 for receiving an authentication response from the authentication server and holding a user ID to be given to the user terminal described in the authentication response;
Means 4 for registering the user ID in the distribution management table using the user name as a search key;
After the connection between the user terminal and the network is established, the distribution management table is searched for the packet transmitted from the user terminal using the transmission source user ID as a search key and corresponds to the transmission source user ID The attached virtual firewall ID, individual filtering ID, and common filtering ID are extracted, and packets transmitted from the user terminal are distributed to the virtual firewall specified by the extracted virtual firewall ID, and transmitted from the user terminal. Means 5 for assigning the extracted individual filtering ID and common filtering ID to the packet;
For the packet transmitted from the communication partner terminal of the user terminal, the distribution management table is searched using the destination user ID as a search key, and the virtual firewall ID, individual filtering ID and common filtering associated with the destination user ID are searched. The ID is extracted, the packet transmitted from the communication partner terminal of the user terminal is distributed to the virtual firewall specified by the extracted virtual firewall ID, and the packet transmitted from the communication partner terminal of the user terminal , Means 6 for assigning the extracted individual filtering ID and common filtering ID;
The filtering policy described in the individual filtering table specified by the assigned individual filtering ID in the distributed virtual firewall, and the assigned policy for the packet to which the individual filtering ID and the common filtering ID are assigned. A high-speed search-capable high-multiple user accommodating firewall device comprising means 7 for passing or discarding according to the filtering policy described in the common filtering table identified by the common filtering ID,
Each filtering policy of the individual filtering table and the common filtering table is composed of at least one filtering rule, and each filtering rule has an address representing the rule itself and a position where the filtering rule to be searched next is stored. Information is described,
The means 7 performs a rule search for a filtering rule specified by the filtering ID given to the packet based on the individual filtering ID and common filtering ID given to the packet, and the individual filtering ID and common filtering ID are When the assigned packet meets the conditions of the rule, the rule search is terminated, and the packet with the individual filtering ID and the common filtering ID is passed or discarded according to the operation described in the rule, A high-speed search-capable high-multiple user accommodating firewall apparatus that performs a rule search for a filtering rule stored at a position represented by the address information when the rule condition is not met. A filtering head rule management table for managing the filtering ID and address information indicating the position where the heading filtering rule of each filtering ID is stored;
The high-speed search support according to claim 1 or 3, wherein the means 7 identifies the filtering rule at the head of the filtering policy specified by each filtering ID based on the filtering head rule management table. High multi-user accommodation firewall device. An individual filtering head rule management table for managing individual filtering IDs and address information indicating a position where the head filtering rule of each individual filtering ID is stored;
A common filtering head rule management table for managing a common filtering ID and address information indicating a position where a head filtering rule of each common filtering ID is stored;
The means 7 identifies the filtering rule at the head of the filtering policy specified by the individual filtering ID and the common filtering ID based on the individual filtering head rule management table and the common filtering head rule management table. The high-multiple user accommodation firewall apparatus according to claim 2 or 4, wherein the high-speed search correspondence high-multiple user accommodation firewall apparatus is characterized. 7. The method according to claim 1, wherein when the address information is not described in the filtering rule searched by the rule, the means determines that the searched filtering rule is a final rule. 2. A high-multiple user accommodation firewall device corresponding to the high-speed search described in 1. The authentication server is a Radius server;
The user ID is a user IP address;
The network is the Internet;
The high-speed search-capable high-multiple user accommodating firewall apparatus according to any one of claims 1 to 7, wherein PPP is used for network connection from the user terminal.

Images