JP2005051588A - Automatic filtering method and device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a filtering method and a device which automatically recognize IP packets which network terminals don't require, and perform abandonment processing. <P>SOLUTION: The automatic filtering method has; a step S1010 of detecting an IP packet; a step S1020 of deciding whether the detected IP packet is an ICMP packet or not; a step S1030 of discriminating whether a detected ICMP packet is a destination unreachable message or not; a step S1040 of deciding whether a detected destination unreachable message is caused by impossibility of processing in network terminals or not; a step S1050 of acquiring information of an IP packet to be abandoned, from the detected ICMP packet; and a step S1010 of setting acquired information of the IP packet to be abandoned, to a filter device. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention provides a method and an apparatus for automatically recognizing and filtering unnecessary IP packets for unauthorized access to an apparatus connected to a network.

  In recent years, with the advancement of network technology, the environment in which each home can always connect to the Internet is increasing. Along with this, an increasing number of homes have built various servers such as WWW (World Wide Web) on home PCs (Personal Computers) to allow access to home PCs from outside the home. On the other hand, since it is always connected to the Internet, there is an increased risk of unauthorized access from malicious persons. In particular, an attack called a DoS (Denial of Service) attack is so large that even a business server is stopped, and several countermeasures have been devised (see, for example, Patent Document 1).

However, the method proposed in Patent Document 1 and the like is a large-scale method performed by a service provider such as a provider. As a countermeasure for each home, a general method is to use a filtering function of an IP (Internet Protocol) packet that is provided as standard in home router products. If the IP packet filtering function is used, only specific packets can be passed from the outside or discarded. For example, if only HTTP (Hyper Text Transfer Protocol) packets normally used for WWW are allowed to pass, only TCP (Transmission Control Protocol) destination port number 80 is passed, and other external packets are discarded. It should be set so that.
Japanese Patent Laid-Open No. 2002-158660 (Section 3-4, FIG. 1)

  However, in order to use the IP packet filtering function, knowledge of IP is required to some extent, and it cannot be easily set by anyone. In other words, it is necessary to know what port the server built in the home is using. Further, it is necessary to update the setting every time a new server is constructed.

  Accordingly, an object of the present invention is to provide a method and apparatus for automatically determining and filtering an IP packet that is unnecessary for a network device accessed from the outside.

  In order to solve the above-mentioned problem, the present invention detects an error notification packet to be transmitted to a transmission source of the unprocessable packet when the network device receives an unprocessable packet that cannot be processed by the network device, and the error An automatic filtering method comprising: obtaining information on the unprocessable packet described in the notification packet; and discarding a packet corresponding to the information on the unprocessable packet.

  According to this, even if the user has little knowledge about IP, it is possible to prevent unauthorized access by automatically recognizing and discarding unnecessary IP packets.

  Further, the present invention records the number of transmissions of the error notification packet to the transmission source of the unprocessable packet, and is transmitted from the transmission source of the unprocessable packet when the number of transmissions exceeds a predetermined number. The automatic filtering method according to claim 1, wherein all packets are discarded.

  According to this, it becomes possible to determine the device that has made unauthorized access, and all access from the device can be prohibited, thereby preventing unauthorized access.

  As is apparent from the above description, the present invention provides a mechanism for analyzing an ICMP message and automatically filtering IP packets unnecessary for the network terminal, thereby reducing the load on the network terminal and preventing unauthorized access. Can be prevented.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

(Embodiment 1)
FIG. 1 shows a configuration diagram of a network terminal 100 according to an embodiment of the present invention. The network terminal 100 is, for example, a home appliance such as a PC, a TV or a video deck having a network function, and is installed at home as needed.

  The network terminal 100 includes a network interface 110 and is connected to the network using the network interface 110. The control unit 120 executes a software program for processing an IP packet input from the outside via the network interface 110 and outputting the IP packet to the outside via the network interface 110. The filter unit 130 is located between the network interface 110 and the control unit 120 and discards an IP packet transmitted from the network interface 110 to the control unit 120 according to a predetermined setting. The ICMP detection unit 140 is located between the control unit 120 and the network interface 110, detects an ICMP packet transmitted from the control unit 120 to the network interface 110, specifies a filtering condition from the detected ICMP packet, and filters 130 Set for. The ICMP and the ICMP detection unit 140 will be described in detail later.

  Note that the filter unit 130 and the ICMP detection unit 140 may be implemented as hardware as part of the function of the network interface 110, or may be implemented as software that operates on the control unit 120.

  FIG. 2 shows a setting example of the filter unit 130.

  The filter unit 130 performs a filtering process according to the setting table 200 of the filter unit 130. In the setting table 200 of the filter unit 130, the protocol number 212, the source IP address 213, and the destination IP address 214 included in the IP header, and the source port number 215 and the destination port number 216 included in the TCP or UDP header are included. The operation 217 is set for the combination. In the operation 217, there are two options of “pass” and “discard”. Each combination has a priority 211, and when the target IP packet corresponds to a plurality of combinations, the combination having the highest priority is followed. An IP packet not corresponding to each combination follows the default operation.

  In the case of the example in FIG. 2, a network terminal having an IP address of 192.168.10.5 accesses a terminal having an IP address of 192.168.0.10 by TCP (protocol number 6) (destination port number). 80) or Telnet (destination port number 23) only. “*” Set in the transmission source port number 215 or the like indicates that all values are applicable.

  ICMP is also a protocol for notifying errors that occur mainly in the IP layer, although it also has a function to check whether there is a terminal having a specified IP address, as used in the PING command. One of the ICMP error notification functions is a function for sending a destination unreachable message (Destination Unreachable Message). The destination unreachable message is a message used to notify a terminal having a source IP address that an IP packet has not been correctly transmitted to a terminal having a destination IP address.

  A format 300 of the destination unreachable message is shown in FIG. For the non-destination message, Type field 301 for 0 to 7 bits, Code field 302 for 8 to 15 bits, Checksum field 303 for 16 to 31 bits, Unused field 304 for 32 to 63 bits, and Internet Header + after 64 bits It consists of a 64-bit of Original Datagram field 305.

  The ICMP field has a common Type field 301, and when this Type field 301 is “3”, it is determined that the destination unreachable message. In the destination unreachable message, the reason can be set in the Code field 302.

  In the network terminal 100, when the control unit 120 cannot process the protocol corresponding to the protocol number 212 of the received IP packet, it sets the Code field 302 to “2” and transmits a destination unreachable message. In addition, when the destination port number of the received IP packet is not used, the control unit 120 sets the Code field 302 to “3” and transmits a destination unreachable message.

  That is, the IP packet that causes the network terminal 100 to return the destination unreachable message can be determined as a packet unnecessary for the network terminal 100.

  FIG. 4 shows a flowchart of the ICMP detection unit 140.

  First, in step S1010, the ICMP detection unit 140 stands by until an IP packet output from the control unit 120 to the network interface 110 is detected.

  In step S1020, it is checked whether the received IP packet is an ICMP packet. The ICMP packet is determined based on the protocol number field in the IP packet header, which is defined as “1”. If it is not an ICMP packet, the process returns to step S1010.

  In step S1030, it is checked whether the ICMP packet is a destination unreachable message. The destination unreachable message is determined based on the Type field 301, which is defined as “3”. If it is not a destination unreachable message, the process returns to step S1010.

  In step S1040, it is checked whether the reason why the destination is unreachable is that protocol processing is not possible or the port is not used. When the protocol processing is impossible, the Code field 302 is “2”, and when the port is not used, the Code field 302 is “3”. If the destination is unreachable, return to step S1010.

In step S1050, setting information for filtering is extracted from the Internet Header + 64-bit of Original Datagram field of the ICMP packet. In the Internet Header + 64-bit of Original Datagram field, a header of an IP packet that could not be processed by the network terminal 100 and a TCP or UDP header for 8 bytes are stored. Extracting various setting information for filtering from each header sets the setting information extracted in step S1050 to the filter unit 130 in step S1060.

  Finally, the procedure from when the network terminal 100 is activated until the first ICMP packet is detected and the filtering setting is performed will be described with reference to FIG. The IP address of the network terminal 100 is assumed to be 192.168.0.10.

  In step S2010, the network terminal 100 is activated to reset the setting table 200 of the filter unit 130. After the reset, the setting table 200 of the filter unit 130 is set to pass all IP packets by default as shown in FIG.

  In step S2020, the network interface 110 of the network terminal 100 receives an IP packet (protocol number 212 is 6 and the source IP address 213 is 192.168.30.9) from a terminal having an IP address of 192.168.30.9. The destination IP address 214 is 192.168.0.10, the source port number 215 is 3001, and the destination port number 216 is 23).

  In step S2030, since the filter unit 130 is set to pass all IP packets, the received IP packet is transferred to the control unit 120.

  In step S2040, the control unit 120 does not use the port number 23, that is, since it is not a Telnet server, so that an ICMP destination unreachable message is set to “3” in the Code field 302 to the terminal of 192.168.30.9. Set and send.

  In step S2050, the ICMP detection unit 140 identifies settings to be filtered from the ICMP packet and sets the settings in the filter unit 130. At this time, the setting table 200 of the filter unit 130 is as shown in FIG. Further, the ICMP packet is passed to the network interface 110.

  In step S2060, the network interface 110 transmits an ICMP packet to a terminal having an IP address of 192.168.30.9.

  As described above, in this embodiment, it is possible to prevent unauthorized access by automatically monitoring IP packets unnecessary for the network terminal 100 by monitoring ICMP packets.

  In this embodiment, it is described that an ICMP packet is transmitted in step S2050. However, transmitting an ICMP packet proves that the network terminal 100 exists, so step S2050 or step S2060. The ICMP packet may be discarded.

(Embodiment 2)
The operation of the ICMP detection unit 140 of the network terminal 100 in the second embodiment of the present invention will be described with reference to FIGS.

  FIG. 8 is an ICMP packet transmission count table 400 provided in the ICMP detection unit 140. The ICMP packet transmission times table 400 associates numbers 401 with ICMP packet destination IP addresses 402 and ICMP packet transmission times 403. The ICMP packet transmission count 403 is incremented every time an ICMP packet is transmitted.

  FIG. 9 shows a part of a flowchart of the ICMP detection unit 140 in the present embodiment. Hereinafter, the operation of the ICMP detection unit 140 in the present embodiment is performed with reference to FIG.

  The ICMP detection unit 140 performs the operation as described in the first embodiment from step S1010 to step S1060, and thus the description thereof is omitted in the present embodiment. Hereinafter, step S1070 and subsequent steps will be described.

  In step S1070, the ICMP transmission frequency table 400 is updated. The ICMP detection unit 140 uses the ICMP packet transmission count table 400 to record the ICMP packet transmission count 403 for each destination IP address 402 of the ICMP packet. In step S1070, the ICMP packet transmission count 403 corresponding to the IP address 402 to which the ICMP packet is transmitted is counted up.

  In step S1080, it is determined whether the count-up ICMP packet transmission count 403 has exceeded a predetermined value in step S1070. If the predetermined value is not exceeded, the process returns to step S1010.

  In step S1090, a setting value for rejecting all IP packets from an IP address whose ICMP packet transmission count 403 exceeds a predetermined value is set in the filter unit 130. FIG. 10 shows a setting example when all IP packets from a terminal having an IP address of 192.168.40.8 are rejected.

  As described above, in this embodiment, by recording the number of ICMP packet transmissions for each destination IP address of the ICMP packet, the IP address of the terminal performing port scanning or the like is specified, and unauthorized access is made. Can be prevented.

  The present invention provides a mechanism for analyzing an ICMP message and automatically filtering IP packets unnecessary for the network terminal, thereby reducing the load on the network terminal and preventing unauthorized access. This is useful for automatically recognizing and filtering unnecessary IP packets in order to deal with unauthorized access to a device that has been used.

Configuration diagram of network terminal 100 The figure showing the example of a setting of the filter part 130 Diagram showing the format of the destination unreachable message Flow chart of ICMP detection unit 140 The figure showing the operation | movement procedure of the network terminal 100 The figure showing the setting table of the filter part 130 The figure showing the setting table of the filter part 130 The figure showing an ICMP packet transmission frequency table Flow chart of ICMP detection unit 140 The figure showing the setting table of the filter part 130

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Network terminal 110 Network interface 120 Control part 130 Filter part 140 ICMP detection part 200 Filter part 130 setting table 211 Priority order 212 Protocol number 213 Source IP address 214 Destination IP address 215 Source port number 216 Destination port number 217 Operation 300 Destination unreachable message format 301 Type field 302 Code field 303 Checksum field 304 Unused field 305 Internet Header + 64 bit of Original Datagram field 400 Number of ICMP packet transmission times table 401 Number 402 ICMP packet destination IP address 403 I

Claims (6)

Detecting an error notification packet to be transmitted to the transmission source of the unprocessable packet when the network device receives an unprocessable packet that cannot be processed;
Obtaining information of the unprocessable packet described in the error notification packet;
An automatic filtering method comprising: performing a step of discarding a packet corresponding to the information of the unprocessable packet. The step of discarding the packet corresponding to the information of the unprocessable packet records the number of transmissions of the error notification packet to the transmission source of the unprocessable packet, and when the number of transmissions exceeds a predetermined number, the process is not possible 2. The automatic filtering method according to claim 1, wherein all packets sent from the packet transmission source are discarded. The automatic filtering method according to claim 1, wherein the error notification packet is ICMP (Internet Control Message Protocol). A connection for connecting to the network;
A filter unit that discards packets that satisfy a predetermined condition from packets input from the connection means;
A control unit that processes packets that do not meet the conditions of the filter unit;
The error notification packet is monitored from the packets output from the control unit, the information of the unprocessable packet described in the error notification packet is acquired, and the unprocessable packet is discarded to the filter unit An automatic filtering device comprising: a detection unit configured to perform the setting. The detection unit includes means for recording the number of transmissions of the error notification packet to the transmission source of the unprocessable packet, and when the number of transmissions exceeds a predetermined number of times, the transmission of the unprocessable packet to the filter unit 5. The automatic filtering device according to claim 4, wherein the setting is made such that all packets sent from the source are discarded. 6. The automatic filtering device according to claim 4, wherein the error notification packet is ICMP (Internet Control Message Protocol).

Images