JP2005080246A - Router device and its packet processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve problems of increasing in communication network traffic by packets being flowed into a communication network and increasing in load of a router for processing the packets because of a filtering process and a QoS process of fragmentation packets not being supported by the router. <P>SOLUTION: The fragmentation packets are passed to a fragmentation packet analyzing unit 42 by a reception packet distributing unit 41. Layer 4 information included in a first fragmentation packet is acquired by the fragmentation packet analyzing unit 42 and registered into a fragment identifier managing table 43 together with a fragment identifier. An option header analyzing unit 45 inserts an option header including the layer 4 information having the same fragmentation identifier registered in the table 43 in response to the packets following a second fragment packet which does not have the layer 4 information. The communication quality of the communication network, the reduction of the load, and the stability are improved by performing the filtering process and the QoS process by the layer 4 information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a router apparatus and its packet processing method and program, and more particularly to a router apparatus which uses an IPv6 (Internet Protocol version 6) protocol and further processes fragmented received packets, and its packet processing method and program. It is.

  When a packet is transferred between network terminals or between a router device and a network terminal, a packet having a certain size or more is divided into several parts and transferred. Such fragmentation of the transfer packet is referred to as fragment processing, and the fragment-processed packet is referred to as a fragment packet.

  Referring to FIG. 17, a packet having a certain size or less shown in (a) is not fragmented, but a packet exceeding a certain size (shown by a dotted line) shown in (b) It is subdivided into fragment packets. At this time, in the IPv6 fragment packet processing, the first fragment packet includes layer 3 information (the third (network) layer according to the OSI reference model, including the IP header (IPv6) information) and layer 4 information (OSI The fourth (transport) layer according to the reference model (including TCP and UDP header information) is added, but only the layer 3 information based on the IPv6 header is added to the subsequent second fragment packet.

  FIG. 18 shows the state of QoS management based on the layer 3 information of fragment packets. As shown in the figure, in the router device 1, when packet processing from the network terminals A and B is performed, Only rough filtering and QoS processing based on the IP address of the terminal and the protocol of the communication packet can be realized. For this reason, an increase in network traffic due to inflow of unnecessary fragment packets into the network and an increase in the load on the router device 1 which is a network device that processes the fragment packets become a problem.

  In FIG. 18, there is a QoS priority process for the packet from terminal A, and no QoS priority process for the packet from terminal B. In this case, between terminal A and server S, Although communication can be performed at high speed, since all packets from the terminal A are prioritized, waste is increased. On the other hand, the terminal B and the server S cannot communicate at high speed, and the packet from the terminal A is given priority, so that necessary data transfer is also delayed.

  Layer 4 information such as TCP / UDP port information for specifying an application and TCP control bits is indispensable for realizing filtering and QoS processing for efficiently operating the network (see Patent Document 1). These pieces of information are included in the first fragment packet, but are not included after the second fragment packet. Therefore, as shown in FIG. 19, filtering or QoS processing by the layer 4 information in the router device 1 may be performed. Can not

That is, FIG. 19 is a diagram showing a state of QoS management based on layer 4 information. In the upper side of the figure, normal packet transfer is shown, application a of terminal A is high-speed processing, and b is low-speed processing. In this case, the packets of the applications a and b are transferred based on the QoS set in the router device 1. However, as shown in the lower part of the figure, at the time of fragment packet transfer, only the first (first) fragment packet is subjected to transfer processing based on QoS. There is also a problem that an attack to the router device using the fragment packet is easily executed.
JP 2001-197111 A

  The first problem is that unnecessary fragment packets flow into the network, thereby increasing network traffic and deteriorating communication quality. The second problem is that processing of unnecessary fragment packets by the router device increases the burden on the router device, resulting in packet discarding and the like, deteriorating communication quality. The third problem is that the operation of the router device as described in the above problem 2 is exploited to attack the router device, which reduces the security of the network.

  For these reasons, since layer 4 information is not added after the second fragment packet, QoS and filtering processing is not performed on layer 4 information such as TCP / UDP port information and TCP control bits for specifying an application. It depends.

  An object of the present invention is to provide a fragment packet filtering and QoS function by adding an option header to a fragment processed IPv6 packet, thereby improving the communication quality, load reduction, and safety of the network. It is to provide a router device capable of performing the above, a packet processing method thereof, and a program.

  A router device according to the present invention is a router device configured to perform filtering processing and QoS processing of the received packet based on header information added to the received packet, wherein the received packet is subjected to fragment processing. A header information insertion control unit that acquires header information for the filtering process and the QoS process from the first fragment packet and controls the insertion of the header information into the subsequent fragment packet. .

  A packet processing method according to the present invention is a packet processing method of a router device that performs filtering processing and QoS processing of the received packet based on header information added to the received packet, wherein the received packet is a fragment In the case of a processed packet, a header information insertion control step for obtaining header information for the filtering process and the QoS process from the first fragment packet and inserting and controlling the header information for the subsequent fragment packet is included. It is characterized by that.

  A program according to the present invention is a program for causing a computer to execute a packet processing method of a router apparatus configured to perform filtering processing and QoS processing of the received packet based on header information added to the received packet. When the received packet is a fragment processed packet, the header information for the filtering process and the QoS process is obtained from the first fragment packet, and the header information is inserted and controlled for the subsequent fragment packet. An information insertion control process is included.

  The first effect of the present invention is that network communication quality is improved. This is because QoS at the layer 4 information level of the fragment packet can be realized. Since the priority transfer process which is the QoS function can be supported, the fragment packet can receive the priority processing function service based on the QoS condition even when the router apparatus is under heavy load and discards the received packet. As a result, packets can be transferred at high speed and safely.

  The second effect is to reduce the load on the network and the router device. Since filtering of the fragment packet at the layer 4 information level can be realized, the distinction between a necessary packet and a packet that is not so can be more finely divided than in the past. Therefore, it is possible to prevent unnecessary packets from entering the network that increase the load on the router device, and to reduce the load on the network device such as the network and the router device.

  The third effect is that the security of the network is improved. Even if an attack that misuses a fragment packet transfer processing request for the purpose of increasing the load on the router device is performed, by filtering the fragment packet, it is possible to prevent the packet from flowing into the router device. It is possible to prevent the network from being down due to the router device being stopped.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a schematic block diagram of a router device 1 according to an embodiment of the present invention. In FIG. 1, a packet input to the hardware 2 is transferred to the TCP / IP processing unit 5 via the hardware control driver 3 and subjected to routing processing. Thereafter, the packet is input to the option header setting unit 4 which is a characteristic part of the present invention, and additional control of the option header, which will be described in detail later, is performed. Then, the packet is passed to the hardware control driver 3, subjected to filtering and QoS processing, and output via the hardware 2.

  As shown in FIG. 1, the option header setting unit 4 which is a feature of the present invention is located between the TCP / IP processing unit 5 and the hardware control driver 3, and is included in the first fragment packet described in FIG. It has a function of adding a TCP header to the subsequent fragment packet.

  FIG. 2 is a block diagram showing a specific example of the option header setting unit 4. The received packet distribution unit 41 has a function of distributing packets received by the router device 1 to the fragment packet analysis unit 42, the option header insertion unit 44, and the option header analysis unit 45 based on preset conditions. . The fragment packet analysis unit 42 has a fragment packet analysis function, and has a function of performing an analysis process on the first (first) fragment packet.

  The fragment identifier management table 43 has a function of registering the fragment identifier of the first fragment packet analyzed by the fragment packet analysis unit 42 and the TCP header (layer 4 information) as a set. The option header insertion unit 44 additionally inserts the same TCP header (layer 4 information: option header) as the first fragment packet with reference to the fragment identifier management table 43 for the second and subsequent fragment packets. It has the function to do. Further, the option header insertion unit 44 inserts the option header and inserts the fragment identifier registered in the fragment identifier management table 43 when the fragment packet is the final packet (when the predetermined area of the fragment header is “1”). And a function of deleting a pair of TCP headers.

  The option header analysis unit 45 has a function of analyzing an option header inserted in the packet and performing filtering and QoS processing set in the router device 1 for the packet having the header. The option header deleting unit 46 has a function of deleting and outputting the option header inserted in the bucket.

  FIG. 3 is a flowchart showing an operation procedure of the option header setting unit 4 shown in FIG. The received packet sorting unit 41 has a function of sorting packets received by the router device 1 based on conditions. First, it is determined whether to perform filtering processing or QoS processing using an option header according to the present invention (step S1). When these processes are not performed, a normal routing process is performed (step S6). When the received packet is a fragment packet having an option header according to the present invention (steps S2 and S3), a process of passing the packet to the option header analysis unit 42 is performed (step S4). If the received packet does not meet the above conditions, normal routing processing is performed (step S6).

  The fragment packet analysis unit 42 has a function of analyzing the fragment packet received by the router device 1, and the processing is different between the first fragment packet and the subsequent fragment packets. First, the processing of the first fragment packet will be described. When the packet is the first fragment packet (step S7), packet analysis processing is performed (step S8). Details of this packet analysis processing are shown in FIG. The fragment identifier and the layer 4 information (port information, message type code) included in the IPv6 header of the first fragment packet are acquired (steps S81 to 84). The acquired fragment identifier and layer 4 information are registered in the fragment identifier management table 43 as a set (step S85). Thereafter, the received packet is passed to the option header insertion unit 44 (step S86). If the packet is not the first fragment packet, the packet is passed to the option header insertion unit 44.

  As shown in FIG. 3, the option header insertion unit 44 performs option header creation and insertion processing (step S9), and deletes registration information from the fragment identifier management table 43 in the case of the final fragment packet (step S10). (Step S11). Details of the operation of the option header insertion unit 44 are shown in FIG. For packets after the second fragment packet (steps S91 and S92), if the fragment identifier of the packet is registered in the fragment identifier management table 43 (step S94), an option header added to the fragment packet is created (step S94). In step S96, an option header is inserted into the packet (step S97). If NO in step S94, routing processing is performed (step S95).

  If the fragment packet is the last packet (the predetermined area of the fragment header is “1”) (step S10), the fragment packet information registered in the fragment identifier management table 43 is deleted after the option header is inserted (step S11). ), And passes the packet to the option header analysis unit 45 (step S12). Note that the option header is not inserted into the first fragment packet.

  FIG. 6 is a flowchart showing details of the processing of the option header analysis unit 45 (step S4 in FIG. 3). This option header analysis unit 45 analyzes the option header inserted in the packet and converts it into a packet having the option header. On the other hand, filtering and QoS processing set in the router are performed.

  Referring to FIG. 6, when the packet is the first fragment packet (steps S40 and S41), the first fragment packet is referred to as layer 2 (the second (data link) layer according to the OSI reference model, and the Ether header information). 3 and 4 information is acquired (step S45). Based on the layer 2 to 4 information obtained from the packet, it is determined whether there is a condition that matches the filtering condition and the QoS condition set in the router device 1 (step S46). If the conditions are matched, filtering and QoS processing are performed (step S48). If the conditions are not matched, filtering and QoS processing are not performed (step S47).

  If the packet is after the second fragment packet, the option header inserted in the packet is first obtained (step S42), the layer 4 information of the original packet is obtained from the option header (step S43), and thereafter The layer 2 and 3 information is acquired from the packet (step S44), and steps S46 to S49 are executed. Then, the packet is passed to the option header deletion unit 46 (step S50).

  FIG. 7 is a flowchart showing details of the process (step S5 in FIG. 3) of the option header deleting unit 46. When the transfer destination router device or network device / terminal can realize filtering by the option header and QoS function, and this function is required, this processing is not performed (No in steps S51 and S52). If the forwarding destination router device or network device / terminal cannot implement filtering or QoS function by option header or does not require this function, the option header inserted in the packet is deleted (steps S52 and S53), The process ends (step S54).

  Next, the fragment identifier management table 43 will be described. This table 43 has a table in which the fragment identifier and the layer 4 information of the packet are associated with each other on the memory, and as shown in FIG. 8, the fragment identifier and the layer 4 information acquired by the fragment packet analysis unit 42 are It has a function of registering in the fragment table (steps S13 to S15). Further, as shown in FIG. 9, this table 43 has a function of providing layer 4 information corresponding to the fragment identifier specified by the option header insertion unit 44 (steps S16 to S19), as well as FIG. As shown in FIG. 5, the identifier specified by the option header insertion unit 44 is also deleted from the fragment table (steps S20 to S23).

  FIG. 11 is a diagram for explaining the operation of the present invention. The operation in the case of transmitting image data from the terminal A to the terminal B using the router 1A to the router 1C will be described. In this configuration example, the routers 1 </ b> A to 1 </ b> C are set with a QoS setting such that communication using the UDP port 8000 performs highest priority communication, and other communication packets perform low priority communication. It shall be.

  It is assumed that the network uses IPv6 and the communication packet is fragmented. A large amount of packets are communicated from terminal C to terminal B, and the loads on routers 1B and 1C are high. For this reason, low priority packets are discarded.

  A conventional QoS process will be described with reference to FIG. First, image data (Pa, Pb in the figure) is transmitted from the terminal A to the terminal B. The packet Pa is subjected to the highest priority communication according to the QoS condition set in the router 1A. However, since the packet Pb does not match the QoS condition, low priority communication is performed. In the router 1B, a large amount of data communication is performed from the terminal C to the terminal B.

  The packet Pa is subjected to the highest priority communication according to the QoS condition set in the router 1B. However, since the packet Pb does not match the QoS condition, the low priority communication is performed. Since the router 1B has a high load due to a large amount of data communication from the terminal C, the packet Pb which is a low priority packet is discarded. For this reason, only the packet Pa reaches the router 3. The packet Pa is subjected to the highest priority communication according to the QoS condition set in the router 1C.

  Since only packet Pa can reach terminal B, terminal B cannot receive image data. Originally, although packets Pa and Pb are both packets that should be prioritized, priority communication is not performed depending on the QoS conditions set in the router. As a result, the terminal B cannot see the image.

  The QoS processing according to the present invention will be described with reference to FIG. First, image data (Pa, Pb in the figure) is transmitted from the terminal A to the terminal B. At this time, the QoS processing performed in the router 1A will be described with reference to FIG. The packet received from the hardware unit 2 in FIG. 1 is transferred to the TCP / IP 5 through the hardware control driver, and routing processing is performed. Thereafter, the packet is transferred to the received packet sorting unit 41 in the option header setting unit 4. Since the packet option header is not added to the packet at this time, the received packet sorting unit 41 passes the packet to the fragment packet analyzing unit 42. The fragment packet analysis unit 42 acquires a fragment identifier and layer 4 information from the first fragment packet and registers the information in the fragment identifier management table 43.

  After registration, the packet is passed to the option header insertion unit 44. The option header insertion unit 44 acquires, from the fragment table, layer 4 information that matches the fragment identifier set in the packet from the fragment identifier management table 43. An option header is created based on this information, and the option header is inserted into the second fragment packet. After insertion, the packet is passed to the option header analysis unit 45.

  The option header analysis unit 45 acquires information necessary for filtering and QoS (layer 2 to 4 information) from the packet, and checks whether the information matches the filtering and QoS information set in the router 1. In the case of QoS processing of packet Pa, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the protocol header. Thereafter, it is determined whether the QoS conditions set in the router 1 match the acquired information.

  In this embodiment, since the condition of the router 1 matches the acquired information, it is processed as a high priority processing packet. In the case of QoS processing of the packet Pb, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the option header. Thereafter, it is determined whether the QoS conditions set in the router 1 match the acquired information. In this embodiment, since it matches the conditions of the router 1, it is processed as a high priority processing packet.

  When the packet to be analyzed is the final fragment packet, the pair of the fragment identifier and the layer 4 information registered in the fragment table of the fragment identifier management table 43 is deleted. After the QoS and fragment table deletion processing, the packet is passed to the option header deletion unit 46. The option header deletion unit 46 has a function of deleting the inserted option header, but the next router (1B) does not delete the option header because it has a QoS function based on the fragment option header. Thereafter, the packet is passed to the hardware control driver 3. Since the packet is processed as a priority packet by the above processing, the hardware control driver 3 performs high priority processing on the packet. Through these processes, high priority processing is performed for both the packets Pa and Pb.

  The QoS process performed in the router 1C will be described with reference to FIG. The packet received from the hardware 2 is transferred to the TCP / IP 5 through the hardware control driver 3 and subjected to routing processing. Thereafter, the packet is transferred to the received packet sorting unit 41 in the option header setting unit 4. The packet received from the router 1A is a fragment packet, and is a packet having an option header added according to the present invention. This packet is delivered to the option header analysis unit 42 by the received packet sorting unit 41.

  The option header analysis unit 45 acquires information (layer 2-4 information) from the packet, and checks whether the information matches the filtering and QoS information set in the router 1B. In the case of QoS processing of packet Pa, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the protocol header. Thereafter, it is determined whether or not the QoS condition set in the router 1B matches the acquired information. In this embodiment, since the condition of the router 1B matches the acquired information, it is processed as a high priority processing packet.

  In the case of QoS processing of the packet Pb, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the option header. Thereafter, it is determined whether or not the QoS condition set in the router 1B matches the acquired information. In this embodiment, since the condition of the router 1B matches the acquired information, it is processed as a high priority processing packet. After the QoS processing, the packet is passed to the option header deletion unit 46. The option header deleting unit 46 has a function of deleting the inserted option header, but the next router 1C does not delete the option header because it has a QoS function based on the fragment option header.

  Thereafter, the packet is passed to the hardware control driver 3. Since the packet is processed as a priority packet by the above processing, the hardware control driver 3 performs high priority processing on the packet. By these processes, high priority processing is performed for both packets Pa and Pb.

  The QoS process performed in the router 1C will be described with reference to FIG. The packet received from the hardware 2 is transferred to the TCP / IP 5 through the hardware control driver 3 and subjected to routing processing. Thereafter, the packet is transferred to the received packet sorting unit 41 in the option header setting unit 4.

  The packet received from the router 1B is a fragment packet and is a packet having an option header added according to the present invention. This packet is delivered to the option header analysis unit 42 by the received packet sorting unit 41. The option header analysis unit 42 acquires information (layer 2 to 4 information) from the packet, and checks whether the information matches the filtering and QoS information set in the router 1C. In the case of QoS processing of packet Pa, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the protocol header.

  Thereafter, it is determined whether the QoS conditions set in the router 1C match the acquired information. In this embodiment, since the conditions of the router 1C match the acquired information, it is processed as a high priority processing packet. In the case of QoS processing of the packet Pb, first, layer 2 information is obtained from the Ether header, layer 3 information is obtained from the IPv6 header, and layer 4 information is obtained from the option header. Thereafter, it is determined whether the QoS conditions set in the router 1C match the acquired information. In this embodiment, since the conditions of the router 1C match the acquired information, it is processed as a high priority processing packet.

  After the QoS processing, the packet is passed to the option header deletion unit 46. The option header deleting unit 46 has a function of deleting the inserted option header. Since the terminal B transferred from the router 1C is the final arrival point of this packet, the option header added to this packet is deleted. After deletion, the packet is passed to the hardware control driver 3. Since the packet is processed as a priority packet by the above processing, the hardware control driver 3 performs high priority processing on the packet. By these processes, high priority processing is performed for both packets Pa and Pb. Packets Pa and Pb arrive at terminal B and can receive image data.

It is a schematic block diagram of the router apparatus by embodiment of this invention. It is a block diagram which shows the specific example of the router apparatus of FIG. It is a flowchart explaining operation | movement of embodiment of this invention. 4 is a flowchart for explaining the operation of a fragment bucket analysis unit 42. 10 is a flowchart illustrating an operation of an option header insertion unit 44. 6 is a flowchart illustrating an operation of an option header analysis unit 45. 10 is a flowchart for explaining the operation of an option header deletion unit 46. It is a flowchart explaining the registration function operation | movement of the fragment identifier management table 43. FIG. It is a flowchart explaining the information acquisition function operation | movement of the fragment identifier management table 43. FIG. It is a flowchart explaining the deletion function operation | movement of the fragment identifier management table 43. FIG. It is a figure which shows the example of the system block diagram of the Example of this invention. It is a figure for demonstrating the QoS process in the past. It is a figure for demonstrating the QoS process in this invention. It is a figure for demonstrating operation | movement of the option header setting part 4 in the router 1A in FIG. It is a figure for demonstrating operation | movement of the option header setting part 4 in the router 1B in FIG. It is a figure for demonstrating operation | movement of the option header setting part 4 in the router 1C in FIG. It is a figure for demonstrating a fragment packet. It is a figure for demonstrating the QoS management process by layer 3 information. It is a figure for demonstrating the QoS management process by the layer 4 information by a prior art.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Router apparatus 2 Hardware 3 Hardware control driver 4 Option header setting part 5 TCP / IP
41 Received packet distribution unit 42 Fragment packet analysis unit 43 Fragment identifier management table 44 Option header insertion unit 45 Option header analysis unit 46 Option header deletion unit

Claims (7)

A router device configured to perform filtering processing and QoS (Quality of Service) processing of the received packet based on header information added to the received packet,
When the received packet is a fragment-processed packet, header information for obtaining header information for the filtering process and QoS process from the first fragment packet and controlling the insertion of the header information for the subsequent fragment packet A router device comprising insertion control means. The header information insertion control means includes
Registration means for registering the fragment identifier set in the first fragment packet and the header information as a set;
When the fragment identifier set in the subsequent fragment packet matches the fragment identifier registered in the registration unit, header information corresponding to the fragment identifier registered in the registration unit The router apparatus according to claim 1, further comprising a means for adding to the fragment packet. Packet processing means for performing filtering processing and QoS processing based on the header information added to the fragment packet;
3. The router apparatus according to claim 1, further comprising means for deleting the added header information from the fragment packet processed by the packet processing means. A packet processing method of a router device that performs filtering processing and QoS (Quality of Service) processing of the received packet based on header information added to the received packet,
When the received packet is a fragment-processed packet, header information for obtaining header information for the filtering process and QoS process from the first fragment packet and controlling the insertion of the header information for the subsequent fragment packet A packet processing method comprising an insertion control step. The header information insertion control step includes
A registration step of registering a fragment identifier set in the first fragment packet and the header information as a set;
When the fragment identifier set in the subsequent fragment packet matches the fragment identifier registered in the registration unit, the header information corresponding to the fragment identifier registered in the registration step is changed to the subsequent The packet processing method according to claim 4, further comprising a step of adding to the fragment packet. A packet processing step for performing filtering processing and QoS processing based on header information added to the fragment packet;
6. The packet processing method according to claim 4, further comprising a step of deleting the added header information from the fragment packet processed by the packet processing means. A program for causing a computer to execute a packet processing method of a router device configured to perform filtering processing and QoS (Quality of Service) processing of the received packet based on header information added to the received packet,
When the received packet is a fragment-processed packet, header information for obtaining header information for the filtering process and QoS process from the first fragment packet and controlling the insertion of the header information for the subsequent fragment packet A program including an insertion control process.

Images