JP2005236665A - Method, program, and apparatus for monitoring unauthorized routing - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To monitor unauthorized access in communication using IP and Ethernet (R). <P>SOLUTION: An unauthorized routing monitoring method comprises a first step of collecting the routing table 311 of a router and an ARP (Address Resolution Protocol) table 312; a second step of detecting IP address information of a GW (gateway) indicating a route of the network registered in the routing table 311; a third step of detecting whether MAC (media access control address) address information, registered in the ARP table 312, of a GW corresponding to the IP address information of the detected GW is correct or not; and a fourth step of outputting the fact that the MAC (Media Access Control Address) address information of the GW corresponding to the IP address information of the GW is not correct if it is detected as incorrect. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a technique for monitoring unauthorized routing in a network using IP (Internet Protocol) and Ethernet (registered trademark).

Currently, a network system in which a terminal is connected to form a LAN (Local Area Network) and can be connected from the LAN to an external network such as the Internet via a router has become widespread. In such an Ethernet (registered trademark) network system, since various terminals are used, an IP suitable for use by a multi-vendor is used.
Further, in such a network system, there is a case where an unauthorized access is made to a terminal connected to the LAN from the external network or the LAN. In order to monitor such unauthorized intrusion, a technology has been proposed that collects information on the configuration and usage status of resources of information devices connected to the network and detects unauthorized use and unauthorized connection (for example, Patent Documents). 1).

  As shown in FIG. 11, this prior art has a configuration in which two LANs (Local Area Networks) 11 and 12 are connected to the Internet 13 and information can be exchanged through the Internet 13. Connected to the Internet 13 is a network centralized monitoring device 14 that monitors the network usage status and the like, and is connected to an anti-virus vaccine distribution Web site 15 that provides a latest vaccine download service against computer viruses. The LANs 11 and 12 have unauthorized access to information devices 111 and 112 such as computers, a mail server 113 for sending and receiving mail, a file server 114 for managing files, a proxy server 115 for setting proxy settings, and unauthorized access. A firewall server 116 for prevention is connected to a monitoring device 117 that monitors the connection status and traffic of information devices in the LAN. Each information device 111, 112 is equipped with an agent that collects the configuration and usage status of resources in the information devices 111 and 112, and the usage status by the user, and virus detection means for introducing a vaccine against a computer virus. Further, the network centralized monitoring device 14 acquires information on the resource configuration and usage status of the information device collected by the agent of each information device, recognizes the resource configuration and usage status of each information device in the network, and Unauthorized use and unauthorized connection are detected.

JP 2002-149435 JP

In the above-described conventional technology, information on the configuration and usage status of information equipment resources must be collected by the network centralized monitoring device 14 one by one, which increases the processing load. In other words, in the above prior art, it is necessary for the network centralized monitoring device 14 to grasp all the usage conditions in the network. For this reason, the processing in the network centralized monitoring device 14 increases as the network scale increases.
An object of the present invention is to solve the above-described problems, and to provide a technique for detecting unauthorized connection more easily in a network using IP and Ethernet (registered trademark).

In order to achieve the above object, the present invention provides an unauthorized routing monitoring method for monitoring unauthorized routing in a router connected to a network using IP (Internet Protocol) and Ethernet (registered trademark). A first step of collecting routing table information and ARP (Address Resolution Protocol) table information, and a second step of detecting IP address information of a GW (gateway) indicating a route of the network registered in the routing table information A third step of detecting whether or not the MAC (Media Access Control Address) address information of the GW corresponding to the detected GW IP address information registered in the ARP table information is valid; GW MAC address information corresponding to the GW IP address information is And a fourth step of outputting a message to that effect when it is detected that it is not valid.
According to the present invention, for example, when the routing table of the router is illegally rewritten, virtual routing information is set, and unauthorized access occurs, the MAC address of the virtual routing information is generated. Since the information does not exist, unauthorized connection can be detected more easily by verifying the validity of the MAC address information corresponding to the IP address information of the GW.

According to the present invention, unauthorized connection can be detected more easily by verifying the validity of the MAC address information corresponding to the GW-IP address information.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows a configuration diagram of a network system using IP (Internet Protocol) and Ethernet (registered trademark) according to the first embodiment of the present invention. In the first embodiment, a case where the terminal detects unauthorized access and notifies the management terminal is taken as an example.
In FIG. 1, a LAN (local area network) 1 is connected to a monitoring center 260 via a network 270 such as the Internet. Connected to the LAN 1 are a plurality of terminals 201 A, B, C such as personal computers, a server 230, a management terminal 240 for managing the LAN 1, and a router (GW) 220 A for connecting the LAN 1 to the network 270. Has been. Each of the terminals 201A, B, and C can communicate with the server 230 as a client computer. In addition, communication with a terminal of another network can be performed via the router 220A and the network 270. In FIG. 1, each of the server 230, the management terminal 240, and the terminals 201A, B, and C has an operating system system (OS) 271, an application program AP272 for performing various operations, and unauthorized access in the present embodiment. A monitoring program (monitoring PRO) 273 and a setting table T274 that stores various setting information such as routing information for connecting to a network are provided.
The unauthorized access monitoring program 273 is software for monitoring unauthorized access by judging the validity when routing information is newly set in the setting table T274. The setting table T274 stores an IP address and MAC address (Media Access Control Address) that are address information of the terminal, routing information and ARP information that is address information of the destination terminal. The routing information may be either static routing or dynamic routing. FIG. 2 shows a setting table T274 stored in the terminal 201A. In FIG. 2, the setting table T274 includes own terminal information 310 that stores the IP address and MAC address of the own terminal in association with each other, a routing table 311 that stores routing information, and an ARP (Address Resolution Protocol) that stores ARP information. ) Table 312. In the routing table 311, for each destination terminal, the IP address of the destination terminal and the IP address of the GW that passes between the destination terminals are stored in association with each other. The ARP table 312 stores a GW IP address and a GW MAC address in association with each GW.
Next, FIG. 3 shows an example of the setting table T274 when contents are added illegally. In the example shown in FIG. 3, the setting table T274 is illegally rewritten to include the destination terminal IP address 192.168.1.1/32 and the GW IP address 10.0.0.100 via In addition, a record including the GW IP address 10.0.0.1 and the GW MAC address dddd.ddd.ddd is added to the ARP table 312. In the present embodiment, when the routing table 311 of the terminal is illegally rewritten, virtual routing information is set, and transmission / reception is performed using the virtual routing information, the virtual routing information is set. Since the MAC address information of the routing information does not actually exist, fraud is detected by verifying whether the MAC address information exists by making an inquiry described later.
Next, the hardware configuration of the terminals 201A, B, and C is shown in FIG. The terminals 201A, B, and C are electronic computers such as personal computers. As shown in FIG. 4, a CPU 401, a memory 403 such as a ROM and a RAM, an input device 402 such as a keyboard, and a display 404 for displaying processing results and the like are provided. The OS 271, AP 272, monitoring program 273, and setting table 274 described above are stored in the memory 403. The CPU 401 executes the OS 271, AP 272, and monitoring program 273 stored in the memory 403.

  In the configuration shown in FIG. 1, the first embodiment will be described by taking as an example a case where when the terminal 211 illegally accesses the terminal 201A, the terminal 201A detects unauthorized access.

In the terminal 201A, the unauthorized access monitoring program 273 according to the present embodiment is installed in advance, and this unauthorized access monitoring program 273, when routing information is newly registered in the setting table T274 as shown in FIG. Alternatively, it is activated at a predetermined time. The activation cycle may be regular or irregular. In the present embodiment, it is assumed that routing information registration includes routing information registration for transmission / reception with a legitimate terminal and virtual routing information registration by an unauthorized terminal. In the event that transmission / reception occurs using the virtual routing information, an unauthorized terminal can receive a packet in which the virtual routing information is set as the destination, Since the MAC address information of the routing information does not exist, it does not respond to inquiries such as reverse ARP (RARP) command, ARP command, and Ping (Packet Internet Groper) command. Detected.
The unauthorized access monitoring program 273 in this embodiment determines that unauthorized access has been performed when the following three conditions A, B, and C are satisfied.
(Condition A) Routing information that passes through a gateway other than the default route exists in the routing table 311.
(Condition B) The MAC address associated with the IP address of the gateway satisfying the condition A exists in the ARP table 312.
(Condition C) The MAC address registered in the ARP table 312 satisfying the condition B is different from the actual one.
These conditions A, B, and C are shown in flowcharts in FIGS. Routing information via the gateway (GW) other than the default route exists in the routing table 311 (condition A), and the MAC address associated with the IP address of the gateway exists in the ARP table 312 (condition B). When the MAC address is different from that of a real GW registered in advance (condition C), it is determined to be illegal.
Hereinafter, the operation of the unauthorized access monitoring program 273 will be described with reference to the flowcharts (Nos. 1 to 4) shown in FIGS. 6 to 9 show flowcharts (parts 1 to 4) of the fraud monitoring program in the first embodiment.
In FIG. 6, the unauthorized access monitoring program 273 indicates that the GW IP address (GW-IP address) of the registered routing information is registered when a record of the routing table 311 is newly registered or periodically. It is determined whether it is registered in the ARP table 312 of the setting table T274 (S601). If the GW-IP address is not registered in the ARP table 312, it is determined that no fraud has been made because communication cannot be performed. If the GW-IP address is registered in the ARP table 312, it is verified whether or not the MAC address of the GW corresponding to the GW-IP address registered in the ARP table 312 is valid (S603). This process will be described later with reference to FIGS. In the example shown in FIG. 3, the MAC address dddd.dddd.dddd of the ARP table 312 corresponding to the GW-IP address 10.0.0.1 of the newly added routing table 311 is verified.
After verification, if there is a suspicion of unauthorized MAC address (S604), the display 404 indicates that there is a possibility of unauthorized access (S605). FIG. 5 shows an explanatory diagram of a display example displayed on the display 404. As shown in FIG. 5, when fraud is detected,
“IP address 10.0.0.1 MAC address dddd.dddd.dddd” and the detected result are displayed. Further, when fraud is detected, an alarm sound or the like may be sent out, or the fraudulent record may be cleared from the routing table 311 and the ARP table 312.
In FIG. 6, if the MAC address is valid, another new record of the routing table 311 is verified (S602). Alternatively, if it is periodically activated, the unauthorized access monitoring program 273 is terminated after verifying all the records.
Next, the processing in S603 of FIG. 6 will be described with reference to FIGS. In order to verify the validity of the MAC address, in the terminal 201A, the unauthorized access monitoring program 273 requests a reverse ARP (RARP) command to the network 270 (S701). In this case, the GW-IP MAC address detected in S601 is input as a reverse ARP request. When there is an RARP response (S702), an IP address is acquired from the RARP response (S703), and whether the acquired IP address matches the IP address of the ARP table 312 is compared (S704). If they match, it is determined that there is no fraud, and the process proceeds to S800 shown in FIG. 8 (S705). If they do not match, it is determined that there is a suspicion of fraud (S707), and the process proceeds to S604 shown in FIG. 6 (S707). Also, if the RARP response is not within a certain period of time, it is assumed that there is an unauthorized routing, a failure has occurred, or that an unauthorized router has been installed (S706), and the process proceeds to S604 shown in FIG. 6 (S707). ).
Next, in S801 in FIG. 8, the unauthorized access monitoring program 273 requests the network 270 for ARP in order to obtain the MAC address from the IP address (S801). In this case, the GW-IP IP address detected in S601 is included in the ARP request. When there is an ARP response (S802), the MAC address is acquired from the ARP response (S803), and the acquired MAC address and the MAC address corresponding to the GW-IP address of the ARP information in the ARP table 312 are obtained. Whether or not they match is compared (S804). If they match, it is determined that there is no fraud, and the process proceeds to S901 shown in FIG. 9 (S805). In the case of mismatch, it is determined that there is a suspicion of fraud, and the process proceeds to S604 shown in FIG. 6 (S807). If the ARP response is not within a certain period of time, it is assumed that there is an unauthorized routing, a failure has occurred, or an unauthorized router has been installed (S806), and the process proceeds to S604 shown in FIG. 6 (S807). ).
Next, in S901 shown in FIG. 9, the unauthorized access monitoring program 273 requests the network 270 for a Ping (Packet Internet Groper) command (S901). In this case, the destination is the GW-IP address detected in S601 shown in FIG. If there is a Ping response, the ARP table 312 is updated. Therefore, the ARP table 312 is searched again, and the MAC address for the GW-IP address is acquired (S902). Whether or not the MAC addresses match is compared (S903). If they match, it is determined that there is no fraud, and the process proceeds to S602 shown in FIG. 6 (S904). If they do not match, it is determined that there is a suspicion of fraud (S906), and the process proceeds to S604 shown in FIG. If there is no Ping response within a certain period of time, it is assumed that there is an unauthorized routing, a failure has occurred, or an unauthorized router has been installed (S906), and the process proceeds to S604 (S906).
As described above, unauthorized access can be detected more easily by verifying the validity of the MAC address of the GW-IP address. Further, the flowcharts shown in FIGS. 7 to 9 verify in the order of FIGS. 7, 8, and 9 when fraud is not detected. Good.
Further, when the fraud is detected, the terminal 201 may notify the management terminal 240 or the monitoring device 250 of the monitoring center 260 that the fraud has been detected. In this case, when the management terminal 240 or the monitoring device 250 of the monitoring center 260 receives a notification of fraud detection from the terminal 201, it can indicate that there is a possibility of unauthorized access on the display.
Next, a second embodiment will be described. In the first embodiment, the unauthorized access is detected in the terminal. In the second embodiment, the monitoring device 250 of the monitoring center 260 shown in FIG. 1 detects that the unauthorized routing is set in the router 220A. How to do will be explained. The router in the present embodiment includes a setting table T274 of the routing table 311 and the ARP table 312 similar to those of the terminal 201 described above, and supports SNMP (Simple Network Management Protocol). Also in this embodiment, the configuration of the network system is the same as that of the first embodiment. The configuration of the monitoring device 250 is the same as the configuration of the terminal shown in FIG. In the monitoring device 250, the unauthorized access monitoring program 273 in the second embodiment is installed in advance, and is activated at a predetermined time. The activation cycle may be regular or irregular. Also in the present embodiment, it is assumed that the registration of routing information includes the registration of routing information for transmission / reception with a legitimate terminal and the registration of virtual routing information with an unauthorized terminal. . In the event that transmission / reception occurs using the virtual routing information, an unauthorized terminal can receive a packet in which the virtual routing information is set as the destination, Since the MAC address information of the routing information does not actually exist, it does not respond to an inquiry about a Ping (Packet Internet Groper) command. Therefore, fraud is detected by executing these commands.
FIG. 10 shows a flowchart of the unauthorized access monitoring program 273 in the second embodiment.
In the monitoring device 250, the unauthorized access monitoring program 273 collects the routing table 311 and the ARP table 312 of the router 220A by SNMP (S1001, S1002). It is determined whether the gateway (GW) -IP address of the routing information is registered in the ARP table 312 (S1003). If the GW-IP address is not registered in the ARP table 312, it is determined that no fraud has been made because communication cannot be performed. If the GW-IP address is registered in the ARP table 312, it is determined whether or not Ping can be executed on the GW from the router (S1004), and if possible, the router is executed to ping the GW. (S1006). If not possible, Ping is executed from the monitoring device 250 to the GW (S1005). In this case, by registering the identification information of the router that can execute Ping in the monitoring device 250 in advance, if it is a registered router, it is determined that Ping can be executed in that GW and registered. Otherwise, it is determined that it is impossible to execute. The destination is the GW-IP address detected in S1003. If there is a Ping response (S1007), since the ARP table 312 is updated, the ARP table 312 is searched again, and the MAC address for the GW-IP address is acquired (S1009). It is compared whether or not the MAC address before execution matches (S1010). If they do not match, it is determined that there is a suspicion of fraud (S1011), and this is displayed on the display as shown in FIG. If the Ping response is not within a certain period of time, it is assumed that there is a suspicion of fraud if there is a suspicion of unauthorized routing, a failure, or an unauthorized router (S1008). As shown in FIG.
After verifying all the records in the routing table 311, if there are a plurality of routers, other router verification is also performed (S1012).

  As described above, in the monitoring device, it is possible to detect that illegal routing has been set by collecting the router setting table T274 and verifying the validity of the routing information.

The system block diagram in 1st Embodiment. Explanatory drawing of the setting table T274 in 1st Embodiment. Explanatory drawing of the setting table T274 in 1st Embodiment. The block diagram of the terminal in 1st Embodiment. Explanatory drawing of the example of a display at the time of fraud detection in 1st Embodiment. The flowchart (the 1) of the fraud monitoring program in 1st Embodiment. The flowchart (the 2) of the fraud monitoring program in 1st Embodiment. The flowchart (the 3) of the fraud monitoring program in 1st Embodiment. The flowchart (the 4) of the fraud monitoring program in 1st Embodiment. The flowchart of the fraud monitoring program in 2nd Embodiment. The block diagram in a prior art.

Explanation of symbols

201A, B, C ... terminal, 220A / B ... router, 230/260 ... server, 240 ... management terminal, 250 ... monitoring device, 260 ... monitoring center, 1 ... LAN, 270 ... network.

Claims (5)

An unauthorized routing monitoring method for monitoring unauthorized routing in a router connected to a network using IP (Internet Protocol) and Ethernet (registered trademark),
A first step of collecting routing table information and ARP (Address Resolution Protocol) table information of the router;
A second step of detecting IP address information of a GW (gateway) indicating a route of the network registered in the routing table information;
A third step of detecting whether or not the MAC (Media Access Control Address) address information of the GW corresponding to the detected GW IP address information registered in the ARP table information is valid;
And a fourth step of outputting the fact when it is detected that the MAC address information of the GW corresponding to the IP address information of the GW is not valid. In the unauthorized routing monitoring method according to claim 1,
The third step includes
Executing a Ping (Packet Internet Groper) command with the IP address information of the GW as a destination for the network;
Collecting ARP table information after execution of the Ping command;
Comparing whether the MAC address information of the GW and the MAC address information of the GW in the ARP table information after execution of the Ping command match;
A step of determining that the MAC address information of the GW is not valid when the comparison does not match and the response of the Ping command is not received within a predetermined time. Monitoring method. In the unauthorized routing monitoring method according to claim 1,
The third step includes
Instructing the router to execute a Ping (Packet Internet Groper) command with the IP address information of the GW as a destination;
Collecting ARP table information after execution of the Ping command;
Comparing whether the MAC address information of the GW and the MAC address information of the GW in the ARP table information after execution of the Ping command match;
A step of determining that the MAC address information of the GW is not valid when the comparison does not match and the response of the Ping command is not received within a predetermined time. Monitoring method. An unauthorized routing monitoring program for monitoring unauthorized routing in a router connected to a network using IP (Internet Protocol) and Ethernet (registered trademark),
The unauthorized access monitoring program
A first step of collecting routing table information and ARP (Address Resolution Protocol) table information of the router;
A second step of detecting IP address information of a GW (gateway) indicating a route of the network registered in the routing table information;
A third step of detecting whether or not the MAC (Media Access Control Address) address information of the GW corresponding to the detected GW IP address information registered in the ARP table information is valid;
And executing a fourth step of outputting the fact when it is detected that the MAC address information of the GW corresponding to the IP address information of the GW is not valid. An unauthorized routing monitoring device that monitors unauthorized routing in a router connected to a network using IP (Internet Protocol) and Ethernet (registered trademark),
A collecting means for collecting routing table information and ARP (Address Resolution Protocol) table information of the router;
Detecting means for detecting IP address information of a GW (gateway) indicating a route of the network registered in the routing table information;
Legitimacy detecting means for detecting whether or not the MAC (Media Access Control Address) address information of the GW corresponding to the detected IP address information of the GW registered in the ARP table information is valid;
An unauthorized routing monitoring apparatus comprising: output means for outputting a message to the effect that the validity detecting means detects that the MAC address information of the GW corresponding to the IP address information of the GW is not valid .

Images