JP2005260520A - Method and device for detecting reply attack error - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent occurrence of a reply attack error by sequence number inversion at the time of QoS setting in IPSec communication. <P>SOLUTION: A memory device 51 has window sets 51-1 to 51-n recording reception history of sequence numbers of received packets on SA by individual QoS classes for the respective SAs (security associations). When receiving the packet on the SA, a reply attack error detecting part 52 detects presence or absence of the reply attack error on the basis of an SPI number 54 included in the header of the received packet, the reception history stored in accordance with the QoS class in the window set which is decided by QoS class information 56 and a received sequence number 55 included in the header of the received packet. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a method and apparatus for preventing a reply / attack error caused by reversing the output order of packets having different QoS classes in IPSec processing using the QoS function.

  Network security is data that is important from the wonders of malicious eavesdropping, tampering, and impersonation by encrypting data when important data is exchanged over the Internet. It is a concept that protects. The QoS function is a technique for guaranteeing quality for each service provided in the network. These functions are important in terms of "security" and "smooth quality assurance" while various applications such as data systems and voice systems are used in today's internet-VPN network environment.

  A typical network architecture that realizes QoS required by various types of traffic is Diffserv (Differentiated Services) (see, for example, Non-Patent Document 1). Fig. 9 shows an example of the network structure of Diffserve. Diffserve network routers are broadly classified into edge routers installed at the boundary between the user terminal and the network, and internal routers inside the network. The edge router that receives the traffic from the user terminal identifies the traffic based on a prior service level agreement (SLA) between the user and the network, classifies the packet into several QoS classes, and responds to the QoS class. The priority information (DSCP: DiffServ Code Point) is described in the IP header of each packet and transferred to the internal router. QoS classes include EF (Expedited Forwarding), AF (Assured Forwarding), and BF (Best effort), and EF and AF are further subdivided into several classes. The internal router differentiates QoS between classes by performing priority control and discard processing according to the DSCP of received packets.

  On the other hand, IPSec communication is a typical network security technology. IPSec is standardized by the Internet Engineering Task Force (IETF), which is an Internet standardization organization, and is the most commonly used encryption communication technology for VPN (Virtual Private Network). Hosts that communicate with each other using IPSec negotiate with the other host in advance the encryption type and encryption key used in IPSec. This agreement is called SA (Security Association), and communication using encrypted packets is started after SA establishment. In the packet encrypted by IPSec, the encrypted communication content is packed in ESP (Encapsulating Sesurity Payload) and transmitted. ESP includes SPI (Security Parameters Index), sequence number, authentication data, etc. in addition to encrypted communication contents. The SPI is an identifier for uniquely identifying the SA. The sequence number is provided as a response to a reply attack (reply attack) such as a DoS (Denial of Service) attack. The principle of protecting against a reply attack using a sequence number is as follows.

The sending side sets the sequence number counter to 0 when creating the SA, and sets the sequence number incremented by 1 each time a packet is sent and sends it in the packet header. The receiving side takes a reception history of the sequence number for each SA, and when a packet with the same sequence number is received repeatedly, or a predetermined number from the maximum sequence number received in the past (this number is the window size ( window size))) If a packet with a smaller sequence number is received, it is detected as an error and the packet is discarded. A reply attack is a packet sent by a third party with malicious intent to intercept communication contents, pretending to be a party, and as described above, every time a packet is sent on the sending side. By counting up the sequence number and confirming the sequence number sequence on the receiving side, it is possible to eliminate illegal packets. However, strictly speaking, there is a case where packets do not arrive at the receiving side in the order of the sequence numbers, so that only a window size is allowed.
"Differentiated Services (Diffserv) Architecture", [online], [Search February 5, 2004], Internet <URL: http://www.mos.ics.keio.ac.jp/lecture/acn/3.1Diffserv .ppt>

  As mentioned above, in today's internet-VPN network environment, while various applications such as data and voice are used, QoS function and IPSec communication are required in terms of "security" and "fine quality assurance". Is an important function, but when QoS settings are configured for IPSec communication in a conventional system, the packet output priority is determined by the QoS classification function, and the sequence number assigned to each packet by IPSec processing is determined. There is a problem that the order is reversed and a reply / attack error occurs on the receiving side. In order to prevent this reply / attack error, it is necessary to create separate SAs for the data system and the voice system, or to turn off the reply / attack prevention function. In the former case, the security performance will be reduced. In the latter case, there is a problem that SA is consumed more than necessary.

  Therefore, the present invention eliminates the need for weakening the security (reply-attack function off) in order to avoid a reply-attack error caused by sequence number reversal when performing QoS setting for IPSec communication. The purpose is to make it possible to use the QoS function in IPSec communication without consuming extra SA resources (using SA for each QoS class).

  According to the first reply / attack error detection method of the present invention, the reception history of the sequence number of the received packet related to the security association is recorded for each QoS class corresponding to the security association, and the received packet related to the security association is recorded. A reply attack error is detected based on a reception history stored corresponding to the QoS class determined by the QoS class information included in the header of the received packet and a sequence number included in the header of the received packet. To do.

  According to the second reply / attack error detection method of the present invention, in the first reply / attack error detection method, the reception history of the sequence number of the received packet is recorded for at least three types of QoS classes of EF, AF, and BF. It is characterized by.

  The third reply / attack error detection method of the present invention is the first reply / attack error detection method according to the first reply / attack error detection method, for each QoS class, a maximum sequence number holding unit that holds the last received largest sequence number, and a past An n-bit bitmap for recording the reception history of the sequence number, and the sequence number that is smaller by n-1 from the sequence number held in the maximum sequence number holding unit in order from the least significant bit to the most significant bit The reception history of the sequence number is managed using the bitmap corresponding to one-to-one with the reception history of the n sequence numbers up to.

  The fourth reply / attack error detection method of the present invention is the third reply / attack error detection method, wherein the sequence number of the received packet is smaller than the sequence number held in the maximum sequence number holding unit, and the difference between the two If d exceeds n, a reply attack error is set.

  The fifth reply / attack error detection method of the present invention is the fourth reply / attack error detection method, wherein when the difference d between the two does not exceed the value n, the bit d of the bitmap indicates that it has been received. In this case, a reply / attack error is set.

  The first reply / attack error detection device according to the present invention includes a storage unit that records a reception history of a sequence number of a received packet related to the security association for each QoS class in correspondence with the security association, and a reception related to the security association. A reply / attack error is detected based on the reception history stored in the storage means corresponding to the QoS class determined by the QoS class information included in the packet header and the sequence number included in the header of the received packet. And detecting means.

  The second reply / attack error detection device of the present invention is the first reply / attack error detection device, wherein the storage means receives the sequence number of the received packet for at least three types of QoS classes of EF, AF, and BF. A history is recorded.

  According to a third reply / attack error detection device of the present invention, in the first reply / attack error detection device, the storage means holds a maximum sequence number that holds the largest sequence number received last for each QoS class. And an n-bit bitmap for recording the reception history of the past sequence number, in order from the least significant bit to the most significant bit, the sequence number held in the maximum sequence number holding unit A reception history of n sequence numbers up to one smaller sequence number is provided with a bit map corresponding to one to one.

  According to a fourth reply / attack error detection device of the present invention, in the third reply / attack error detection device, the detection means uses the sequence number of the received packet from the sequence number held in the maximum sequence number holding unit. If the difference d between the two exceeds n, a reply / attack error is assumed.

  According to a fifth reply / attack error detection device of the present invention, in the fourth reply / attack error detection device, when the difference d between the two does not exceed the n, the detection unit determines that the bit d of the bitmap is In the case of a value indicating reception completion, a reply / attack error is set.

  According to the reply / attack error detection method and apparatus of the present invention, it is not necessary to weaken the security, and it is possible to use the QoS function in IPSec communication without consuming additional SA resources. The reason for this is that the detection of reply / attack errors is detected based on the sequence number reception history for each QoS class.Even if the sequence number is reversed when QoS setting is performed for IPSec communication, each QoS class This is because the sequence number is not reversed.

  The configuration of the embodiment of the present invention is shown in FIG. In the relationship with FIG. 9, the terminal 102 and the terminal 136 in FIG. 1 correspond to the user terminal in FIG. 9, and the VPN Router A 138 and the VPN Router B 139 correspond to the edge router. Hereinafter, referring to FIG. 1, the present embodiment will be described by taking as an example a case where data is transmitted from terminal 102 of corporate LAN A 101 to terminal 136 of corporate LAN B 137 via Internet 119 in tunnel mode. The configuration and operation will be described.

  The data transmitted from the terminal 102 of the corporate LAN A 101 is traffic in which a data system and a voice system are mixed, and is received by the VPN Router A 138. Packets subject to IPSec processing from the receiving interface unit 103 of VPN Router A 138 are forwarded to the IPSec Engine unit 107, processed by the CPU unit 104 for HDR (header) processing, and then sent to the encryption unit 106 via the PCI bus 105. Is encrypted.

  Packets that have been made IPSec by the IPSec Engine unit 107 are classified into QoS classes by the QoS classifier unit 109 of the QoS Engine unit 108, and are stored in queues classified by the QoS classes of the QoS class / queue unit 110. Since the data transmitted from the terminal 102 of the corporate LAN A 101 is traffic that is a mixture of data and voice data, the voice data is distributed to the EF_2 queue of the QoS class queue unit 110, and the data data Are distributed to the BE queue of the QoS class / queue unit 110. The priority of the data distributed to each QoS class / queue unit 110 is determined by the QoS schedule unit 111. The packets 113, 114, 115, and 116 that are output-controlled by the QoS shaper unit 112 according to priority are transmitted in the tunnel mode from the transmission interface unit 117 to the VPN Router B 139 via the Internet 119 in the tunnel mode. Is done.

  The IPSec packet received by the reception interface unit 120 of the VPN Router B 139 is forwarded to the IPSec Engine unit 121 for decryption processing. Search for any SA123 stored in the SAD database unit 122 of the IPsec Engine unit 121 from the SPI number in the HDR of the forwarded IPSec packet, and use the window size units 124-130 set for each QoS class Check the sequence number. For example, an IPSec packet whose QoS class is EF_2 is checked by checking the reception history of the sequence number using the window size unit 125 for EF_2.

  The sequence number is checked by the window size units 124 to 130 for each QoS class, and the passed IPSec packet is decrypted by the encryption unit 134 via the PCI bus 133, and after the HDR processing by the CPU unit 132, the VPN Router The data is transmitted from the output interface unit 135 of the B 139 to the terminal 136 of the corporate LAN B 137.

  Next, a more detailed operation of the present embodiment will be described with reference to FIGS.

  The data transmitted from the terminal 102 of the corporate LAN A 101 in FIG. 1 is continuously transmitted in the order of HTTP traffic 9 and voice traffic 8 as shown in FIG. Such different types of traffic are received by VPN Router A 138 shown in FIG.

  The data received by VPN Router A 138 is encrypted by the encryption processing unit 10 of the IPSec Engin unit 11 shown in FIG. The IPSec packets 12 and 13 are assigned sequence numbers 14 and 15 for each packet and forwarded to the QoS Engine unit 108 on the egress side shown in FIG.

  The IPSec packet received by the QoS Engine unit 108 is classified by the QoS classifier unit 109 as voice system data and HTTP best effort type data. The packets classified by the QoS classifier unit 109 are stored in the queue units 18 to 23 of the QoS class / queue unit 110 that are classified according to each QoS class. In the case of the present embodiment, the audio data is distributed to the EF_2 queue unit 20, and the HTTP data is distributed to the BE queue unit 18.

  The priority assigned to the data distributed to each QoS class / queue unit is determined by the QoS scheduler unit 111. BE type traffic is output controlled when there is AF and EF traffic. As a result, the QoS shaper unit 112 outputs the voice traffic 28 to 31 classified into EF2 first, and the BE traffic 27 is shaped after the voice traffic 28 to 31 because the priority of the QoS class is low. . In this way, when packets with different QoS classes are sent to VPN Router B 139 via the Internet 119 using the same tunnel, as shown in FIG. 4, the sequence number 32 assigned to the IPSec packet, 33 is received by VPN Router B 139 with the order reversed.

  The IPSec packet received by the VPN Router B 139 is transferred to the IPSec Engine unit 121, and the SAD database unit 122 is searched for the only SA unit 123 corresponding to the unique number based on the SPI number in the ESP header. After the corresponding SA section 123 is searched, the sequence numbers 32 and 33 given to the packet are checked. In the present embodiment, the sequence number 1 included in the HTTP traffic 33 arrives after the sequence numbers 50, 51, 52, 53,... Included in the voice traffic 32 shown in FIG. Therefore, if there is only one window size as in the conventional system, if the window size is 32 bits, an HTTP packet with sequence number 1 will be out of the 32-bit windows size and will be processed as a reply / attack error. End up.

  On the other hand, in this embodiment, as shown in FIG. 4, by having a windows size unit 36 for each QoS class, the windows size unit 36 of the corresponding QoS class checks the sequence number. Therefore, even if the sequence number 1 included in the HTTP traffic 33 arrives after the sequence numbers 50, 51, 52, 53,... Included in the voice traffic 32, the sequence is performed in the windows size unit 36 for each QoS class. No order reversal of numbers occurs, and it is possible to prevent detection of reply / attack errors due to sequence number reversal. The decrypted IP packet is transferred to the output interface unit 135 shown in FIG. 1, and transmitted from the VPN Router B 139 to the terminal 136 of the corporate LAN B.

  Next, an embodiment of a reply / attack error detection mechanism climate in VPN Router B 139 will be described with reference to the drawings.

  Referring to FIG. 5, an embodiment of a reply / attack error detection device provided in VPN Router B 139 includes a memory device 51 and a reply / attack error detection unit 52.

  In the memory device 51, window sets 51-1 to 51-n corresponding to one-to-one are stored in the SA unit 123 existing in the VPN Router B 139. Each of the window sets 51-1 to 51-n includes window information 53-1 to 53-m for each QoS class. For example, when QoS classes are roughly divided into three types, EF, AF, and BF, and EF and AF are further divided into three, there are seven QoS classes in total, so each window set 51-1 ˜51-n includes window information 53-1 to 53-7 for each of the seven QoS classes.

  Each piece of window information 53-1 to 53-m has a 32-bit bitmap bitmap and a last reception sequence number register lastseq. The last reception sequence number register lastseq is a storage area for holding the largest sequence number received last. The bitmap bitmap is a bit string for recording the reception history of past sequence numbers. Since it is 32 bits, in the case of the present embodiment, it is possible to save the reception history from the largest sequence number received last to the sequence number that is smaller by 32. For example, if the largest sequence number received last is 100, the reception history from 69 to 100 can be stored in the bitmap bitmap. If a received packet having a sequence number smaller than 69 is received, an error occurs because there is no reception history and confirmation is not possible. That is, a reply / attack error occurs.

  The reply / attack error detection unit 52 refers to and updates the memory device 51 to detect the presence / absence of a reply / attack error in the received packet. An example of the processing is shown in FIG. Based on the SPI number 54 in the ESP header of the IPSec packet received by VPN Router B 139, the reply / attack error detection unit 52 uses the window set 51-i () corresponding to the SA unit 123 that is uniquely determined by the SPI number. i = 1 to n) (S100), and based on the QoS class information 56 included in the packet, the window information 53-j (j = 1 to m) is determined (S200). As the QoS class information 56, priority information (DSCP: DiffServ Code Point) set in a DS (Differentiated Services) field in the IP header is used. Next, the presence / absence of a reply / attack error is detected based on the determined window information 53-j and the reception sequence number 55 included in the received packet (S300).

  Details of step S300 of FIG. 6 are shown in FIG. The reply / attack error detection unit 52 checks whether seq (reception sequence number 55) is 0 (S301). If seq is not 0 (NO in S301), it is checked whether seq is greater than the last sequence number lastseq received last stored sequence number lastseq in window information 53-j (S302) .

If seq is a sequence number larger than lastseq (YES in S302), a difference value diff obtained by subtracting lastseq from seq is calculated (S303), and it is checked whether the diff is smaller than 32 which is the window size wsizeb (S304). . If it is small, the bitmap bitmap difference value diff
Shift to the left and set bit0 to 1 (S305). Otherwise, the value of the bitmap bitmap is set to 1 (S307). In other words, bit0 is set to 1 and other bits are set to 0. Then, the current reception sequence number seq is stored as lastseq (S306).

  On the other hand, if seq is not larger than lastseq (NO in S302), a difference value diff obtained by subtracting seq from lastseq is calculated (S308), and it is checked whether or not the diff is 32 or more which is the window size wsizeb (S309). If diff is 32 or more (YES in S309), a packet having a sequence number smaller than the last received maximum sequence number lastseq by a window size or more is received, and an error is assumed. If diff is smaller than 32 (NO in S309), it is checked whether the diff-th bit (bit diff) from the lower order of the bitmap bitmap is 1 (S310). If it is not 1, the bit is set to 1 (S311), and if it is 1, it means that the same sequence number packet has been received twice, so that it is an error.

  FIG. 8 shows an example of the state transition of bitmap and lastseq in the window information 53-j. As shown in FIG. 8 (a), in the initial state, all bits of the bitmap are 0, and lastseq is not set. FIG. 8 (b) shows a state immediately after receiving the received packet with the sequence number 101. In the bitmap, only bit 0 is 1, and 101 is stored in lastseq. Starting from this state, the state transitions when the received packets of sequence numbers 102, 103, 110, 108, 103, 60 are received in this order are shown in (c) to (h) of FIG.

  First, when the packet with sequence number 102 is received, since seq> lastseq and diff = 102-101 = 1, after bitmap is shifted 1 bit to the left, bit0 is set to 1 (S305) and lastseq is set to 102 (S306).

  Similarly, when a packet with sequence number 103 is received, since seq> lastseq and diff = 103-102 = 1, after bitmap is shifted 1 bit to the left, bit0 is set to 1 (S305), and lastseq is set to 103. It is set (S306).

  Similarly, when a packet with sequence number 110 is received, since seq> lastseq and diff = 110-103 = 7, after bitmap is shifted 7 bits to the left, bit0 is set to 1 (S305), and lastseq is set to 110 It is set (S306).

  Next, when the packet with sequence number 108 is received, seq <lastseq, diff = 110-108 = 2, diff = 2 <wsizeb = 32, so it is checked whether bit2 of bitmap is 1 (S310), 0 , Bit2 of the bitmap is set to 1 (S311).

  Next, when the packet with sequence number 103 is received, since seq <lastseq, diff = 110-103 = 7, diff = 7 <wsizeb = 32, it is checked whether bit7 of bitmap is 1 (S310), An error is detected. Packets in which errors are detected are discarded.

  Next, when the packet having the sequence number 60 is received, since seq <lastseq, diff = 110-60 = 50, and diff = 50> wsizeb = 32 (YES in S309), an error is detected. Packets in which errors are detected are discarded.

  Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and various other additions and modifications can be made. For example, in the above-described embodiment, the reception history of the sequence number is managed using a 32-bit bitmap, but a bitmap having a larger number of bits such as 64 bits may be used.

It is a figure which shows the structure of embodiment of this invention. It is a figure which shows a mode that the inversion of the sequence number of the packet from which QoS class differs arises in the IPSec process which uses a QoS function. FIG. 5 is an operation explanatory diagram of VPN Router A. FIG. 6 is an operation explanatory diagram of VPN Router B. It is a block diagram of one Example of a reply attack error detection apparatus. It is a flowchart which shows the process example of a reply / attack error detection part. It is a flowchart which shows the detail of step S300. It is a figure which shows an example of the state transition of bitmap and lastseq in window information. It is a figure which shows the network structural example of a differential serve.

Explanation of symbols

51 ... Memory device
51-1 to 51-n ... Window set
52… Reply / Attack Error Detection Unit
53-1 ~ 53-m ... Window information for class
54… SPI number
55 ... Reception sequence number
56 ... QoS class information

Claims (10)

  Corresponding to the security association, the reception history of the sequence number of the received packet related to the security association is recorded for each QoS class, and the QoS class determined by the QoS class information included in the header of the received packet related to the security association A reply / attack error detection method, wherein a reply / attack error is detected on the basis of a reception history stored corresponding to the received message and a sequence number included in a header of the received packet.   2. The reply / attack error detection method according to claim 1, wherein a reception history of a sequence number of a received packet is recorded for at least three types of QoS classes of EF, AF, and BF.   For each QoS class, a maximum sequence number holding unit that holds the largest sequence number received last, and an n-bit bitmap for recording the reception history of past sequence numbers, from the least significant bit to the most significant bit In order up to the bit, using a bit map corresponding to the reception history of n sequence numbers from the sequence number held in the maximum sequence number holding unit to a sequence number smaller by n-1 by one to one, 2. The reply / attack error detection method according to claim 1, wherein a reception history of sequence numbers is managed.   4. The reply according to claim 3, wherein when the sequence number of the received packet is smaller than the sequence number held in the maximum sequence number holding unit and the difference d between both exceeds n, a reply attack error is generated. -Attack error detection method.   5. The reply / attack error detection according to claim 4, wherein if the difference d between the two does not exceed the n, a reply / attack error is detected when the bit d of the bitmap is a value indicating reception completion. Method.   Corresponding to the security association, storage means for recording the reception history of the sequence number of the received packet related to the security association for each QoS class, and the QoS determined by the QoS class information included in the header of the received packet related to the security association A reply attack characterized by comprising: a detection means for detecting a reply / attack error based on a reception history stored in the storage means corresponding to a class and a sequence number included in a header of the received packet. Error detection device.   7. The reply / attack error detection apparatus according to claim 6, wherein the storage unit records a reception history of a sequence number of a received packet for each of at least three types of QoS classes of EF, AF, and BF.   The storage means includes, for each QoS class, a maximum sequence number holding unit that holds the largest sequence number received last, and an n-bit bitmap for recording a reception history of past sequence numbers. In order from the least significant bit to the most significant bit, a bit map corresponding to the reception history of n sequence numbers from the sequence number held in the maximum sequence number holding unit to a sequence number smaller by n-1 by one-to-one 7. The reply / attack error detection apparatus according to claim 6, further comprising:   The detection means, when a sequence number of a received packet is smaller than a sequence number held in the maximum sequence number holding unit, and a difference d between the two exceeds n, a reply / attack error is generated. Item 9. The reply / attack error detection device according to item 8.   10. The detection means according to claim 9, wherein when the difference d between the two does not exceed the n, a reply / attack error is generated when the bit d of the bitmap is a value indicating reception completion. Reply and attack error detection device.

Images