JP2006005555A - Infection and destroy spread prevention system, packet transfer device, packet gathering and analyzing device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable an infection and destroy spread prevention system to prevent virus damage from spreading through a server in a global address space, and also to prevent closed in-office direct infection in a local address pace. <P>SOLUTION: A packet transfer device 2 inquires an input packet from a terminal 1 of a registered terminal list of terminals having been registered. When the packet is judged to be a packet whose safety is not confirmed through the inquiry, the packet is encapsuled and transferred to a packet gathering and analyzing device 3. The packet gathering and analyzing device 3 encapsules and returns only packets whose safety is confirmed to the packet transfer device 2. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention refers to an input packet from a terminal with a registered terminal list registered in advance, and encapsulates a packet whose safety has not been confirmed and forwards it to a packet collection and analysis device, where safety is confirmed. By encapsulating only the received packets again and sending them back to the packet transfer device, it is possible to prevent the spread of virus damage through the servers in the global address space and to prevent direct infection within the company closed in the local address space. It is also related to the damage diffusion prevention system that can be used.

  Cases that are attracting attention as cases where computer virus infection spreads within the company are so-called unmeasured terminals such as laptops that have been taken home (OS, application patch programs are installed, and anti-virus program pattern files are updated) It is an infection from a device that is unknown. There are two main infection patterns as infection patterns from untreated terminals.

  The first is indirect infection, which is a pattern of infection via a server such as a public mail server. The other is direct infection, in which the damage is spread directly from the terminal at the source of infection to other terminals and servers using the company network.

  On the other hand, the corporate network is generally divided into a global space using a global IP address and a local space using a local IP address in terms of IP address system.

  The relationship between the infection pattern and the IP address space described above has some exceptions, but roughly speaking, the indirect infection can be said to be an infection via the global space, and the direct infection can be said to be an infection closed in the local space.

  As a technique for preventing indirect infection, as disclosed in Japanese Patent Laid-Open No. 2002-358253, data from a terminal such as a PC is transferred to a security server placed in a global space, the content is checked, and it is not infection data. A technique is known in which the information is transferred from the security server to the original destination after confirmation.

  With the technique disclosed in Japanese Patent Laid-Open No. 2002-358253, it is possible to prevent indirect infection through the global space, but it is impossible to prevent direct infection closed in the local space for the following reasons. Met.

In the technique disclosed in Japanese Patent Laid-Open No. 2002-358253, the packet is encapsulated and transferred to a security server in the global space, the virus check is performed by the security server, and then the encapsulated header is decapsulated. A packet is being sent to the destination.
In the case of indirect infection, the original destination IP address after decapsulation is usually a global IP address, and since it is an address in the same global space as the security server, transfer from the security server is possible.

  However, in the case of direct infection in which the original destination IP address after decapsulation is the IP address in the local space, the packet having the IP address addressed to the local space is transferred from the security server in the global space, and the transfer itself Becomes impossible. That is, in the case of the technique disclosed in Japanese Patent Application Laid-Open No. 2002-358253, only infections in which a security server exists in the same IP address space as the original destination IP address can be protected.

  In the technique disclosed in Japanese Patent Laid-Open No. 2002-358253, a packet to be checked for infection at a security center is determined by a protocol. Originally, an infection activity is a security hole in an OS or application of a terminal such as a PC. Usually, the infection activity itself is prevented by the pattern file of the patch program or virus check program. In other words, in the case of a terminal whose patch program or pattern file has been updated to the latest one (referred to as a countermeasured terminal), in most cases, infection activities are not performed. In, it can be easily imagined that most of the load on the security server is a normal packet.

In the case of the configuration of the technique disclosed in Japanese Patent Application Laid-Open No. 2002-358253, all packets designated as the check target protocol are transferred through the security server regardless of the presence or absence of infection. Depending on the load, there is a disadvantage that communication delay increases.
JP 2002-358253 A

  The present invention has been made to solve the above-mentioned problems. In addition to preventing direct infection simultaneously with indirect infection, the present invention is linked with a database of terminals that have already been treated, so that data from necessary terminals, i.e., The purpose is to reduce the infection check load at the center and improve the efficiency of the entire system by performing infection checks only on data from countermeasure terminals.

The damage diffusion prevention system according to the present invention is
A damage diffusion prevention system comprising a packet transfer device connected to a terminal in a local space and a packet collection and analysis device connected to the packet transfer device in a global space,
The packet transfer device
(1) a local-side packet receiver that receives packets from a terminal;
(2) a terminal countermeasure determining unit that determines whether the terminal of the transmission source of the received packet has already undergone security countermeasures;
(3) an encapsulating unit for encapsulating the packet to the packet collection and analysis device when the terminal of the transmission source has not been subjected to security measures;
(4) having a global-side packet transmitter for sending the encapsulated packet to the global space,
Packet collection and analysis equipment
(5) a packet receiver that receives packets from the global space;
(6) a decapsulation unit that decapsulates the received packet to obtain an original packet;
(7) a packet analysis function unit that determines whether the original packet is safe;
(8) an encapsulating unit that encapsulates a safe original packet to a packet transfer device that is a transmission source;
(9) a packet transmission unit that transmits the encapsulated packet to the global space;
The packet transfer device
(10) a global-side packet receiver that receives packets from the global space;
(11) A decapsulation unit that decapsulates a received packet to obtain an original packet;
(12) A local-side packet transmission unit that transmits an original packet to an original transmission destination.

  According to the present invention, it is possible to prevent the spread of virus damage through a server in the global address space and to prevent direct infection within a company closed in the local address space.

Embodiment 1 FIG.
Hereinafter, the present invention will be described based on embodiments shown in the drawings. FIG. 1 is a system configuration diagram of the present invention. A typical corporate network is composed of a plurality of corporate networks 5 connected to a wide area network 4 such as the Internet and a network management center. The network management center may be placed in a part of the corporate network 5 such as the head office. Depending on the scale, a network management center may be installed in each company network 5.

  The present invention is realized by the packet transfer device 2 placed in the corporate network 5 and the packet collection / analysis device 3 placed in the network management center. The packet transfer apparatus 2 is installed for each local segment of the corporate network 5. A local segment is a group of a relatively small number of terminals 1. When a company organization is taken as an example, a local segment is a department unit, a section unit, a staff unit, or the like. The local segment is also a unit of isolation in the event of infection damage, so infection damage will be less if it is made as small as possible.

  In addition to the system of the present invention, the security management of the corporate network 5 manages the firewall, IDS (intrusion detection system), update monitoring system (whether in-house terminal software and virus monitoring programs are updated to the latest version) In general, various systems are operated as necessary.

  FIG. 2 is an internal block configuration diagram of the packet transfer apparatus. The packet scrutinizing function unit 21 is a function for scrutinizing whether or not the packet received from the local segment is transferred to the packet collection / analysis device 3. The scrutiny is carried out by checking the received packet against the list of countermeasured terminals. The purpose of this function is to determine whether or not to transfer a packet to the packet collection and analysis device 3 and to avoid transferring a useless packet to the packet collection and analysis device 3 as much as possible. The collation location changes depending on the threat at that time. For example, in the case where the OS has a basic defect, the information (source IP address) for identifying the terminal 1 that uses the OS is collated. The original IP address is checked against the protocol of the packet. Basically, the more detailed matching is performed, the smaller the number of packets transferred to the packet collection and analysis apparatus 3.

  The packet transfer function unit 23 has a function for transferring a packet to the packet collection analysis device 3 described later, and has a function of operating in a pair with the packet transfer function unit 31 of the packet collection analysis device 3. The packet that has been determined to be transferred to the packet collection and analysis device 3 by the packet scrutinizing function unit 21 is subjected to encapsulation processing in the packet transfer function unit 23. The packet format before and after the encapsulating process is shown in FIG. For the sake of simplicity, FIG. 4 shows only the part related to the present invention among the parameters constituting the IP header.

  FIG. 3 is an internal block diagram of the packet collection / analysis apparatus. The packet transfer function unit 31 is a function that forms a pair with the packet transfer function unit 23 of the packet transfer device 2 described above. The packet transfer function unit 31 is determined to be decapsulated and safe for the transferred packet, and retransmitted (sent back) to the packet transfer device 2. Encapsulation processing of a packet to be performed is performed. The packet analysis function unit 32 has a function of analyzing original data of a packet transferred from the packet transfer device 2, and a packet determined to be safe by this analysis is sent via the packet transfer function unit 31. Is returned to the packet transfer apparatus 2.

  The countermeasure-completed terminal database unit 34 is a database of the terminal 1 that has been countermeasured against a certain incident. For example, this corresponds to the database of the terminal 1 in which the latest OS patch has been installed, and this database information is obtained from an update server or the like. The terminal 1 in the company is registered in this database since the latest patch is generally installed after a certain period of time has elapsed since patch distribution. On the other hand, if the countermeasure patch program is not distributed in the incident immediately after the occurrence, the number of registered database of the countermeasured terminal 1 is zero. Further, since personal PCs brought into the company are not registered in this database, they can be determined.

  The packet transfer device management function unit 33 has a function of managing the operation of the packet transfer device 2 and has a role of notifying the packet transfer device 2 of the latest information of the countermeasured terminal database unit 34 described above. By the notification from this function, the countermeasured terminal list of the packet transfer apparatus 2 is updated, and the operation of transferring only the packets that need to be analyzed to the packet collection and analysis apparatus 3 is realized.

Embodiment 2. FIG.
The operation of the system when a new incident occurs will be described using the figure. FIG. 5 shows an example of a corporate network 5 configured via the Internet. A local address is used in the corporate network 5 and NAT (conversion from a local address to a global address) is performed at a connection point with the Internet. Suppose that it is done. Accordingly, the terminals A to D, the packet transfer device E, and the server S have local addresses A to D, E, and S of the corporate network, and the packet collection and analysis device 3 has a global address α. Further, among terminals A to D, terminals other than D have the latest patch for the incident, and are registered in the countermeasured terminal list of the packet transfer apparatus E.

  Here, the operation will be described taking communication from the terminal D to the server S as an example. FIG. 6 is a detailed configuration diagram relating to transfer processing by packet inspection. FIG. 7 is a diagram showing a transfer processing flow by packet scrutiny.

  When the local packet receiving unit 61 of the packet transfer apparatus E receives a packet from the local side (S701), the terminal countermeasure determining unit 62 compares the packet with the countermeasure-completed terminal list (S702). Since the terminal D is not registered in the terminal list, it is encapsulated by the encapsulating unit 64 of the packet transfer function unit 23 of the packet transfer device E (S704), and transferred from the global packet transmission unit 65 to the packet collection and analysis device 3 (S705). The packet format at this time is as shown in FIG.

  The packet of FIG. 8 transmitted from the packet transfer device E is transferred to the packet collection and analysis device 3 after the local address E in the encapsulation header is converted to the global address G at the Internet connection point. A packet format received by the packet collection and analysis apparatus 3 is shown in FIG.

  FIG. 10 is a detailed configuration diagram of the packet collection and analysis apparatus. FIG. 11 is a diagram showing a processing flow of the packet collection and analysis apparatus. In the packet collection and analysis apparatus 3 that has received the encapsulated packet by the packet receiving unit 101, the packet is decapsulated by the decapsulating unit 102 (S1102), and the data of the original packet is analyzed by the packet analyzing function unit 32 (S1103). If the analysis result is dangerous, the packet is discarded (S1106). If the analysis result is safe, the encapsulation unit 103 performs encapsulation processing (S1104), and the packet transmission unit 104 sends a packet transfer device. A packet is returned to E (S1105). The packet format at this time is shown in FIG.

  The encapsulated packet from the packet analysis / collection apparatus arrives at the packet transfer apparatus E after the global address G of the destination packet transfer apparatus E is converted to the local address E by NAT at the Internet connection point.

  FIG. 13 is a diagram illustrating a configuration related to secure packet transfer processing. FIG. 14 is a diagram showing a safe packet transfer processing flow. The packet transfer apparatus E that has received the packet from the global side by the global side packet receiving unit 131 decapsulates the packet by the decapsulation unit 132 (S1402), and transmits the packet from the local side packet transmission unit 133 to the port on the server S side (S1403). . At this time, the packet transmitted from the packet transfer apparatus to the server S is the same as the packet first received by the packet transfer apparatus from the terminal D as shown in FIG. 8, 9, 12, and 15 only describe portions related to the present invention, and, for example, the MAC header is omitted.

  By returning the packet from the packet collection / analysis device 3 to the packet transfer device once, it is possible to transfer the packet that is suspected of being directly infected in the local address space after confirming the safety.

  Since this sequence is applied to all the terminals 1 that are not registered in the countermeasure terminal list of the packet transfer apparatus, by changing the contents of the countermeasure terminal list, a personal computer (in-house PC) It is possible to easily deal with attacks that have not been released with a fix program and attacks that have not been released with a modified program (all registered device lists are removed and all safety is checked by the packet collection analyzer 3). Become.

Embodiment 3 FIG.
It is also effective to return a warning packet when the analysis result is dangerous in the packet collection and analysis device. FIG. 16 is a configuration diagram of a packet collection and analysis apparatus according to the third embodiment. FIG. 17 is a diagram illustrating a processing flow of the packet collection and analysis apparatus according to the third embodiment.

  As shown in the figure, when the packet analysis function unit 32 determines that there is a danger (S1703), a warning packet is generated (S1706), encapsulated (S1704), and returned to the packet transfer apparatus (S1705).

  By operating in this way, the packet transfer apparatus can recognize that the transferred packet is dangerous.

  The packet transfer device and the packet collection / analysis device are computers, and each element can execute processing by a program. Further, the program can be stored in a storage medium so that the computer can read the program from the storage medium.

  FIG. 18 is a diagram illustrating a hardware configuration example of the packet transfer device and the packet collection and analysis device. An arithmetic device 1801, a data storage device 1802, a memory 1803, and a communication interface 1804 are connected to the bus. The data storage device 1802 is, for example, a ROM (Read Only Memory) or a hard disk. The memory 1803 is a normal RAM (Random Access Memory).

  The program is normally stored in the data storage device 1802, and is loaded in the memory 1803 and sequentially read into the arithmetic device 1801 for processing.

It is a system configuration diagram of the present invention. It is an internal block block diagram of a packet transfer apparatus. It is an internal block block diagram of a packet collection analyzer. It is a figure which shows the packet format before and behind an encapsulating process. It is a figure which shows the example of the corporate network comprised via the internet. It is a detailed block diagram which concerns on the transfer process by packet examination. It is a figure which shows the transfer processing flow by packet examination. It is a figure which shows the packet format transferred to a packet collection analyzer. It is a figure which shows the packet format received with a packet collection analyzer. It is a detailed block diagram of a packet collection analyzer. It is a figure which shows the processing flow of a packet collection analyzer. It is a figure which shows the packet format returned to a packet transfer apparatus. It is a figure which shows the structure regarding the transfer process of a safe packet. It is a figure which shows the transfer processing flow of a safe packet. It is a figure which shows the packet format transmitted to the server. FIG. 10 is a configuration diagram of a packet collection and analysis apparatus according to a third embodiment. FIG. 10 is a diagram showing a processing flow of the packet collection and analysis apparatus according to the third embodiment. It is a figure which shows the hardware structural example of a packet transfer apparatus and a packet collection analyzer apparatus.

Explanation of symbols

  1 terminal, 2 packet transfer device, 3 packet collection and analysis device, 4 wide area network, 5 corporate network, 21 packet inspection function unit, 22 countermeasured terminal list storage unit, 23 packet transfer function unit, 31 packet transfer function unit, 32 packets Analysis function unit, 33 Packet transfer device management function unit, 34 Countermeasured terminal database unit, 61 Local packet reception unit, 62 Terminal countermeasure determination unit, 63 Local packet transmission unit, 64 Encapsulation unit, 65 Global packet transmission unit 101 packet receiving unit, 102 decapsulating unit, 103 encapsulating unit, 104 packet transmitting unit, 131 global side packet receiving unit, 132 decapsulating unit, 133 local side packet transmitting unit.

Claims (7)

A damage diffusion prevention system comprising a packet transfer device connected to a terminal in a local space and a packet collection and analysis device connected to the packet transfer device in a global space,
The packet transfer device
(1) a local-side packet receiver that receives packets from a terminal;
(2) a terminal countermeasure determining unit that determines whether the terminal of the transmission source of the received packet has already undergone security countermeasures;
(3) an encapsulating unit for encapsulating the packet to the packet collection and analysis device when the terminal of the transmission source has not been subjected to security measures;
(4) having a global-side packet transmitter for sending the encapsulated packet to the global space,
Packet collection and analysis equipment
(5) a packet receiver that receives packets from the global space;
(6) a decapsulation unit that decapsulates the received packet to obtain an original packet;
(7) a packet analysis function unit that determines whether the original packet is safe;
(8) an encapsulating unit that encapsulates a safe original packet to a packet transfer device that is a transmission source;
(9) a packet transmission unit that transmits the encapsulated packet to the global space;
The packet transfer device
(10) a global-side packet receiver that receives packets from the global space;
(11) A decapsulation unit that decapsulates a received packet to obtain an original packet;
(12) A damage diffusion prevention system comprising: a local-side packet transmission unit that transmits an original packet to an original transmission destination.   The damage diffusion prevention system according to claim 1, wherein the packet analysis function unit discards the original packet when the original packet is not secure. The packet analysis function unit generates a warning packet notifying that the original packet is not safe when the original packet is not safe,
The encapsulating unit encapsulates the warning packet to the source packet transfer device,
2. The damage diffusion prevention system according to claim 1, wherein the packet transmission unit transmits the encapsulated packet to the global space. A packet transfer apparatus that is connected to a terminal in a local space and is connected to a packet collection and analysis apparatus in a global space, the packet transfer apparatus having the following elements: (1) a local side packet that receives a packet from a terminal (2) A terminal countermeasure determining unit that determines whether the terminal of the transmission source of the received packet has already undergone security countermeasures. (3) If the terminal of the transmission source has not undergone security countermeasures, the packet collecting and analyzing apparatus Encapsulation part for encapsulating to address (4) Global side packet transmission part for sending encapsulated packet to global space (5) Global side packet reception part for receiving packet from global space (6) Decapsulating received packet Decapsulation part to obtain original packet (7) Original Local side packet transmitter for transmitting packet, to the original destination. A packet collection and analysis device connected to a packet transfer device in the global space, and having the following elements: (1) a packet reception unit for receiving packets from the global space (2) reception Decapsulation part that decapsulates the original packet and obtains the original packet (3) Packet analysis function part that determines whether the original packet is safe (4) Packet transfer that was the source of the safe original packet Encapsulation part for encapsulating to the device (5) A packet transmission part for sending the encapsulated packet to the global space. A program for causing a computer to be a packet transfer device connected to a terminal in a local space and connected to a packet collection and analysis device in a global space to execute the following procedure (1) A procedure for receiving a packet from a terminal (2) received Procedure for determining whether the terminal of the packet transmission source has been subjected to security measures (3) Procedure for encapsulating the packet to the packet collection / analysis device when the terminal of the transmission source has not been subjected to security measures (4) Procedure to send encapsulated packet to global space (5) Procedure to receive packet from global space (6) Procedure to decapsulate received packet to obtain original packet (7) Original packet to original destination To send to. A program for causing a computer that is a packet collection and analysis device connected to a packet transfer device in the global space to execute the following procedure (1) a procedure for receiving a packet from the global space (2) decapsulating the received packet, Procedure for obtaining the original packet (3) Procedure for determining whether the original packet is safe (4) Procedure for encapsulating the original packet that is safe to the packet transfer apparatus that was the source (5) Procedure to send encapsulated packet to global space.

Images