JP2006060306A - Packet filtering method and packet filter device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a packet filtering method capable of dealing with continuous illegal access like a service rejection attack. <P>SOLUTION: The packet filter device (10) is equipped with: a rule storage section (14) which stores rule information including conditions for specifying a plurality of specified packets received from a packet transmission path (100), a packet information extraction section (12) which extracts packet information for identifying the packets received from the transmission line from the packets; a statistical processing part (13) which finds statistics of the packet information each time the packet information is extracted by the packet information extraction section; and a decision section (15) which decides whether the packets received from the transmission line need to be discarded according to the statistics found by the statistical processing part and the rule information. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a packet filtering function provided in a firewall system or the like provided in a communication network or individual communication terminals.

  2. Description of the Related Art Conventionally, in order to enhance information security in a local network such as a LAN or a communication terminal for personal use, a so-called firewall system for dealing with unauthorized access from the outside at a boundary with an external network or in a communication terminal has been provided. It is known to introduce. Some firewall systems have a packet filtering function, for example, as means for determining whether or not to accept a packet sent from an external network or another terminal. This function determines whether or not to accept a packet based on a preset rule. When it is determined that the packet is rejected, the function deals with unauthorized access from the outside by discarding the packet.

Regarding such a packet filtering function, for example, there is a method described in Patent Document 1 described later. The method of Patent Document 1 prepares a plurality of rules that are sequentially applied to received packets, and moves rules that do not frequently match incoming packets to the rear of the order.
JP 2000-174808 A

  In the method of Patent Document 1, the performance of filtering processing is improved by replacing rules. However, the filtering process using this method employs a discard rule for each received packet. For example, a large number of packets are intentionally sent as in a so-called Denial of Services (DoS) attack. Even if a situation occurs, there is an inconvenience that it is difficult to recognize the abnormality of the situation unless the sender is known in advance as an unauthorized one.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a packet filtering method capable of appropriately dealing with continuous unauthorized access.

  The packet filtering method according to the present invention stores rule information including conditions for a device connected to a packet transmission path to specify a plurality of predetermined packets received from the transmission path, and receives the rule information from the transmission path. Packet information for identifying the packet is extracted from the received packets, packet information statistics are obtained for each packet information extraction, and packets received from the transmission path are discarded based on the obtained statistics and the rule information. It is a method of determining whether or not it is necessary.

  A packet filter device according to the present invention includes a rule storage unit that stores rule information including a condition for specifying a plurality of predetermined packets received from a packet transmission path, and a packet received from the packet received from the transmission path. A packet information extraction unit for extracting packet information for identification; a statistical processing unit for obtaining statistics of packet information for each extraction of packet information by the packet information extraction unit; the statistics obtained by the statistical processing unit and the rule information And a determination unit that determines whether or not to discard the packet received from the transmission path.

  According to the present invention, statistics are taken for packets sequentially received from the transmission path, and filtering processing is performed based on the results of the statistics. Therefore, even if the transmission source of the received packet is not known in advance, the transmission source Continuous access can be detected. Thereby, it is possible to appropriately deal with unauthorized access such as a denial of service attack.

[Example 1]
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the first embodiment according to the present invention. The packet filter device 10 according to the first embodiment includes a packet receiving unit 20 such as a network interface mechanism for receiving a packet from the transmission line 100, and an OS (Operating System) that accepts a packet permitted to be accepted by the packet filter device 10. Is connected to a packet processing unit 30 for processing based on the above.

  As shown in FIG. 1, the packet filter device 10 includes a buffer 11 that temporarily stores a packet supplied from the packet receiver 20, and an in-buffer packet process that performs processing such as reading and discarding of the packet in the buffer 11. Unit 12, a statistical processing unit 13 that extracts packet information from the read packet and obtains statistical information of the packet information, a rule storage unit 14 that stores later-described rule information related to filtering processing, and statistics of statistical processing unit 13 And a determination unit 15 that determines whether to discard the packet based on the rule information in the rule storage unit 14.

  FIG. 2 shows an example of rule information stored in the rule storage unit 14. The rule information 150 includes a “target 151” indicating a filtering process determination target, a “condition 152” for identifying a specific packet from packets corresponding to the target 151, and a filtering process for a packet that matches the condition 152. “Processing 153” indicating the contents is included.

  The rule information 150 shown in FIG. 2 “discards” packets received in “one second” from the transmission path 100 when the condition “10 or more packets from the same source IP address” is satisfied, It is defined that “all” packets that reach “TCP port 80” are “passed”.

  The operation procedure of this embodiment will be described with reference to the sequence diagram of FIG. First, as a preliminary preparation, the buffer packet processing unit 12 of the packet filter device 10 acquires the target 151 from the rule information 150 of the rule storage unit 14 to recognize the read timing of the packet to be supplied to the statistical processing unit 13. (Step A1). When receiving packets from the transmission line 100, the packet receiving unit 20 sequentially stores them in the buffer 11 (step A2).

  The in-buffer packet processing unit 12 confirms the accumulation status of the buffer 11 (step A3), and when there are packets in the buffer 11, reads them from the buffer 11 (step A4). The timing of reading from the buffer 11 can be set as appropriate. As an example, a method of continuously reading packets from the buffer 11 by timer control is conceivable. In this case, by setting the packet 151 to be read at a time interval shorter than “one second” of the target 151, it is possible to avoid a processing delay of the packet that passes through the packet filter device 10. It is also a preferable method to read out received packets at a timing according to traffic control on the network.

  Each time the packet processing unit 12 in the buffer reads a packet from the buffer 11, it extracts packet information for identifying the packet. The packet information refers to information corresponding to the condition 152 of the rule information 150 such as a source IP address described in the IP header area of the packet or a destination port number in the TCP header area. The in-buffer packet processing unit 12 supplies the extracted packet information to the statistical processing unit 13 (step A5).

  The statistical processing unit 13 performs statistical processing on the packet information received from the in-buffer packet processing unit 12 according to the condition 152 of the rule information 150. For example, in the case of the rule information 150 in FIG. 2, the statistical processing referred to here refers to calculating the packet information statistics by counting the number of packets for each source IP address and recording the port number. The statistical processing unit 13 supplies the obtained statistics to the determination unit 15 (step A6).

  The determination unit 15 determines whether the statistics sequentially received from the statistical processing unit 13 satisfy the condition 152 of the rule information 150. For example, with respect to the condition 152 shown in FIG. 2 that “more than 10 packets arrive from the same source IP address”, the statistics for “one second” regarding the source IP address from the statistical processing unit 13 are referred to. It is determined whether 10 or more packets having the same source IP address are recorded. Note that the above-mentioned “one second” statistics refers to statistics for two times when the interval between reading from the buffer 11 is 0.5 seconds, for example.

  As a result, when the number of packets with the same source IP address is 10 or more, it is determined that the condition 152 is satisfied, and in the current process, it is determined to apply “discard” specified in the process 153. If there are less than 10 identical source IP addresses, it is determined to accept the packet. That is, even packets from the same source IP address are not discarded until the threshold value of 10 is exceeded. The determination unit 15 notifies the in-buffer packet processing unit 12 of the determination result as described above (step A7).

  If the determination result from the determination unit 15 permits acceptance of the packet, the in-buffer packet processing unit 12 transfers the packet read from the buffer 11 in step A4 to the packet processing unit 30 to be processed. (Step A8). If the packet is to be discarded, the packet is discarded (step A9).

  According to the first embodiment described above, since filtering is performed based on statistical results regarding a plurality of packets, unauthorized access such as a large number of packets being sent from the same source occurs like a denial of service attack. However, the situation can be properly detected and dealt with. In addition to the denial-of-service attack, for example, it is possible to cope with so-called slow scan in which an intrusive communication port is scanned for a long time. Furthermore, it can also be used to detect servers that provide unauthorized content within the network.

[Example 2]
FIG. 4 is a block diagram showing the configuration of the second embodiment according to the present invention. The packet filter device 10 according to the second embodiment includes a load measuring unit 16 in addition to the configuration illustrated in FIG. The load measuring unit 16 obtains the operating load factor of the CPU when the packet receiving unit 20 receives a packet, and notifies the in-buffer packet processing unit 12 of the obtained value.

  In the present embodiment, information as shown in FIG. 5 is added as the rule information 150 in the rule storage unit 14. In the procedure according to the rule information 150, when the operating load factor at the time of packet reception obtained by the load measuring unit 16 is 80% or more, the in-buffer packet processing unit 12 intentionally sends a large number of packets. The received packet is discarded based on the judgment that it is.

  According to the second embodiment, not only unauthorized access from the same transmission source but also distributed attacks from a plurality of transmission sources can be appropriately dealt with.

[Example 3]
The third embodiment according to the present invention performs a filtering process based on rule information having a plurality of conditions that are established by a combination. As rule information of the present embodiment, for example, the information shown in FIG. 6 can be considered. In the illustrated rule information 150, a number 154 for identifying each information and a related condition 155 indicating a related condition are added, and the condition of the number indicated by the related condition 155 is preferentially applied. .

  More specifically, in the rule information 150 of FIG. 6, “premise: 3” is designated as the related condition 155 in the information of the number “1”. This means that when applying the number “1”, the determination based on the number “3” is performed in advance, and as a result, the number “1” is applied to a packet that is not discarded. Here, since the information “number 3” designates “discarding” a packet “going to other than TCP port 80”, the packet going to port 80 is not discarded. Therefore, in the determination by the number “1” on the assumption of the number “3”, the packet destined for the TCP port 80 is “discarded” when “10 or more packets arrive from the same source IP address”.

  According to the above-described third embodiment, since a combination of a plurality of conditions is possible, it is possible to set complicated rule information for dealing with various situations related to unauthorized access.

[Example 4]
FIG. 7 shows the configuration of a fourth embodiment according to the present invention. The packet filter device 10 according to the present embodiment includes a determination notification unit 17 that performs an e-mail transmission function. When the determination unit 15 determines that the packet is discarded, the in-buffer packet processing unit 12 instructs the determination notification unit 17 to transmit an e-mail notifying that effect. The determination notification unit 17 transmits an e-mail describing that the packet has been discarded to a preset e-mail address. As an e-mail destination, for example, a network monitoring center, a center manager's terminal, an individual user's terminal, a mobile phone, or the like is set.

  Note that the packet discard notification by e-mail can be set to be executed only when a specific discard condition is met. This is because, for example, information indicating whether or not to send a discard notification by e-mail is set in association with each condition of the rule information 150, and when the e-mail is matched, It is a method of transmitting.

  Further, the determination notification unit 17 is not limited to the above-described e-mail transmission function, and may be a function of notifying that the packet is discarded by, for example, displaying a warning screen or sounding a warning sound.

  According to the above-described fourth embodiment, it is possible to promptly notify an administrator or the like that there is an abnormal state in which packet discarding is performed, and thereby it is possible to constantly monitor unauthorized access. .

[Example 5]
The fifth embodiment according to the present invention is a case where the buffer 11 is not provided in the packet filter device 10. In this case, each time the packet receiving unit 20 receives a packet from the transmission path 100, the in-buffer packet processing unit 12 acquires this and extracts packet information such as a source IP address. Each time packet information is extracted, the result of statistical processing by the statistical processing unit 13 is held, and determination of discard by the determination unit 15 is performed. When the statistics match the conditions for discarding, the target of determination at that time Discard the packet that became.

  According to the above-described fifth embodiment, the processing delay in the packet filter device 10 can be suppressed by performing statistical processing each time a packet arrives without having the buffer 11.

It is a block diagram which shows the structure of Example 1 by this invention. It is explanatory drawing for demonstrating the rule information of Example 1. FIG. FIG. 3 is a sequence diagram illustrating an operation procedure according to the first embodiment. 6 is a block diagram illustrating a configuration of Example 2. FIG. It is explanatory drawing for demonstrating the rule information of Example 2. FIG. It is explanatory drawing for demonstrating the rule information of Example 3. FIG. FIG. 10 is a block diagram illustrating a configuration of a fourth embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Transmission path 10 Packet filter apparatus 11 Buffer 12 In-buffer packet processing part 13 Statistical processing part 14 Rule storage part 15 Determination part 16 Load measurement part 17 Determination notification part 20 Packet reception part 30 Packet processing part

Claims (13)

A device connected to the packet transmission path
Storing rule information including conditions for specifying a plurality of predetermined packets received from the transmission path;
Extracting packet information for identifying the packet from the packet received from the transmission path;
Obtain packet information statistics for each packet information extraction,
A packet filtering method comprising: determining whether or not to discard a packet received from the transmission path based on the obtained statistics and the rule information. The device is
Find the operating load factor when receiving a packet,
The packet filtering method according to claim 1, wherein when the obtained operating load factor exceeds a predetermined value, it is determined that the received packet is to be discarded. The device is
The packet filtering method according to claim 1, wherein information including a plurality of the conditions established by a combination is stored as the rule information. The device is
Accumulate packets received from the transmission path,
4. The packet filtering method according to claim 1, wherein a predetermined packet is read from the accumulated packet, and the packet information is extracted from the read packet. The device is
4. The packet filtering method according to claim 1, wherein when the packet is received from the transmission path, the packet information is extracted from the packet. The device is
6. The packet filtering method according to claim 1, wherein when it is determined that the packet is to be discarded, an e-mail for notifying the determination is transmitted to a predetermined mail address. A rule storage unit that stores rule information including conditions for specifying a plurality of predetermined packets received from a packet transmission path;
A packet information extraction unit for extracting packet information for identifying the packet from the packet received from the transmission path;
A statistical processing unit for obtaining statistics of packet information every time packet information is extracted by the packet information extracting unit;
A packet filter device comprising: a determination unit that determines whether or not to discard a packet received from the transmission path based on the statistics obtained by the statistical processing unit and the rule information. A load measurement unit that calculates the operating load factor when a packet is received is provided.
The packet filter device according to claim 7, wherein the determination unit determines to discard the received packet when the operating load factor obtained by the load measurement unit exceeds a predetermined value.   9. The packet filter device according to claim 7, wherein the rule information storage unit stores information including a plurality of the conditions established by combination as the rule information. A packet storage unit for storing packets received from the transmission path;
The packet filter device according to claim 7, further comprising: an accumulation packet processing unit that reads a predetermined packet from the packet accumulation unit and supplies the packet to the statistical processing unit.   10. The packet filter device according to claim 7, wherein when the statistical processing unit receives a packet from the transmission path, the statistical processing unit extracts the packet information from the packet.   The determination notifying unit that transmits an e-mail for notifying the determination to a predetermined mail address when the determining unit determines to discard the packet. The packet filter device according to item 1.   A program for causing a computer to function as the packet filter device according to any one of claims 7 to 12.

Images