JP2007068208A - Device, method and program for band control - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a band control device for autonomously regulating specific application level traffic so that network resources can be utilized in fair manner. <P>SOLUTION: The band control device is connected to at least one information processing device. The band control device detects regulation subject data, based on data contents of an L4 connection, and performs a control of communication regulation, with respect to the detected regulation subject data. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a bandwidth control device, a bandwidth control method in the bandwidth control device, and a bandwidth control program.

  Currently, the number of users of the Internet is increasing, and the number of users who use electronic mail as a means of communication is also increasing. In particular, due to the rapid increase in the number of mobile phone users, in addition to the increase in mail traffic between computers, there is also an increase in mail traffic on mobile phones.

  One useful function of electronic mail is a broadcast function. In recent years, cases where direct mail such as advertisements are transmitted to an unspecified number of users by using this broadcast function are increasing rapidly. Such spam mail is referred to as SPAM mail.

  This SPAM mail causes a large amount of mail traffic. Furthermore, the SPAM mail does not always include an address for confirming the arrival of mail, and a large amount of undelivered mail may occur. . If the processing of undelivered mail becomes excessive, it causes a Dos attack (Deny Of Service Attack) for the receiving server. For this reason, ISPs (Internet Service Providers), carriers, companies, etc. have to increase the number of mail servers for SPAM mail distribution processing and undelivered mail reply processing.

  The outline of a conventional mail delivery system will be described below with reference to FIGS. The following processing operation will be described by taking as an example a case where SMTP (Simple Mail Transfer Protocol) is used as a mail transfer protocol.

  In the mail delivery system shown in FIG. 1, a router (101) is arranged at the boundary of a network management domain (3) provided under the management of an ISP, carrier, company, etc., and mail is sent to the management domain (3). Servers (hereinafter referred to as MTA (Message Transfer Agent)) (2-1 to 2-3) are deployed. In addition, MTA (2-4, 2-5) exists outside the management domain (3). It should be noted that MTA (2-4) is used by a malicious user, and MTA (2-5) is managed by a normal user. The mail delivery system in FIG. 1 shows an example in which mail delivery is performed from the MTA (2-4, 2-5) to the MTA (2-2) in the management domain (3).

  The normal router (101) does not identify whether the traffic flowing into the router (101) itself is mail traffic, and based on the IP address, MTA (2-1 to 2-1) in the management domain (3). Deliver traffic to 2-3). For this reason, when a large amount of SMTP traffic (102) is flowed from the MTA (2-4), the router (101) delivers the flowed SMTP traffic (102) to the MTA (2-2). Become.

  Further, when the SMTP traffic (103) is also flown from the MTA (2-5), the router (101) delivers the flowed SMTP traffic (103) to the MTA (2-2). At this time, the amount of SMTP traffic (102) delivered from the router (101) to the MTA (2-2) increases, and the SMTP traffic (102) delivered from the router (101) in the MTA (2-2). Cannot be processed, the MTA (2-2) cannot accept the SMTP traffic (103) delivered from the MTA (2-5) via the router (101).

  Further, if the router (101) itself concentrates on the transfer processing of the SMTP traffic (102) that flows in from the MTA (2-4), the SMTP traffic (103) from the MTA (2-5) that is another user. When SMTP flows in, the SMTP traffic (102) prevents the SMTP traffic (103) from being delivered to the MTA (2-2).

  In this way, a mail distribution system in which the router (101) is simply deployed cannot control a large amount of SPAM mail distribution traffic.

  In recent years, there is a firewall that can identify the L4 layer as a device for identifying mail traffic. However, since the firewall does not scrutinize the contents at the application layer level, the firewall cannot determine whether the mail transferred from the outside is a SPAM mail.

  The mail delivery system in FIG. 2 shows a case where the MTA (2-2) in the management domain (3) is a mail delivery server. In the case where the ISP or carrier is providing a server hosting service, it is assumed that an external user who has contracted with that service uses the MTA (2-2) in the management domain (3) to distribute SPAM mail. Is done. In FIG. 2, a large amount of SMTP traffic (104) is distributed from MTA (2-2) to MTA (2-4) and MTA (2-5), and SMTP traffic distributed from MTA (2-1). (106) and the SMTP traffic (105) distributed from the MTA (2-3) are being pressed by the router (101).

  In addition, as a technical document filed prior to the present invention, it is possible to limit the transmission band of the attack traffic of the distributed denial of service attack (DDos attack) while securing the communication traffic of the authorized user. Yes, for example, when an attack suspect packet of a DDos attack is detected in the gate device, the upstream communication device is notified of the transmission bandwidth limit value of the attack suspect packet, and the upstream communication device determines the transmission bandwidth of the attack suspect packet. While limiting to the received transmission band limit value, there are those that further repeat the notification of the transmission band limit value to the upstream communication device to the most upstream, and each communication device limits the transmission band of the suspected attack packet (for example, (See Patent Documents 1 and 2).

Further, when the attack suspect packet of the DDos attack is detected in the gate device, the suspect signature of the attack suspect packet and the normal condition are transmitted to the upstream communication device, and the upstream communication device is identified by the suspect signature. While restricting the transmission bandwidth of the packet, the transmission bandwidth restriction of the packet identified by the normal signature generated based on the normal condition and the suspect signature is released, and further, the suspect signature and the normal condition for the upstream communication device Is repeated until the most upstream, and each communication device detects the attack packet from the attack suspect packet while limiting the bandwidth of the attack suspect packet, and further limits the bandwidth (for example, see Patent Document 3). ).
JP 2003-283572 A JP 2003-283555 A JP 2003-283554 A

  However, the above Patent Documents 1 to 3 limit the transmission bandwidth of the attack suspect packet when the attack suspect packet is detected. However, the gate device limits the transmission bandwidth of the attack suspect packet to the upstream communication device. Since each communication device limits the transmission bandwidth of the attack suspect packet by transmitting information, it is considered difficult to limit the transmission bandwidth of the attack suspect packet within one device.

  The present invention has been made in view of the above circumstances, and provides a bandwidth control device and bandwidth control that can autonomously regulate traffic at a specific application layer level and allow network resources to be used fairly. It is an object to provide a method and a bandwidth control program.

  In order to achieve this object, the present invention has the following features.

  The bandwidth control device according to the present invention is a bandwidth control device connected to at least one information processing device, and is a detection means for detecting data to be regulated based on the data content of the L4 connection, and is a regulation target. And a control means for controlling data communication restriction.

  In addition, the bandwidth control device according to the present invention is characterized in that the port number includes a first restriction target excluding means for excluding packet data that does not include SMTP from the restriction target data. .

  In the bandwidth control device according to the present invention, the port number includes SMTP, and the IP address of the packet data including the SMTP is not specified as a specific source IP address or The present invention is characterized in that it has a second restriction target excluding means for excluding the packet data that is the destination IP address from the restriction target data.

  In addition, the bandwidth control apparatus according to the present invention includes a third restriction target exclusion unit that excludes packet data including a specific mail address that is not subject to restriction from data subject to restriction. It is.

  The bandwidth control method according to the present invention is a bandwidth control method performed by a bandwidth control device connected to at least one information processing device, and detects data to be regulated based on the data content of the L4 connection. The bandwidth control apparatus performs the process and the control process for controlling the communication restriction of the data to be restricted.

  Further, the bandwidth control method according to the present invention is characterized in that the bandwidth control device performs a regulation object exclusion step of excluding packet data whose port number does not include SMTP from data to be regulated. It is.

  The bandwidth control program according to the present invention is a bandwidth control program that is executed by a bandwidth control device connected to at least one information processing device, and detects data to be regulated based on the data content of the L4 connection. The bandwidth control device is caused to execute detection processing and control processing for controlling communication restriction of data to be restricted.

  In addition, the bandwidth control program according to the present invention causes the bandwidth control device to execute a restriction target exclusion process for excluding packet data that does not include SMTP in the port number from the restriction target data. Is.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to apply a regulation autonomously with respect to the traffic of a specific application layer level, and to use a network resource fairly.

First, the bandwidth control apparatus in this embodiment will be described.
The bandwidth control device in the present embodiment is a bandwidth control device that is a network device deployed between information processing devices connected via a network, and the bandwidth control device is an application layer for data transmitted from the information processing device. When the data to be regulated is detected and the regulated data is detected, a series of L3 traffic, L4 connection, and application layer level transactions of the detected regulated data are blocked, or the bandwidth is limited. Or adding a delay. Specifically, when the bandwidth control device detects the data to be regulated, the new L7 session (transaction) traffic at the application layer level of the detected data to be regulated is prohibited. In addition, when application band level termination processing is performed in the bandwidth control device, session establishment is rejected. Further, the flow rate (= bandwidth) of the L3 traffic or the L4 connection traffic is limited to a specified value or less. In addition, a delay of a specified value is added to the data at the application layer level of the data to be regulated, thereby increasing the processing time at the application layer level of the data to be regulated.

The data to be regulated include data in the following cases (1) to (5).
(1) When the amount of data traffic of a specific L3 address exceeds a specified value (Note that the criteria for determining whether or not the amount of data traffic exceeds the specified value is the amount of data traffic per unit time Or the total amount of data traffic).
(2) When the number of L4 connections of a specific L3 address exceeds a specified value (as a judgment criterion, as in (1), per unit time or total amount).
(3) When an information processing apparatus identified at the application layer level is a monitoring target, and the amount of data traffic from the information processing apparatus that is the monitoring target exceeds a specified value (the determination criterion is the same as (1) , Per unit time or total amount).
(4) When the number of L4 connections from a specific information processing apparatus exceeds a specified value (as a determination criterion, as in (1), per unit time or total amount).
(5) When the number of transactions at the application layer level from a specific information processing apparatus exceeds a specified value (as a criterion for judgment, per unit time or the total amount as in (1)).
In addition, it is also possible to use the data to be regulated based on the case where the above cases (1) to (5) are combined.

  Further, the bandwidth control apparatus according to the present embodiment monitors the transition state of the application layer level data, and detects the data subject to regulation based on the transition state of the application layer level data to be monitored. It is characterized by blocking a series of L3 traffic, L4 connection, and application layer level transactions of the detected data to be regulated, limiting the bandwidth, and adding a delay.

  The processing operation when monitoring the transition state of data at the application layer level is the same as the processing operation when detecting the data to be regulated as described above. In particular, in an electronic mail (hereinafter referred to as mail) distribution system using SMTP (Simple Mail Transfer Protocol), the IP address of the SMTP server of the delivery source and the SMTP server of the delivery destination, the TCP connection unit of the mail delivery, the mail delivery The number of IP packets of delivery mail, the number of TCP connections, the number of outgoing mails, the duration of an SMTP transaction, the number of sender mail addresses (Mail From) of SMTP messages, and the destination mail address of SMTP messages (Rcpt-To) ), The number of SMTP error responses, the number of TCP connections established at the same time, the number of SMTP transactions established at the same time, and any one of the measured values is set in advance Is exceeded, or a combination of a plurality of measurement values exceeding the specified value is determined as data to be regulated, and thereafter, IP packets, TCP connections, and SMTP transactions that match the data to be regulated Will be subject to regulatory processing. It is also possible to preset data to be regulated.

  Further, the restriction control for the data to be restricted is performed separately for the IP level, the TCP level, and the SMTP level. The IP-level regulation control for the data to be regulated includes IP packet discard, IP packet delay addition, and IP packet bandwidth regulation (policing and shaping). The TCP level restriction control for the data to be restricted includes disconnection of the TCP connection, restriction of the number of TCP connections (rejection of new TCP connections), and addition of a TCP ACK response delay. Further, the restriction control of the SMTP transaction level for the data subject to restriction is forcibly termination of the SMTP transaction, restriction of the number of transactions of the SMTP transaction (rejection of passage of new SMTP transaction), and delay addition of the SMTP command response. .

  In addition, the bandwidth control device according to the present embodiment includes a function for excluding packet data that does not include SMTP in the port number from the data to be regulated, and the port number includes SMTP. A function of excluding packet data whose IP address of the packet data is a specific source IP address or destination IP address that is not subject to restriction from data subject to restriction, and a specific mail address that is not subject to restriction It is also possible to mount at least one function of excluding the included packet data from the data to be regulated.

  Hereinafter, an application band control apparatus according to the present embodiment will be described with reference to the accompanying drawings.

  The application bandwidth control apparatus according to the present embodiment inspects the data content of the application layer of the data received from the external communication device, and when detecting the data to be regulated, the L3 traffic of the detected data to be regulated , L4 connection and application layer level transactions are regulated and network resources can be used fairly.

  Specifically, it is considered malicious by performing block processing of L3 traffic, L4 connection, and application layer level transactions of data subject to regulation, bandwidth limitation processing, and delay addition processing. The mail traffic transmitted from the MTA used by the user is autonomously restricted, and the increase in traffic due to the SPAM mail is reduced.

  FIG. 3 is a schematic diagram of a mail delivery system in which the application bandwidth control device (1) in the present embodiment is arranged. The mail delivery system shown in FIG. 3 has a system configuration corresponding to the conventional mail delivery system shown in FIG.

  In the mail delivery system shown in FIG. 3, the application bandwidth control device (1) regulates only the mail traffic (6) delivered from the MTA (2-4) used by the malicious user. Only a part of traffic (4) distributed from (2-4) is distributed to MTA (2-2). The application bandwidth control device (1) normally distributes the mail traffic (5) distributed from the MTA (2-5) to the MTA (2-2).

  FIG. 4 is a schematic diagram of another mail delivery system in which the application bandwidth control device (1) in the present embodiment is arranged. The mail delivery system shown in FIG. 4 has a system configuration corresponding to the conventional mail delivery system shown in FIG.

  In the mail delivery system shown in FIG. 4, the application bandwidth control device (1) regulates the SPAM mail delivered from the MTA (2-2) used by the malicious user, and the management domain (3) It shows a state where distribution to the external MTA (2-4, 2-5) is stopped. Note that the application bandwidth control device (1) is configured so that the mail traffic distributed from the other MTA (2-1) and MTA (2-3) in the management domain (3) is normally external MTA (2-4, 2-5).

  Next, the application band control device (1) in the present embodiment will be described with reference to FIGS. FIG. 5 is a block diagram showing a configuration example of the application bandwidth control apparatus (1) in the present embodiment. FIG. 5 shows an example of the application bandwidth control apparatus (1) for mail as an example. A configuration example is shown. FIG. 6 shows a configuration example of the database of the L3 / L4 passage permission list (35) shown in FIG. FIG. 7 shows a configuration example of the database of the L3 / L4 restriction target list (36) shown in FIG. FIG. 8 shows a configuration example of the database of the application pass permission list (55) shown in FIG. 9 to 11 show configuration examples of the database of the application restriction target list (56) and the restriction target list (66) shown in FIG. In the present embodiment, a case where IP is used as the L3 layer, TCP is used as the L4 layer, and SMTP is used as the application layer will be described as an example.

(Configuration of Application Bandwidth Control Device (1))
First, the configuration of the application bandwidth control device (1) in the present embodiment will be described with reference to FIG.
As shown in FIG. 5, the application bandwidth control device (1) includes a network interface (20), a traffic control unit (30), an L4 termination unit (40), an application processing unit (50), and a determination unit ( 60).

(Configuration of network interface (20))
The network interface (20) has one or more input / output ports. The network interface (20) shown in FIG. 5 shows a configuration example having two input / output ports, and the input port (21) and the output port (23) are devices in the management domain (3). And a port to be connected. The input port (22) and the output port (24) are ports connected to devices outside the management domain (3).

(Function of network interface (20))
The network interface (20) performs termination processing of the physical layer (layer 1) and the data link layer (layer 2). In the present embodiment, the types of the physical layer and the data link layer are not particularly limited. However, in the following description, a case where Ethernet (registered trademark) is used as the data link layer will be described. In addition, data transfer using MAC frame data is performed between the network interface (20) and the traffic control unit (30).

  The network interface (20) receives the MAC frame data received from the network via the input port (21) in the management domain or the input port (22) outside the management domain, and the L3 data reception unit of the traffic control unit (30). To (31). Further, the network interface (20) receives the MAC frame data received from the L3 data transmission unit (32) of the traffic control unit (30) as an output port (23) in the management domain or an output port ( 24) to the network.

(Configuration of traffic control unit (30))
The traffic control unit (30) is connected to the network interface (20), the L4 termination unit (40), and the determination unit (60).
The traffic control unit (30) includes an L3 data reception unit (31), an L3 data transmission unit (32), an L3 data measurement unit (33), a data buffer (34), and an L3 / L4 passage permission list. (35) and an L3 / L4 restriction target list (36).

(Function of L3 data receiver (31))
The L3 data receiving unit (31) receives MAC frame data transmitted from the network interface (20). Then, the L3 data receiving unit (31), based on the MAC frame data received from the network interface (20), extracts the IP header information, extracts the IP address, and specifies the upper protocol (TCP / UDP, etc.) I do. In addition, when the higher level protocol can be specified by the higher level protocol specifying process, the L3 data receiving unit (31) extracts the TCP header information of the specified higher level protocol from the MAC frame data. The L3 data receiving unit (31) temporarily stores the MAC frame data received from the network interface (20) in the data buffer (34).

  The L3 data receiving unit (31) is stored in the L3 / L4 passage permission list (35) based on the IP header information and the TCP header information extracted from the MAC frame data in the L3 data receiving unit (31). The IP address and TCP connection information (see FIG. 6) of the data to be excluded from the restriction target (see FIG. 6), or the IP address and TCP connection information of the restriction target data stored in the L3 / L4 restriction target list (36) Referring to FIG. 7), the MAC frame data once stored in the data buffer (34) is transferred to the L3 data transmission unit (32), transferred to the L4 data reception unit (41), or It is decided whether or not to discard within the traffic control unit (30). The IP address is information that is a set of a source IP address (IP SA in FIGS. 6 and 7) and a destination IP address (IP DA in FIGS. 6 and 7) extracted from the MAC frame data. It is used to identify an address. The TCP connection information includes a source IP address (IP SA in FIGS. 6 and 7), a destination IP address (IP DA in FIGS. 6 and 7), a protocol (Protocol in FIGS. 6 and 7), and a source port. This information is a set of a number (SP in FIGS. 6 and 7) and a destination port number (DP in FIGS. 6 and 7), and is information used to identify a TCP connection.

  The L3 data receiving unit (31) receives the IP address or the TCP connection information from which the MAC frame data once stored in the data buffer (34) is not regulated, stored in the L3 / L4 passage permission list (35). If it is determined that it matches, the L3 data receiving unit (31) transfers the MAC frame data to the L3 data transmitting unit (32). This process is referred to as a packet through process.

  In addition, the L3 data receiving unit (31) is configured such that the MAC frame data once stored in the data buffer (34) is an IP address that is not subject to restriction stored in the L3 / L4 passage permission list (35), or TCP If it does not match the connection information and it is determined that it does not match the IP address to be regulated stored in the L3 / L4 regulation target list (36) or the TCP connection information, the L3 data receiving unit (31) The MAC frame data is transferred to the L4 data receiving unit (41). This process is referred to as an application relay process.

  In addition, the L3 data receiving unit (31) is configured such that the MAC frame data once stored in the data buffer (34) is an IP address that is not subject to restriction stored in the L3 / L4 passage permission list (35), or TCP If it does not match the connection information and it is determined that it matches the IP address to be restricted stored in the L3 / L4 restriction target list (36) or the TCP connection information, the L3 data receiving unit (31) , Refer to the restriction operation field (restriction action of FIG. 7) in the L3 / L4 restriction target list (36), and transfer the MAC frame data to the L4 data receiving unit (41) (application relay process), or In the traffic control unit (30), whether to discard (MAC frame data discarding process) is determined.

  For example, if the L3 data receiving unit (31) determines that the “restriction operation” in the L3 / L4 restriction target list (36) shown in FIG. The data is transferred to the receiving unit (41) (application relay processing). When the L3 data receiving unit (31) determines that the “restriction operation” in the L3 / L4 restriction target list (36) illustrated in FIG. 7 is “discard”, the L3 data reception unit (31) performs traffic control on the MAC frame data. It is discarded in the part (30) (MAC frame data discarding process).

  In addition, the L3 data receiving unit (31) transmits the IP header information and the TCP header information extracted by the L3 data receiving unit (31) to the L3 data measuring unit (33). When the L3 data receiving unit (31) transfers the MAC frame data once stored in the data buffer (34) to the L4 data receiving unit (41), the IP header information extracted from the MAC frame data and The TCP header information is transferred to the L4 data receiving unit (41).

  Note that the L3 data receiving unit (31) can receive an IP address registered in the L3 / L4 passage permission list (35), the L3 / L4 restriction target list (36), or by the designation from the determination unit (60), or Based on the TCP connection information, packet through processing, application relay processing, and MAC frame data discarding processing are performed on the MAC frame data.

(Function of L3 data transmission unit (32))
The L3 data transmission unit (32) transmits the MAC frame data received from the L3 data reception unit (31) to the network interface (20) via the data buffer (34). The L3 data transmission unit (32) receives TCP data transmitted from the L4 data transmission unit (42) in the L4 termination unit (40), and the TCP data belongs to the received TCP data. IP header information is assigned and IP data is constructed. Then, the L3 data transmission unit (32) attaches MAC header information to the constructed IP data, creates MAC frame data, and transmits the created MAC frame data to the network interface (20). . The L3 data transmission unit (32) temporarily stores the IP data in the data buffer (34) when the IP data constructed in the L3 data transmission unit (32) is the IP data to be regulated, and the transmission regulation. After processing, the IP data once stored in the data buffer (34) is taken out, MAC header information is added to the taken out IP data, MAC frame data is created, and the created MAC frame data is transferred to the network. It is transmitted to the interface (20).

  Note that the L3 data transmission unit (32) determines that the IP data matches the IP address registered in the L3 / L4 restriction target list (36) or the TCP connection information according to the designation from the determination unit (60). In addition, transmission restriction processing (delay addition processing) is performed on IP data whose restriction operation corresponds to “delay”.

(Function of L3 data measurement unit (33))
The L3 data measuring unit (33) receives the IP header information and TCP header information transmitted from the L3 data receiving unit (31), and based on the received IP header information and TCP header information, the same transmission source Measure the number of TCP connections for the same destination port number (SMTP in this embodiment) with the IP address or the number of TCP connections for the same source port number (SMTP in this embodiment) with the same destination IP address. become.

  The L3 data measuring unit (33) measures the number of TCP connections with the same source IP address and the same destination port number measured based on the IP header information and the TCP header information received from the L3 data receiving unit (31), or When it is determined that the number of TCP connections with the same destination IP address and the same transmission source port number is equal to or greater than a predetermined value preset in the L3 data measurement unit (33), it is determined that the number is equal to or greater than the predetermined value. The transmitted IP header information and TCP header information are transmitted to the determination unit (60).

(Function of data buffer (34))
The data buffer (34) is transmitted from the L3 data receiving unit (31) and the L3 data transmitting unit (32) (from the L3 data receiving unit (31) to the MAC frame data, from the L3 data transmitting unit (32)). Is used for temporarily storing IP data).

(Functions of the L3 / L4 passage permission list (35) and the L3 / L4 restriction target list (36))
The L3 / L4 passage permission list (35) stores an IP address of data that is not subject to restriction and TCP connection information. With respect to data stored in the L3 / L4 passage permission list (35), all the restriction operations are to be performed as a passage process (packet-through process). Therefore, the L3 / L4 passage permission list (35) includes a restriction operation. This means that there is no restriction operation information item indicating. The L3 / L4 restriction target list (36) stores an IP address of data to be restricted, TCP connection information, and restriction operation information.

  The information stored in the L3 / L4 passage permission list (35) and the L3 / L4 restriction target list (36) is set from the determination unit (60). The information stored in the L3 / L4 passage permission list (35) and the L3 / L4 restriction target list (36) is referred to by the L3 data receiving unit (31), and the L3 data receiving unit (31). Is used for collation between the IP header information extracted in step 1 and the TCP header information. An example of the data structure of the L3 / L4 passage permission list (35) is shown in FIG. An example of the data structure of the L3 / L4 restriction target list (36) is shown in FIG.

  The L3 / L4 passage permission list (35) shown in FIG. 6 includes an IP source address: IP SA, an IP destination address: IP DA, Protocol, a source port number: SP (Source Port), and a destination. The data structure includes a port number: DP (Destination Port).

  The L3 / L4 restriction target list (36) shown in FIG. 7 has a data structure in which items of restriction operation information indicating restriction actions are newly added to the L3 / L4 passage permission list (35). In this embodiment, the restriction operation includes relay (application relay processing), delay (delay addition processing), and discard (MAC frame data discard processing).

(Configuration of L4 terminal portion (40))
The L4 termination unit (40) is connected to the traffic control unit (30), the application processing unit (50), and the determination unit (60).
The L4 termination unit (40) includes an L4 data reception unit (41), an L4 data transmission unit (42), an L4 data measurement unit (43), and a data buffer (44). The

(Function of L4 data receiving unit (41))
The L4 data receiving unit (41) receives the MAC frame data, the IP header information, and the TCP header information transmitted from the L3 data receiving unit (31) of the traffic control unit (30). When the L4 data receiving unit (41) receives the MAC frame data transmitted from the L3 data receiving unit (31) of the traffic control unit (30), the L4 data receiving unit (41) performs a TCP termination process. As TCP termination processing, TCP connection state transition management, TCP connection open processing (3-way handshake), TCP connection close processing (4-way handshake), TCP from MAC frame data Examples include data extraction processing, arrival packet order management, SMTP message reconstruction processing, and the like.

  In addition, when receiving the MAC frame data, the L4 data receiving unit (41) performs an extraction process of upper protocol data (SMTP message in the present embodiment) included in the received MAC frame data, and the extracted SMTP The message is transmitted to the application data receiving unit (51) for SMTP relay processing. When the L4 data receiving unit (41) receives the back pressure signal from the application data receiving unit (51), the L4 data receiving unit (41) stops the transmission of the SMTP message to the application data receiving unit (51), and the SMTP message is sent to the data buffer (44). Will be temporarily stored. The L4 data receiving unit (41) reads the SMTP message temporarily stored in the data buffer (44) by releasing the reception of the back pressure signal, and reads the read SMTP message to the application data receiving unit ( 51).

  Further, the L4 data receiving unit (41) manages the transition state of each TCP connection by the TCP connection state transition management, which is a TCP termination process, and the TCP connection information of the corresponding TCP data and the TCP connection information A start notification and an end notification are transmitted to the L4 data measurement unit (43). In addition, the L4 data receiving unit (41) performs a reception restriction process on the TCP data in the MAC frame data designated by the determining unit (60). Note that reception restriction processing for TCP data includes rejection of new connection acceptance (data discard when receiving SYN packet data) and disconnection of an already connected connection (discarding received data thereafter).

(Function of L4 data transmission unit (42))
The L4 data transmission unit (42) receives the SMTP message transmitted for the SMTP relay process from the application data transmission unit (52), performs the construction process of the TCP data based on the received SMTP message, and the construction process The TCP data subjected to is transferred to the L3 data transmission unit (32). At this time, the L4 data transmission unit (42) refers to the information on the transition state of the TCP connection managed in the L4 data reception unit (41) and performs TCP data transmission control.

  The L4 data transmission unit (42) transmits a back pressure signal to the application data transmission unit (52) when it is desired to stop receiving the SMTP message transmitted from the application data transmission unit (52). Note that the L4 data transmission unit (42) performs a transmission restriction process for specific TCP data designated by the determination unit (60). Transmission restriction processing for TCP data includes new connection acceptance rejection (RST packet data transmission when receiving SYN packet data), disconnection of already connected connection (FIN packet data transmission), TCP ACK transmission delay, and the like.

(Function of L4 data measurement unit (43))
The L4 data measuring unit (43) measures the duration of the corresponding TCP connection based on the TCP connection information, the start notification of the corresponding TCP connection, and the end notification transmitted from the L4 data receiving unit (41).

  Also, the L4 data measurement unit (43) sends a new start TCP connection to the determination unit (60) based on the TCP connection information transmitted from the L4 data reception unit (41) and the start notification and end notification of the corresponding TCP connection. And the end TCP connection.

  In addition, the L4 data measurement unit (43) transmits the TCP connection information to the determination unit (60) when the duration of the TCP connection managed in the L4 data measurement unit (43) exceeds a threshold value. It will be. Note that the threshold value of the duration of the TCP connection is set in advance in the L4 data measurement unit (43). In addition, the threshold value of the TCP connection duration can be changed.

(Function of data buffer (44))
The data buffer (44) receives data transmitted from the L4 data receiving unit (41) and the L4 data transmitting unit (42) (from the L4 data receiving unit (41) to the SMTP message and from the L4 data transmitting unit (42)). (TCP data) is used for temporarily storing.

(Configuration of application processing unit (50))
The application processing unit (50) is connected to the L4 termination unit (40) and the determination unit (60).
The application processing unit (50) includes an application data receiving unit (51), an application data transmitting unit (52), an application data measuring unit (53), a data buffer (54), and an application pass permission list (55). ), An application restriction target list (56), and an application execution unit (57).

(Function of application data receiving unit (51))
The application data receiving unit (51) receives the SMTP message transmitted from the L4 data receiving unit (41). Then, the application data receiving unit (51) transmits the received SMTP message to the application executing unit (57) in message units. When the application execution unit (57) determines that the amount of the SMTP message exceeds the transfer processing capacity, the application execution unit (57) determines that the SMTP message needs to be temporarily stored, and transmits the back pressure signal to the application data reception unit (51). ) Will be sent to. As a result, the application data receiving unit (51) receives the back pressure signal from the application executing unit (57), and the application data receiving unit (51) temporarily stores the SMTP message in the data buffer (54). Will be stored. Then, the application data receiving unit (51) transmits SMTP message identification information for identifying the SMTP message temporarily stored in the data buffer (54) to the application executing unit (57). When the application execution unit (57) determines that the amount of the SMTP message does not exceed the transfer processing capacity, the application execution unit (57) determines that the transfer process is possible, and the application execution unit (57) transmits the back pressure signal. And the SMTP message temporarily stored in the data buffer (54) is read based on the SMTP message identification information received from the application data receiving unit (51). Thus, the application execution unit (57) acquires the SMTP message temporarily stored in the data buffer (54).

  When the reception of the back pressure signal is canceled, the application data receiving unit (51) reads the SMTP message temporarily stored in the data buffer (54), and reads the read SMTP message into the application execution unit (57 ) Can also be sent.

  The application data receiving unit (51) receives the back pressure signal from the application execution unit (57), and when the SMTP message is temporarily stored in the data buffer (54), the data buffer (54) is full. When the SMTP message cannot be stored in the data buffer (54) and it is desired to stop receiving the SMTP message transmitted from the L4 data receiving unit (41), the application data receiving unit (51) A back pressure signal is transmitted to (41). As a result, the L4 data receiving unit (41) stops transmitting the SMTP message to the application data receiving unit (51), and the L4 data receiving unit (41) temporarily stores the SMTP message in the data buffer (44). Will be stored.

(Function of application data transmission unit (52))
The application data transmission unit (52) transmits the SMTP message received from the application execution unit (57) to the L4 data transmission unit (42) in the L4 termination unit (40). When the application data transmission unit (52) receives the back pressure signal from the L4 data transmission unit (42), it stops transmitting the SMTP message to the L4 data transmission unit (42) and temporarily stores the SMTP message as data. It is stored in the buffer (54). When the reception of the back pressure signal is canceled, the application data transmission unit (52) reads the SMTP message temporarily stored in the data buffer (54), and reads the read SMTP message into the L4 data transmission unit ( 42).

(Function of application execution unit (57))
The application execution unit (57) interprets the SMTP message received from the application data reception unit (51) or the SMTP message read from the data buffer (54), determines whether to transfer the SMTP message, and generates a new SMTP message. Processing will be performed. Normally, the application execution unit (57) relays the SMTP message to the next network (SMTP relay). In this case, the application execution unit (57) transfers the SMTP message to the application data transmission unit (52).

  The application execution unit (57) is instructed by the application data transmission unit (52) to suspend data transmission during other data processing during the SMTP message transfer process, and temporarily transmits the SMTP message. If it is necessary to save the data, the application execution unit (57) temporarily stores the SMTP message in the data buffer (54). When the application data transmission unit (52) cancels the data transmission interruption instruction, the application execution unit (57) temporarily stores the data in the data buffer (54). The stored SMTP message is read out, and the read SMTP message is transmitted to the L4 data transmission unit (42) via the application data transmission unit (52).

  The application execution unit (57) is instructed to interrupt data transmission from the application data transmission unit (52), and the application execution unit (57) is required to temporarily store the SMTP message. Temporarily stores the SMTP message in the data buffer (54), transmits the SMTP message identification information for identifying the stored SMTP message to the application data transmission unit (52), and transmits the application data transmission unit (52). When it is determined that the data can be received, the SMTP message stored in the data buffer (54) is read out based on the SMTP message identification information received from the application execution unit (57). SMTP message corresponding to message identification information Acquires, it is also possible to send SMTP messages obtained to the L4 data transmitter (42).

  As a result of interpreting the SMTP message, the application execution unit (57) extracts the state of the SMTP transaction, the sender mail address of the SMTP message, and the destination mail address information. Then, the application execution unit (57) manages the SMTP transaction that is performing the SMTP relay process based on the state of the SMTP transaction extracted from the SMTP message. Further, the application execution unit (57) transmits information on the state of the SMTP transaction extracted from the SMTP message, the source mail address of the SMTP message, and the destination mail address to the application data measurement unit (53). Become.

  In addition, the application execution unit (57) is a mail address that is not subject to restriction stored in the application passage permission list (55) based on the sender mail address and the destination mail address of the SMTP message, or the application Collation processing is performed with the email addresses to be regulated stored in the regulation target list (56), and unconditional passage, conditional passage, and regulation processing are determined based on the result of the collation processing.

  When the sender email address or the destination email address of the SMTP message matches the email address stored in the application passage permission list (55), the application execution unit (57) The SMTP relay process is unconditionally performed as the SMTP transaction process.

  Further, the application execution unit (57) does not match the mail address stored in the application passage permission list (55) because the sender mail address or the destination mail address of the SMTP message does not match the application restriction target list (56). ), The application execution unit (57) performs the SMTP relay process as the SMTP transaction process.

  Further, the application execution unit (57) does not match the mail address stored in the application passage permission list (55) because the sender mail address or the destination mail address of the SMTP message does not match the application restriction target list (56). ), The application execution unit (57) refers to the restriction content field (restriction operation in FIG. 9) in the application restriction object list (56), and processes the SMTP transaction. One of a plurality of restriction processes (discard, delay, relay) is selected and the process is executed.

(Function of application data measuring unit (53))
The application data measuring unit (53) is applicable based on the information transmitted from the application execution unit (57) (information on the state of the SMTP transaction, the sender mail address of the SMTP message, and the destination mail address). The number of SMTP transaction mails is measured for each IP address. The application data measurement unit (53) measures the number of MAIL commands, the number of RCPT commands, and the number of SMTP error responses in the corresponding SMTP transaction. Then, when the application data measurement unit (53) determines that any of the above measurement numbers is equal to or greater than the prescribed value for each measurement number, the measurement information of the SMTP transaction and the STMP transaction that are greater than the prescribed value. Are transmitted to the determination unit (60).

(Function of data buffer (54))
The data buffer (54) is used as a temporary storage location for data used by the application data reception unit (51), the application data transmission unit (52), and the application execution unit (57).

(Functions of application pass permission list (55) and application restriction target list (56))
In the application passage permission list (55), as shown in FIG. 8, in addition to the items of the L3 / L4 passage permission list (35), an item of an e-mail address that is not subject to restriction is added. 57) and the application data receiving unit (51).

  In addition, in the application restriction target list (56), as shown in FIG. 9, in addition to the items of the L3 / L4 restriction target list (36), the TCP connection upper limit number for restriction activation determination and the mail to be restricted. At least one item of the address and the upper limit number of e-mails for restriction activation determination is added, and is referred to from the application execution unit (57) and the application data reception unit (51). In addition to the items of the L3 / L4 restriction target list (36), FIG. 9 shows the TCP connection upper limit number for restriction activation determination, the mail address to be restricted, the upper limit number of e-mails for restriction activation determination, This shows a configuration in which three items are added.

  FIG. 10 shows a configuration in which an item of the upper limit number of TCP connections for restriction activation determination is added to the items of the L3 / L4 restriction target list (36). In addition, FIG. 11 shows another example, in addition to the items in the L3 / L4 restriction target list (36), items of the restriction target mail address and the restriction mail activation upper limit number are added. The configuration is shown.

(Configuration of determination unit (60))
The determination unit (60) is configured by connecting a traffic control unit (30), an L4 termination unit (40), and an application processing unit (50).

  The determination unit (60) collects measurement information of each layer transmitted from the L3 data measurement unit (33), the L4 data measurement unit (43), and the application data measurement unit (53), and collects the collected information. Based on the measurement information, an event to be regulated (IP address unit, TCP connection unit, SMTP transaction unit, mail address unit) is determined. Then, the determination unit (60) transmits the performed determination result to the traffic control unit (30), the L4 termination unit (40), and the application processing unit (50), and the restriction processing instruction at each part. Will do.

  The determination unit (60) includes a passage permission list (65), a restriction object list (66), a restriction object management list (67), and a determination logic part (61).

(Function of the passage permission list (65))
The passage permission list (65) is a master list of the L3 / L4 passage permission list (35) in the traffic control unit (30) and the application passage permission list (55) in the application processing unit (50). It is a combination. The pass permission list (65) is set by the user who uses the application bandwidth control apparatus (1) in the present embodiment, and the pass permission list (65) is the L3 / L4 pass permission list (35). ) And the application passage permission list (55) and are registered in the traffic control unit (30) and the application processing unit (50).

(Function of restriction list (66))
The restriction target list (66) is a master list of the L3 / L4 restriction target list (36) in the traffic control unit (30) and the application restriction target list (56) in the application processing unit (50). It is a combination. The restriction target management list (66) is a dynamic list in which the application band control device (1) manages IP addresses, TCP connections, and SMTP transactions that are subject to restriction.

(Function of restriction target management list (67))
The regulation target management list (67) is notified from the IP address information notified from the L3 data measuring unit (33), the TCP connection information notified from the L4 data measuring unit (43), and notified from the application data measuring unit (53). The received SMTP transaction information is received, and the received IP address information, TCP connection information, and SMTP transaction information are managed.

(Function of judgment logic unit (61))
The determination logic unit (61) includes IP header information and TCP header information notified from the L3 data measurement unit (33), and a new start TCP connection, end TCP connection, and TCP connection notified from the L4 data measurement unit (43). The information, the SMTP transaction information notified from the application data measurement unit (53), the measurement information of the STMP transaction, and the items in the restriction target list (66) are collated. This is to determine whether or not the SMTP transaction is SMTP regulation target traffic.

  When the determination logic unit (61) determines that the SMTP transaction is SMTP restriction target traffic, it adds the corresponding SMTP transaction information, TCP connection information, and IP address information to the restriction target management list (67). become. At the same time, the determination logic unit (61) performs the restriction operation described in the restriction operation field in the restriction object list (66) determined that the SMTP transaction is the SMTP restriction object traffic, and the traffic control part (30), Sent to the L4 termination unit (40) and the application processing unit (50) to instruct regulation processing at each part, and to be regulated units (IP address unit, TCP connection unit, SMTP transaction unit, mail address unit) Each regulation operation is executed.

(Processing operation in the application bandwidth control device (1))
Next, bandwidth control in the application bandwidth control apparatus (1) having the above configuration will be described with reference to FIG. FIG. 12 is a flowchart showing a control process in the application band control device (1) in the present embodiment.

  First, when packet data arrives at the network interface (20) from the external communication device via the input ports (21, 22), the network interface (20) receives the packet data (step S1). Then, the network interface (20) transmits the received packet data to the L3 data receiving unit (31) of the traffic control unit (30), and the L3 data receiving unit (31) is connected to the L3 data receiving unit (31). Filtering is performed on the packet data received from the network interface (20) by the provided SMTP Traffic filter (not shown), and it is determined whether or not the packet data is SMTP packet data ( Step S2).

  Next, when the L3 data receiving unit (31) determines that the packet data transmitted from the network interface (20) is SMTP packet data (step S2 / SMTP), the L3 data receiving unit (31) The L3 / L4 passage permission list (35) is referred to, and the SMTP packet data is stored in the IP address of the data to be excluded from restriction stored in the L3 / L4 passage permission list (35) or the TCP connection information. It is determined whether or not they match (step S3).

  In the determination process of step S2, the determination condition for determining that the L3 data receiving unit (31) is the SMTP packet data is that the packet data is TCP packet data and the source port number: SP (Source Port) or destination port number: DP (Destination Port) is SMTP (= 25). In the case of other packet data (step S2 / NO · SMTP), the L3 data receiving unit (31) passes the packet data as it is through the data buffer (34) to the L3 data transmitting unit (32) ( Packet through: Step S5) and transfer to the network interface (20) (Step S11).

  If the SMTP packet data matches the IP address of the data to be excluded from restriction stored in the L3 / L4 passage permission list (35) or the TCP connection information in the determination process of step S3, the L3 data reception is performed. When the unit (31) determines (step S3 / Hit), the L3 data receiving unit (31) determines that the SMTP packet data is the passage-permitted packet data, and directly uses the SMTP packet data via the data buffer (34). The data is passed through the L3 data transmitter (32) (packet through: step S5) and transferred to the network interface (20) (step S11).

  In addition, if the SMTP packet data does not match the IP address to be excluded from the restriction or the TCP connection information stored in the L3 / L4 passage permission list (35) in the determination process of step S3, the L3 data receiving unit When (31) is determined (step S3 / NO · Hit), the L3 data receiving unit (31) determines that the SMTP packet data is the restriction target packet data, and the L3 data receiving unit (31) is the restriction target. It is determined whether the SMTP packet data determined to be packet data is a port number of a transmission source port number: SP (Source Port) or a destination port number: DP (Destination Port) (step S4).

  In the determination process of step S4, when the L3 data receiving unit (31) determines that the SMTP packet data is the transmission source port number: SP (Source Port) (step S4 / SP = SMTP), L3 The data receiving unit (31) determines that the SMTP packet data is packet data including an SMTP command response (SP = SMTP: SMTP command response) and does not handle the packet data to be regulated, but the SMTP packet response. In order to manage the transition state, the application processor (50) performs SMTP monitoring of SMTP packet data (step S9-1).

  In the determination process of step S4, when the L3 data receiving unit (31) determines that the SMTP packet data is the destination port number: DP (Destination Port) (step S4 / DP = SMTP), the L3 data The receiving unit (31) determines that the SMTP packet data is the SMTP command and the packet data constituting the mail data (DP = SMTP: SMTP command and mail data). Then, the L3 data receiving unit (31) performs a reference process of the L3 / L4 restriction target list (36) to handle the SMTP packet data as restriction target packet data, and the SMTP packet data is converted to L3 / L4. It is determined whether the IP address of the data to be regulated stored in the regulation target list (36) or the TCP connection information matches (step S6).

  Next, the L3 data receiving unit (31) determines that the SMTP packet data does not match the IP address or TCP connection information of the data to be regulated stored in the L3 / L4 regulation target list (36). If it is determined (step S6 / NO / Hit), the application processor (50) performs SMTP monitoring of the SMTP packet data (step S9-1).

  In addition, the L3 data receiving unit (31) determines that the SMTP packet data matches the IP address of the data to be regulated stored in the L3 / L4 regulation target list (36) or the TCP connection information. In this case (step S6 / Hit), the SMTP packet data is subjected to restriction processing (step S7) or policing (step S8), which is restriction processing, and then the SMTP packet is sent to the application processing unit (50). Data SMTP monitoring is performed (step S9-2).

  Note that the process of limiting the number of connections in step S7 is performed by the L4 termination unit (40) shown in FIG. The policing in step S8 is performed by the L3 data receiving unit (31) shown in FIG.

  Further, in the SMTP monitor performed in steps S9-1 and S9-2, statistical information collection of SMTP traffic in units of IP addresses and TCP connections is performed. The statistical information collection of SMTP traffic in units of IP addresses and TCP connections in steps S9-1 and S9-2 is performed by the application data measuring unit (53) shown in FIG. Note that the SMTP packet data subjected to the SMTP monitor in step S9-2 is subjected to delay addition / shaping which is a restriction process in the L3 data transmission unit (32) shown in FIG. 5 (step S10).

  The packet data subjected to SMTP monitoring in step S9-1 or the packet data subjected to delay addition / shaping in step S10 is transmitted to the network interface (20) (step S11).

  Further, the statistical information collected by performing the SMTP monitor in step S9-1 and step S9-2 is collected in the determination unit (60) shown in FIG. 5, and is the traffic subject to SMTP regulation in the determination unit (60)? If it is determined that the traffic is restricted traffic, the restricted list reference process in step S6, the connection number limiting process in step S7, the policing in step S8, and the step S10 Delay addition and shaping are performed (step S12).

  The traffic control unit (30), the L4 termination unit (40), the application processing unit (50), and the determination unit (60) constituting the application bandwidth control device (1) in the present embodiment are dedicated. The hardware and firmware can be used, and the processing operation in the present embodiment can be realized even if the hardware and firmware are used.

  As described above, the application bandwidth control device (1) according to the present embodiment is subject to restriction while the application processing unit (50) inspects the data content of the application layer and detects the restriction target data. In the restriction control for data, the traffic control unit (30) serving as the L3 layer or the L4 termination unit (40) serving as the L4 layer performs the regulation control of the traffic and the connection. As a result, the application bandwidth control device (1) in the present embodiment can greatly improve the processing capability as compared with the case where the application processing unit (50) serving as the application layer performs transaction regulation control. For example, the application bandwidth control device (1) in the present embodiment can regulate mail that is distributed indiscriminately to an unspecified number of users from various SMTP traffic.

Next, a second embodiment will be described.
The application bandwidth control device (1) in the second embodiment, in addition to the processing operation in the application bandwidth control device (1) in the first embodiment, a sender email address (Mail From) of the SMTP message, and The destination email address (RCPT-To) is searched, and the number of emails for each email address is measured based on the sender email address (Mail From) of the searched SMTP message and the destination email address (RCPT-To). The mail delivery is regulated in units of mail addresses based on the number of mails for each measured mail address.

  Note that the application bandwidth control device (1) in the second embodiment is configured such that the application execution unit (57) of the application bandwidth control device (1) shown in FIG. ) And the destination mail address (RCPT-To), and the application mail measuring unit (53) sends the sender mail address (Mail From) and the destination mail address (RCPT-To) of the searched SMTP message. Send. Then, the application data measurement unit (53) measures the number of emails for each email address based on the sender email address (Mail From) and the destination email address (RCPT-To), and for each email address thus measured. Are sent to the determination unit (60). Then, the determination unit (60) updates the restriction object management list (67) and searches and passes the restriction object list (66) based on the number of mails for each mail address received from the application data measurement part (53). The permission list (65) is searched, and mail delivery is restricted on a mail address basis. As a result, it is possible to more specifically specify the mail transmitted by a specific user and limit the transmitted mail.

Next, a third embodiment will be described.
The application bandwidth control apparatus (1) according to the third embodiment is configured such that the application data measurement unit (53) shown in FIG. 5 transmits information (SMTP transaction status and SMTP message transmission) transmitted from the application execution unit (57). Based on the original mail address and the destination mail address), the number of destination mail addresses of the corresponding SMTP message is measured for each IP address, and the number of destination mail addresses of the SMTP message measured for each IP address is determined (60 ). Then, the determination unit (60) updates the restriction object management list (67) and restricts the restriction object list (66 based on the number of destination mail addresses of the SMTP message for each IP address received from the application data measurement part (53). ) And the passage permission list (65), the mail distribution is restricted in units of IP addresses, and the number of destination mail addresses in one transaction is limited. As a result, it is possible to more specifically specify the mail transmitted by a specific user and limit the transmitted mail.

Next, a fourth embodiment will be described.
The application bandwidth control apparatus (1) in the fourth embodiment adds a measurement function for measuring the number of packets for each IP address and the number of packets for each TCP connection to the L3 data measurement unit (33) shown in FIG. However, it is characterized by monitoring the traffic volume more finely.

Next, a fifth embodiment will be described.
The application bandwidth control apparatus (1) in the fifth embodiment is configured so that the L3 data receiving unit (31) shown in FIG. 5 performs IP packet level processing in the delay addition / shaping process in step S10 shown in FIG. The L4 data receiving unit (41) and the L4 data transmitting unit (42) shown in FIG. 5 perform TCP ACK response delay addition and TCP window size change processing. This makes it possible to limit a specific TCP connection according to the traffic volume of mail transmitted by a specific user.

Next, a sixth embodiment will be described.
In the application bandwidth control apparatus (1) in the sixth embodiment, the L3 data receiving unit (31) shown in FIG. 5 performs IP packet level processing in the delay addition / shaping process in step S10 shown in FIG. In the application execution unit (57) shown in FIG. 5, a delay is added to the SMTP command response. This makes it possible to limit a specific SMTP transaction according to the amount of mail traffic transmitted by a specific user.

Next, a seventh embodiment will be described.
In the application bandwidth control apparatus according to the seventh embodiment, instead of performing the connection number limiting process in step S7 of FIG. 12, the application execution unit (57) performs the SMTP transaction restriction process. As a result, it is possible to limit the amount of mail traffic transmitted from a specific information processing apparatus.

Next, an eighth embodiment will be described.
The application bandwidth control device (1) according to the eighth embodiment performs a restriction process for a specific SMTP transaction in the application execution unit (57) in response to an instruction from the determination unit (60) shown in FIG. The reception restricting process for the SMTP transaction with the specific source address is performed in the receiving unit (51), and the transmission restricting process for the SMTP transaction with the specific destination address is performed in the application data transmitting unit (52). This makes it possible to limit the traffic volume of mail transmitted from a specific information processing apparatus.

  The above-described embodiment is an example of a preferred embodiment of the present invention. The embodiment of the present invention is not limited to this, and various modifications are made without departing from the scope of the present invention. It is possible to implement in the form. For example, the processing operation in the application band control device in the above embodiment can also be executed by a computer program. The above program can be an optical recording medium, a magnetic recording medium, a magneto-optical recording medium, a semiconductor, or the like. It is also possible to cause the information processing apparatus to execute the processing operations described above by recording the information in the recording medium and causing the information processing apparatus to read the program from the recording medium. It is also possible to cause the information processing apparatus to execute the processing operations described above by causing the information processing apparatus to read a program from an external device connected via a predetermined network. The application band control device in the above embodiment has been described with respect to the case where the L3 layer is IP, the L4 layer is TCP, and the application layer is SMTP. However, the L3 layer, L4 layer, and application layer protocols are different protocols. Even if it is used, it is applicable.

  The bandwidth control device, bandwidth control method, and bandwidth control program according to the present invention are applicable to network devices such as bridges, routers, and gateways provided between information processing devices connected via a network.

It is a figure which shows an example of the conventional mail delivery system. It is a figure which shows another example of the conventional mail delivery system. It is a figure which shows an example of the mail delivery system using the application band control apparatus in this embodiment. It is a figure which shows another example of the mail delivery system using the application zone | band control apparatus in this embodiment. It is a block diagram which shows the structure of the application band control apparatus in this embodiment. It is a figure which shows the structural example of the database of a L3 / L4 passage permission list | wrist (35). It is a figure which shows the structural example of the database of a L3 / L4 control object list | wrist (36). It is a figure which shows the structural example of the database of an application passage permission list (55). It is the 1st figure showing the example of composition of the database of application regulation object list (56) and regulation object list (66), and the upper limit number of TCP connections for regulation starting judgment, the mail address used as regulation object, and regulation starting judgment 3 shows a configuration in which three pieces of information, i.e., the upper limit number of emails, are stored. Is shown. It is a 2nd figure which shows the example of a structure of the database of an application control object list | wrist (56) and a control object list | wrist (66), and has shown the structure by which the TCP connection upper limit number for a regulation starting determination was stored. It is the 3rd figure showing the example of composition of the database of application regulation object list (56) and regulation object list (66), and the mail address used as regulation object and the mail upper limit number for regulation starting judgment are stored. The configuration is shown. It is a flowchart which shows the processing operation of the application band control apparatus in this embodiment.

Explanation of symbols

1 Application Bandwidth Control Device 2-1 to N (N is an arbitrary integer) MTA (Message Transfer Agent: Mail Server)
3 management domain 20 network interface 21, 22 input port 23, 24 output port 30 traffic control unit 31 L3 data reception unit 32 L3 data transmission unit 33 L3 data measurement unit 34, 44, 54 data buffer 35 L3 / L4 passage permission list 36 L3 / L4 restriction target list 40 L4 termination unit 41 L4 data receiving unit 42 L4 data transmitting unit 43 L4 data measuring unit 50 application processing unit 51 application data receiving unit 52 application data transmitting unit 53 application data measuring unit 55 application pass permission list 56 Application restriction target list 57 Application execution part 60 Judgment part 61 Judgment logic part 65 Pass permission list 66 Restriction target list 67 Restriction target management list 101 Router

Claims (8)

A bandwidth control device connected to at least one information processing device,
Detection means for detecting data subject to regulation based on the data content of the L4 connection;
Control means for controlling communication restriction of data to be restricted;
A bandwidth control apparatus comprising:   2. The bandwidth control apparatus according to claim 1, further comprising a first restriction target exclusion unit that excludes packet data that does not include SMTP in the port number from the restriction target data.   The port number includes SMTP, and packet data whose IP address of the packet data including the SMTP is a specific source IP address or destination IP address to be excluded from the restriction is defined as the restriction. The band control device according to claim 1, further comprising a second restriction target exclusion unit that excludes the target data.   4. The apparatus according to claim 1, further comprising a third restriction object exclusion unit that excludes packet data including a specific mail address that is not restricted from the restriction data. 5. The bandwidth control apparatus described. A bandwidth control method performed by a bandwidth control device connected to at least one information processing device,
A detection step of detecting data subject to regulation based on the data content of the L4 connection;
A control step for controlling communication restriction of data to be restricted;
The bandwidth control method, wherein the bandwidth control device performs the above.   6. The bandwidth control method according to claim 5, wherein the bandwidth control device performs a restriction target exclusion step of excluding packet data whose port number does not include SMTP from the restriction target data. A bandwidth control program to be executed by a bandwidth control device connected to at least one information processing device,
A detection process for detecting data subject to regulation based on the data content of the L4 connection;
Control processing for controlling communication restriction of data to be restricted;
Is executed by the bandwidth control apparatus.   8. The bandwidth control program according to claim 7, wherein the bandwidth control apparatus causes the bandwidth control device to execute a restriction target exclusion process for excluding packet data whose port number does not include SMTP from the restriction target data.

Images