JP2007079815A - Autoimmune protection system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an autoimmune protection system, capable of protecting a computer from various threats even without a correction program. <P>SOLUTION: In this autoimmune protection system, a decoy server arranged on the Internet 111 is used, a record attacked is taken as a fingerprint, and this is reported as a template of autoimmune to an autoimmune template information management server within an internal network. The autoimmune template information management server forms a database of the new template, and reports it to each node or device to be monitored as a template of new threats, whereby each node connected to the internal network is protected from a new thread. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a system that protects a network and a node connected to the network from viruses, worms, and other threats that cause damage via the network.

  When connecting to the Internet, in order to protect the internal network from threats that might come from the outside, the external network and the internal network are separated by software or dedicated devices, commonly referred to as firewalls. It was.

  The firewall determines whether or not to allow incoming packets to pass through based on rules such as packet filtering defined in advance. Packets that are determined to be appropriate according to the defined contents pass through the firewall and reach the internal network.

  By using this method, it is possible to block network services that do not require external access, and as a result, it is possible to protect the internal network from external threats.

  However, with this method, if malicious data is included in the communication content recognized as correct by the firewall, there is a problem that the internal network cannot be protected from the threat that may be generated by this. there were.

  The firewall can monitor communication from the external network to the internal network and from the internal network to the external network, but packets exchanged in the internal network are not monitored. Therefore, there is a problem that a computer connected to the internal network via a computer brought in from a virus-infected state cannot be used as a defense against the situation where viruses and worms spread on the internal network. Have

As another conventional example, Patent Literature 1 and Patent Literature 2 can be cited.
Japanese Patent Laid-Open No. 2003-281023 JP 2005-063032 A

  As mentioned in the previous section, even if a firewall is installed to protect the internal network from threats from the Internet, there is no way to deal with viruses and worms brought in by routes other than the firewall.

  In addition, a fix for fixing a security hole that is attacked by a new virus or worm is supplied by the computer operating system manufacturer or application manufacturer. After the security hole is discovered, the fix is released and tested. In the meantime, your computer is exposed to threats to the security hole.

  In addition, depending on the contents of the corrections to the operating system, the application program that has been operating in the past may not operate normally, and even if there is a correction program, it may not be applicable. Yes. Computers equipped with such applications will be forced to be exposed to threats to their security holes virtually indefinitely.

  The present invention solves the above problems and provides an environment in which a computer can be protected from various threats without a correction program.

Using a decoy server placed on the Internet, the attacked record is used as a fingerprint, this is used as a template for autoimmunity, and this is notified to the autoimmune template information management server in the internal network. Create a new template in the information management database,
By notifying each node or device to be monitored as a new threat template, this protects each node connected to the internal network from new threats, thereby realizing an autoimmune defense system. is there.

  As described above, according to the present invention, a decoy server placed on the Internet is used, and the attacked record is used as a fingerprint, and this is used as a template for autoimmunity to manage autoimmune template information in the internal network. This is notified to the server, converted into a database as a new template in the autoimmune template information management database, and this is notified to each monitored node or device as a new threat template. By protecting each node connected to, it is possible to perform autoimmune protection.

  Hereinafter, the details of the present invention will be described in accordance with the description of the embodiments.

  1 and 2 are diagrams showing a network configuration according to an embodiment of the present invention.

  In FIG. 1, 101 and 102 are bag servers. This server group is placed outside the firewall 103, that is, at a position that is directly referred to from the Internet, and the attacker conducts some kind of attack preview activity or actual attack against this server. The number of servers may be one, but in this embodiment, two servers with different operating systems are installed.

  This server 101 or 102 records the packets received from the outside one by one and has the function of judging whether or not it matches the existing attack pattern (attack fingerprint). If this happens, this information is sent to the management console 104 via the firewall 103.

  The management console 104 stores the template information in the template database 105 using the new fingerprint as an attack template, and notifies the management console 104 and the network protocol stack portion 107 of the client computer 106 of the attack template.

  The client computer 106 checks whether the packet it receives matches the template information it has, and if it matches, discards this packet, making it unknown and not supporting security patches for the operating system It will be equipped with immunity that can defend itself against attacks.

  In the unlikely event that the trap server 101 or 102 is infected with a virus or worm, the router 110 and firewall 103 should have appropriate access control so that the Internet 111 and the internal network 112 are not affected. There is a need to do.

  In order to further improve safety, it is possible to adopt a configuration as shown in FIG.

  In FIG. 2, the trap server operates as a guest operating system that operates virtually in the host 208 or 209, and the host 208 or 209 connects to a segment 213 different from the segment to which the trap server is connected. ing. By adopting such a configuration, it is possible to monitor the status of the operating system by the host-side operating system even when the operating system itself of the server is damaged, and to increase the safety. It has become.

  Needless to say, appropriate access control is performed by the firewall.

  In both FIG. 1 and FIG. 2, the protocol stack part of the client computer 106 has a function of scanning the received packet against the template data. By installing it in between, it is possible for the defense mechanism of this system to function even for nodes that cannot provide protocol stack modification programs. It is very widespread without being restricted by hardware or operating system.

  FIG. 3 is a functional block diagram of the bag server 101 or 102 in this embodiment.

  In FIG. 3, the bag server 101 or 102 is connected to the network through the communication control unit 301. The communication control unit 301 captures all packets addressed to itself or flowing in the network to which the communication control unit 301 is connected, and sends the captured packet to the communication packet reading unit 304.

  It also manages communication with the management console 104.

  The communication packet reading unit 304 analyzes the packet captured by the communication control unit 301, and the packet data comparison unit receives the fingerprint and the database management device 351, and the received data matches the known attack fingerprint. Compare whether or not.

  Reference numeral 302 denotes an operation management unit that manages logs related to the operation of the server and users who can log in to the node.

  Reference numeral 303 denotes an information providing unit. If it is determined that the series of communications is an unknown attack as a result of the comparison by the packet data comparing unit 306, the fingerprint of the series of communications is displayed on the management console 104, And transmitted via the communication control unit 301.

  FIG. 4 is a functional block diagram of the management console 104 in this embodiment.

  In FIG. 4, the communication control unit 401 communicates with the client computer 106 via the network by the management console 104 via the network, the server 101 or 102, or the host server 108 or 109 that captures the guest operating system as a guest operating system. To manage.

  The operation management unit 402 manages logs related to the operation of the management console 104 and manages users who can log in to the node.

  Reference numeral 404 denotes an information providing unit that provides a new attack template to the client node via the data transmission unit 405 and the communication control unit 401.

  Reference numeral 405 denotes a template database management unit, which includes a fingerprint of a new attack sent from the 囮 server 101 or 102, or the host server 108 or 109 that incorporates the 囮 operating system as a guest operating system, or the client computer 106, A known attack pattern is used as a template for management using a template database management device 451.

  Reference numeral 406 denotes a client management unit that manages information about clients to be managed by the management console 104 using the management node data management unit 452.

  FIG. 5 is a functional block diagram of the client computer 106 in this embodiment.

  In FIG. 5, reference numeral 501 denotes a communication control unit which controls communication of the client computer 106 through the network.

  An operation management unit 502 performs an operation log of the client computer 106 and account management of available users.

  Also, the attack template information sent from the management console 104 is reflected in the template data management apparatus, and the deletion of the attack template information notified from the management console 104 is also handled.

  A communication packet reading unit 504 sends a packet received by the communication control unit 501 to the packet data comparison unit 506 before executing an operation requested by the packet.

  A data transmission unit 505 controls communication between the management console 104 and the communication control unit 501.

  A packet data comparison unit 506 verifies whether the packet received by the communication control unit 501 matches the unknown attack pattern notified from the management console using the template data management device 551.

  FIG. 6 is an attack fingerprint management table managed by the fingerprint and database management device 351 in the trap server 101 or 102.

  The fingerprint database stores all attack patterns of known threats. This information can be provided from the management console 104 side based on the template information provided from the provider of this system as well as the collected attack pattern data by the trap server 101 or 102. Is assumed.

  FIG. 7 is a template database management table managed by the template database management device 451 in the management console 104.

  As described above, each attribute information of the template database related to known attacks can be provided periodically or free of charge from the provider of this system, and it is always a known vulnerability. It is possible to maintain up-to-date information on threats to

  Further, information on attack patterns of new threats captured by the server is obtained from the template database of the management console 104 by the server 101 or 102, or the host server 108 or 109 that incorporates the operating system as a guest operating system. Provided to the management device 451.

  新 規 For new attack patterns that are captured by the server and registered in the template database, it is assumed that the information is known, and when the countermeasures and threat identification numbers (for example, CVE) are established, the provider side of this system Therefore, the information is updated in the information provided periodically or free of charge to the template data management prime minister 551 of the management console 104. In addition, depending on the degree of risk that the threat poses to the network and network-connected devices, it is possible to update the information at any time from the provider of this system without waiting for periodic information updates. It has become.

  FIG. 8 illustrates a management node database management table managed by the management node data management device 452 in the management console 104.

  Based on this table, the management console 104 recognizes the nodes that should be managed, the type and version of the operating system of the client computer 106 that is the management target, whether or not there is a description of security patches, and the operation. By having the configuration information such as the application, it is possible to send the template data necessary for each client computer 106 to the template data management device 551 of the client computer 106.

  FIG. 9 is a management table used when the client computer 106 manages template data.

  As described above, this template data is sent from the management console 104 to the template data management device 551 of each client computer 106, and is information optimized for each client computer 106. By performing this optimization, the template data management device 551 of each client computer 106 minimizes the information that must be held, and care is taken not to reduce the communication throughput.

  FIG. 10 shows the flow of information sent from the provider of this system to the template information database 451 of the management console.

  In FIG. 10, a template information providing server 1001 has a template master database 1002, which contains information on attack templates (fingerprints) for known threats (attack patterns) and their attacks. Holds the target operating system, patch information, and officially assigned ID (for example, CVE).

  The mold information providing server 1001 transmits 1061 a difference from the mold data information stored in the mold database 105 of the management console to the management console 104 for a fee or free of charge. At this time, the pull model from the management console side 104 and the push model from the mold information providing server 1001 side are conceivable as communication modes at this time. Based on the network management policy in which the system is installed.

  Needless to say, the communication between the template information providing server 1001 and the management console 104 should be encrypted after mutual authentication using a digital certificate or the like.

  When the management console 104 receives new mold information from the mold information providing server 1001, it registers 1062 in the mold database 105.

  As described above, the template information registered in the template database 105 is collated with the management node database 451, and the management console 104 creates the optimal template information for each client 106 managed by the management console 104. Distribute to At this time, as described above, a client computer that retains the template information and cannot reflect the function of matching with the received packet can be installed between the client computer 106 and the network as a dedicated device having this function. Packet monitoring is possible.

  In addition, the management console 104 creates an attack fingerprint information from the template data provided from the template information providing server 1001, and captures the trap server 101 or 102 or the trap operating system as a guest operating system. Send to 108 or 109 to keep the fingerprint database up to date.

  At this time, the communication between the management console 104 and the server 101 or 102, or the host server 108 or 109 that incorporates the guest operating system as a guest operating system, is mutually authenticated using a digital certificate or the like. Needless to say, encrypted communication should be performed.

  FIG. 11 shows the flow of information sent from the fingerprint DB of the bag server to the template information database 451 of the management console.

  In FIG. 11, the new threat (attack pattern) captured by the trap server 101 or 102 is reflected in the template database 105 held by the management console 104, and the client computer 106 is notified of the new threat (attack pattern). Is the flow of information.

  This process occurs when the trap server 101 or 102 receives an attack (a series of packet groups) that is not managed by the template information providing server 1001 and can be predicted as a new threat.

  The eaves server 101 or 102 uses a series of packets recognized as a new attack pattern as a fingerprint, and notifies the management console 1161. The management console 104 reflects this fingerprint information in the template database 105 and notifies 1063 the client computer 106 under management.

  Needless to say, the communication between the management console 104 and the server 101 or 102 or the host server 108 or 109 and 104 that incorporates the guest operating system as a guest operating system is also a digital certificate. Encrypted communication is performed after performing authentication using the above.

  Even if a virus or a worm that is the source of this new threat (attack pattern) flows into the firewall for some reason, the client computer 106 managed by the management console 104 It is possible to avoid attacks from viruses and worms.

Example 1 of autoimmune defense system configuration Example 2 of autoimmune defense system configuration Functional block diagram of bag server 101 or 102 in this embodiment Functional block diagram of the management console 104 in this embodiment Functional block diagram of the client computer 106 in this embodiment Example of management table with attack fingerprint Example of mold database management table Example of management table of management node database Example of mold data management table Example of information flow sent from the provider of this system to the template information database 451 of the management console Example of information flow sent from the server fingerprint DB to the management console template information database 451

Claims (4)

This is an autoimmune defense system that uses a decoy server located on the Internet and uses the recorded attack as a fingerprint and uses it as a template for autoimmunity to notify autoimmune template information management means in the internal network. There,
The decoy server has a database of fingerprints of various attacks on the Internet,
When receiving an access without a fingerprint in the database, this is regarded as a new threat, and has means for notifying the fingerprint obtained to the autoimmune template information management means in the internal network,
The autoimmune template information management means has means for creating a database of the fingerprint notified from the decoy server as a new template,
An autoimmune defense system capable of protecting each node connected to the internal network from a new threat by notifying each monitored node or device as a new threat template. This is a system control method that uses a decoy server placed on the Internet and uses the attack record as a fingerprint and uses it as an autoimmune template to notify autoimmune template information management means in the internal network. And
The decoy server has a database of fingerprints of various attacks on the Internet,
When receiving an access for which no fingerprint exists in the database, this is regarded as a new threat, and has a step of notifying the obtained fingerprint to the autoimmune template information management means in the internal network,
The autoimmune template information management means has a step of creating a database of a fingerprint notified from the decoy server as a new template,
A method for controlling an autoimmune defense system capable of protecting each node connected to the internal network from a new threat by notifying each monitored node or device as a new threat template. .   The program for implement | achieving the control method of the autoimmune type | mold defense system of Claim 2 by computer.   A computer-readable storage medium storing the program according to claim 3.

Images