JP2007221192A - Attack packet filter apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an attack packet filter apparatus capable of maintaining a stable communication state by preventing abnormity of a fragment management table and depletion of a packet buffer even when receiving an attack packet from a malicious communication opposite party. <P>SOLUTION: The attack packet filter apparatus 1 includes: a packet reception section 11 connected to a network and for receiving packets; a packet identification section 12 for identifying a fragment packet received by the packet reception section 11; a fragment decision section 13 for deciding whether or not the fragment packet is an illegitimate packet; a fragment reconfiguration section 15 for reconfiguring the fragment packets when all the fragment packets arrive; and a fragment packet storage section 18 for storing the fragment packets until they are reconfigured, and the filter apparatus 1 discards the fragment packet which is decided to be an illegitimate packet by the fragment decision section. The attack packet filter apparatus may be provided with the fragment management table 17 used for deciding whether or not the fragment packet is an illegitimate packet. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an attack packet filter device, and more particularly to an attack packet filter device that protects against attack packets (illegal fragment packets) in communication devices such as switches, layer 3 switches, routers, and servers.

  When data exceeding the MTU (Maximum Transmission Unit) of the network is transferred on the Internet, as shown in FIG. 5, the data is divided within a range not exceeding the MTU and transferred as a fragment packet. In a communication device such as a layer 3 switch or a router, reassembly (assembly) processing is performed after all fragmented packets have arrived and transferred to the communication destination.

  Here, due to the relay route, it is necessary to wait until all the fragment packets are collected, and the arrival fragment packet is temporarily stored in the packet buffer. Arrival fragment packets are managed by providing a fragment management table for each segment. Even in the server, fragment packets do not make sense individually, so they need to be reconstructed. A packet buffer that temporarily stores packets for reconstruction, and a fragment management table that manages incoming fragment packets Prepare.

  For example, Patent Document 1 discloses a packet buffer for reconstructing fragmented packets in order to reduce the load on the server and the network and improve economy and quality in stream distribution in a best effort IP network. A cache method and apparatus having a temporary buffer corresponding to the above and a temporary table corresponding to a fragment management table and a function of checking and reconstructing an incoming fragment packet are described.

  Further, in Patent Document 2, in order to suppress transmission delay, reduce a decrease in throughput when filtering, and reduce overhead, a head fragment packet is entered in a search machine, and subsequent fragment packets are stored in the search machine. A router device or the like that performs filtering processing based on entry information is disclosed.

  Further, in Patent Document 3, relay processing such as IP filtering, NAT address conversion, and encryption is performed even on a packet having a large data capacity, and the fragment packet is stored in an internal buffer in order to ensure packet data transfer. A data relay method for storing, grouping buffer management blocks by a double link queue structure and logically linking fragment packets is described.

Japanese Patent Laid-Open No. 2003-242019 JP 2002-281071 A JP 2005-12697 A

  However, in the above conventional technology, when an attack with malicious packets from an attacking party (illegal fragment packet) is received, the fragment management table is abnormal and the packet buffer is exhausted, resulting in communication failure. There was a problem.

  For example, when a communication device having no defense function is subjected to an overlapping attack, information of a TCP (Transmission Control Protocol) header is rewritten as shown in FIG. 6, and correct routing cannot be performed.

  In the case of a tiny fragment attack, as shown in FIG. 7, all TCP information cannot be obtained in the first packet, and correct routing cannot be performed.

  Furthermore, when a Ping of Death attack is received, the total size exceeds the manageable memory size as shown in FIG.

  Furthermore, when a Teardrop attack is received, the length (packet length) calculation becomes abnormal as shown in FIG. 9, and the fragment of the duplicate IP packet cannot be appropriately processed, and the system may crash. is there.

  Further, as shown in FIG. 10, there is a problem that the packet buffer is exhausted when incomplete fragment packets are continuously received.

  Therefore, the present invention has been made in view of the above-described problems in the prior art, and even when a malicious communication partner is attacked by an attack packet, the fragment management table is abnormal or the packet buffer is depleted. It is an object of the present invention to provide an attack packet filter device capable of maintaining a stable communication state.

  In order to achieve the above object, the present invention provides an attack packet filter device that is connected to a network and receives a packet from the network, and identifies a fragment packet received by the packet receiver. A packet identification unit to be performed, a fragment determination unit for determining whether or not the fragment packet is illegal, a fragment reconstruction unit for reconstructing a fragment packet when all fragments have arrived, and a reassembly of the fragment packet A fragment packet storage unit that stores the fragment packet until construction is performed, and the fragment packet determined to be illegal by the fragment determination unit is discarded.

  According to the present invention, for example, when an overlapping attack or a tiny fragment attack is received, an attack can be detected by checking the fragment offset in the fragment determination unit. Because the packet is discarded, even if a malicious communication partner is attacked by an attack packet, it is possible to maintain a stable communication state without causing an error in the fragment management table or exhaustion of the packet buffer. It becomes.

  The attack packet filter device may include a packet transmission unit that transmits a packet that has not been determined as a fragment packet by the packet identification unit and a packet that has been reconstructed by the fragment reconstruction unit.

  The attack packet filter device may further include a fragment management table for determining whether or not the fragment packet is illegal. By adding reconstruction information to the fragment management table, it is possible to detect an illegal fragment packet in a segment and discard the illegal fragment packet. For example, for the Ping of Death attack and the Teardrop attack, the last data position of the segment being reconstructed is set in the fragment management table to detect the attack, and for the continuous transmission attack of incomplete fragment packets. A received packet counter for the segment is provided in the fragment management table, and when the number of set packets is exceeded, it can be determined as an attack.

  In the attack packet filter device, the fragment management table can use TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) header information for segment management.

  As described above, according to the present invention, it is possible to maintain a stable communication state even if an attack by an attack packet of a malicious communication partner is received.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 shows an embodiment of an attack packet filter device according to the present invention. The attack packet filter device 1 is connected to a network via IP (Internet Protocol) and receives a packet from the network. 11, a packet identification unit 12 that identifies a fragment packet, a fragment determination unit 13 that performs segment determination of a fragment packet and an attack packet, and a fragment management unit 14 that manages each segment and a stored packet. A fragment reconstructing unit 15 that reconstructs a fragment packet when all fragments arrive, a packet that is not determined to be a fragment packet by the packet identifying unit 12, and a packet reconstructed by the fragment reconstructing unit 15. Packet to send the packet Packet transmission unit 16, a fragment management table 17 that stores fragment management information, and a packet buffer 18 that stores fragment packets until they are reconstructed. The fragment management table 17 has a configuration as shown in FIG.

  Next, the operation of the attack packet filter device 1 having the above configuration will be described with reference to FIGS.

  When the packet receiving unit 11 receives the packet, the packet identification unit 12 determines whether the packet is a fragment packet (step S11). If it is determined in step S11 that the packet is not a fragment packet, the packet is transmitted as it is in step S26 and the process is terminated. On the other hand, if it is determined in step S11 that the packet is a fragment packet, the fragment determination unit 13 determines whether the packet length is within the normal range (step S12), and whether or not a ping of death attack has occurred. Check whether or not. If it is outside the normal range, the received packet is discarded (step S20). The packet length is checked by checking that the value of TL (Total Length) + FO (Fragment Offset) × 8 in the header of the received packet is within the maximum value of 65,535 bytes of the IP packet.

  If the packet length is in the normal range in step S12, it is determined in step S13 whether or not the offset value is in the normal range, and it is checked whether an overlapping attack or a tiny fragment attack has been received. If it is outside the normal range, the received packet is discarded (step S20). The offset value is checked by checking that FO × 8 is 20 bytes or more which is the TCP header length.

  If the offset value is within the normal range in step S13, the table information of the corresponding segment is read from the fragment management table of FIG. 2 based on the IP address of the received packet and ID (Identification) (step S14). If there is no corresponding segment in step S15, the fragment management unit 14 registers a new segment (step S19). In the new segment, an IP address or the like is registered as table information.

  Next, in step S16, it is determined whether or not the number of received packets is within the threshold value from the read table information of the segment, and it is checked whether or not a continuous attack of incomplete fragment packets has been received. If it is larger than the threshold value, the received packet is discarded (step S20). If the number of received packets is within the threshold value, it is determined in step S17 whether or not it is a final fragment packet.

  If it is not the final fragment packet in step S17, the fragment management unit 14 updates the table information of the fragment management table 17 in FIG. 2 (step S25) and stores it in the packet buffer 18. The update information is the total size of received packets and the number of received packets.

  On the other hand, in the case of the last fragment packet in step S17, it is determined whether the reconstructed packet length is normal (step S18), and it is checked whether or not there is a teardrop attack. This determination is made by checking that the value of TL (Total Length) + FO (Fragment Offset) × 8 is equal to or larger than the total size of the received packets of the table information shown in FIG.

  If the final fragment packet is normal, the corresponding segment of the fragment management table 17 is deleted (step S21), the packet registered in the table information is read from the packet buffer 18, and the fragment reconstructing unit 15 The fragment packet is reconstructed (step S22).

  On the other hand, if the final fragment packet is not normal, the packet is discarded (step S23) and the segment of the fragment management table is deleted (step S24). The reconstructed packet is transmitted to the communication destination together with the packet other than the fragment by the packet transmission unit 16 (step S26).

  In the above embodiment, the attack packet filter device is configured on the assumption that it is realized by hardware. However, the operation of the flowchart shown in FIG. 3 is realized by software control using a CPU. Is also possible.

  In the above embodiment, the TCP header information is not included in the table information. However, in the case of a server or the like, the TCP port number is also added as necessary information. FIG. 4 shows the fragment management table configuration in that case.

It is a block diagram of the attack packet filter apparatus concerning this invention. It is a figure which shows the structure of the fragment management table of the attack packet filter apparatus of FIG. It is a figure which shows the processing flow by the attack packet filter apparatus of FIG. It is a figure which shows the structure (TCP header addition) of the fragment management table of the attack packet filter apparatus of FIG. It is a conceptual diagram of an IP fragment. It is a conceptual diagram of an overlapping attack. It is a conceptual diagram of a tiny fragment attack. It is a conceptual diagram of a Ping of Death attack. It is a conceptual diagram of a teardrop attack. It is a conceptual diagram of mass fragment attack.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Attack packet filter apparatus 11 Packet receiving part 12 Packet identification part 13 Fragment judgment part 14 Fragment management part 15 Fragment reconstruction part 16 Packet transmission part 17 Fragment management table 18 Packet buffer S11 Fragment packet judgment S12 Packet length check judgment S13 Offset value check Determination S14 Fragment management table read S15 Corresponding segment determination S16 Exceeding threshold of received packets in segment S17 Determination of final fragment packet S18 Determination of packet length after reconstruction S19 Fragment management table newly created S20 Packet discard S21 Fragment management table Delete S22 Fragment packet reconstruction S23 Packet discard S24 Fragment management table deletion S25 Fragment Capital management table update S26 packet transmission

Claims (4)

A packet receiving unit connected to the network and receiving packets from the network;
A packet identification unit for identifying a fragment packet received by the packet reception unit;
A fragment determination unit for determining whether or not the fragment packet is invalid;
A fragment reconstruction unit that reconstructs fragment packets when all fragments have arrived;
A fragment packet storage unit for storing the fragment packet until the fragment packet is reconstructed,
An attack packet filter device that discards a fragment packet determined to be illegal by the fragment determination unit.   The attack packet filter device according to claim 1, further comprising: a packet transmission unit that transmits a packet that is not determined as a fragment packet by the packet identification unit and a packet that is reconstructed by the fragment reconstruction unit. .   3. The attack packet filter device according to claim 1, further comprising a fragment management table for determining whether or not the fragment packet is illegal.   The attack packet filter device according to claim 3, wherein the fragment management table uses TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) header information for segment management.

Images