JP2009272659A - Communication control apparatus, communication control method and communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To apply a stateful inspection to communication from a client out of a site to a network in the site. <P>SOLUTION: The communication control apparatus 35 includes: a name resolution section 31 for registering a server address generated in response to an access request specifying a sever name to a server 15 in the a network 100 in the site from a terminal device 25 in a network 200 out of the site, and an address of the terminal device 25 in an access control list (ACL) 32 in pairs and transmitting the server address to the terminal device 25; and a communication control section 33 for permitting communication between the terminal device and the server 15 when the server address to be paired with the address of the terminal device is already registered in the access control list 32 for communication from the terminal device in the network 200 out of the site to the network 100 in the site. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a communication control apparatus, a communication control method, and a communication system for monitoring communication from an off-site network to an in-site network in an in-site network.

  As a packet filtering method for realizing a firewall, there is dynamic filtering in which only a session port is dynamically opened. As an improvement of the dynamic filtering technique, there is a stateful inspection technique (see, for example, Patent Document 1). In the stateful inspection, determination of communication control for a connection request for a new communication is made according to information on a state derived from past communication or an application. The determination of communication control is, for example, determination regarding packet filtering. An example of stateful inspection is described in Non-Patent Document 1.

JP2007-212240 (paragraph 0002) “Introduction to IDS Snort & Tripwireno Basics and Practice”, Ryu Hiyoshi, Technical Review, April 25, 2004, pp. 107-109

  A case will be described in which stateful inspection as described in Non-Patent Document 1 is applied to a gateway apparatus (hereinafter referred to as a gateway) installed at a data gateway for an off-site network in a site network.

  As shown in FIG. 6, when a client (client device) 20 in the intra-site network 100 communicates with a server device (hereinafter referred to as a server) 30 in the off-site network 200, the gateway 10 starts from the server 30 in the off-site network 200. The filter setting is changed so as to allow communication to the in-site network 100. In the intra-site network 100, the client 20 and the gateway 10 communicate via the LAN 40.

  When the communication between the client 20 in the in-site network 100 and the server 30 in the off-site network 200 is completed, the gateway 10 does not allow communication from the server 30 in the off-site network 200 to the client 20 in the in-site network 100. Change the filter settings to.

  As shown in FIG. 6, the gateway 10 permits communication in the access control list (ACL) of its own device based on communication from the intra-site network 100 to the off-site network 200 (see arrows A and B). Registration is performed, and thereafter, regarding communication from the off-site network 200 (see arrows C and D), it is determined whether to permit communication by checking the access control list.

  In the stateful inspection shown in FIG. 6, access control is performed based on information obtained from a communication packet or the like obtained in the gateway 10 when the client 20 in the intra-site network 100 connects to the server 30 in the off-site network 200. Pair information such as a client address and a server address is registered in the list. Then, based on the registered contents of the access control list, the communication from the server 30 in the off-site network 200 that is started thereafter to the client 10 in the intra-site network 100 is controlled. The intra-site network 100 is a network under the management of the gateway 10. The off-site network 200 is a network that is not managed by the gateway 10.

  In the stateful inspection shown in FIG. 6, since communication control is started when the intra-site network 100 is connected to the off-site network 200, a client (not shown in FIG. 6) in the off-site network 200 starts the intra-site network. Stateful inspection cannot be applied to communications for connections to servers at 100 (not shown in FIG. 6).

  Therefore, an object of the present invention is to provide a communication control device, a communication control method, and a communication system that can apply stateful inspection to communication from a client in an off-site network to a server in the in-site network.

  A communication control device according to the present invention is a communication control device that monitors communication from an off-site network to an in-site network, and an access request specifying a server name from a terminal device in the off-site network to a server device in the in-site network A name resolution unit for registering the server address generated for the terminal and the address of the terminal device in a pair in the access control list, and transmitting the server address to the terminal device, and in-site from the terminal device in the off-site network A communication control unit that permits communication between the terminal device and the server device when a server address that is paired with the address of the terminal device is registered in the access control list for communication with the network. And

  A communication control method according to the present invention is a communication control method for monitoring communication from an off-site network to an in-site network, and an access request specifying a server name from a terminal device in the off-site network to a server device in the in-site network A server address is generated for the server, and the generated server address and the address of the terminal device are registered in the access control list as a pair, and the server address is transmitted to the terminal device. For the communication with respect to the terminal device, it is confirmed whether or not a server address that is paired with the address of the terminal device is registered in the access control list, and when the server address is registered in the access control list, the terminal device and the server device And permits the communication.

  A communication system according to the present invention is a communication system in which a communication control device for monitoring communication from an off-site network to an in-site network and a server device for providing a service are provided in the in-site network, the communication control device Register the server address generated in response to the access request specifying the server name from the terminal device to the server device in the off-site network and the address of the terminal device in the access control list, and When a server address that is paired with the address of the terminal device is registered in the access control list for communication from the name resolution unit that transmits the server address to the intra-site network from the terminal device in the off-site network, the terminal Device and server device Characterized in that it comprises a communication control unit to allow communication.

According to the present invention, stateful inspection can be applied to communication from a client of an off-site network to a server of the intra-site network.

  Embodiments of the present invention will be described below with reference to the drawings.

Embodiment 1. FIG.
FIG. 1 is an explanatory diagram showing a first embodiment of a communication system including a communication control device according to the present invention. The communication system shown in FIG. 1 includes an intra-site network 100 and an off-site network 200. In the intra-site network 100, a gateway 3 is installed as a communication control device for communication with the off-site network 200. . FIG. 1 shows a server 1 in the intra-site network 100 and a client 2 in the off-site network 200. In the intra-site network 100, the server 1 and the gateway 3 communicate via the LAN 40.

  FIG. 2 is a block diagram illustrating an internal configuration example of the server 1 and the gateway 3 in the intra-site network 100. As shown in FIG. 2, the server 1 includes a local site server 11 and a main service 12. The local site server 11 has a function of dynamically generating a server address (for example, an IP address) in response to an address generation request from the gateway 3 and transmitting the generated server address to the gateway 3. When the local site server 11 generates a server address, the local site server 11 checks whether or not the address of another server or network device existing in the intra-site network 100 is duplicated. 1 new server address.

  The main service 12 is a main function of the server 1 and is a service provided to the client 2 in response to an access request from the client 2, that is, a service request. Actually, a block for providing a service realized by software or the like in the server apparatus provides the main service 12. The server address is dynamically generated by the local site server 11, but the block providing the main service 12 deletes the server address when the provision of the main service 12 is completed.

  In this embodiment, it does not matter what service the block that provides the service provides. That is, the communication control device and the communication control method according to the present invention can be applied to the main service 12 that provides an arbitrary service. In the configuration shown in FIG. 2, the function of the local site server 11 and the main service 12 are realized in the server 1, but the function of the local site server 11 and the server device that provides the main service 12 are provided. However, it may be realized by a separate device.

  The client 2 is a terminal device such as a PC (Personal Computer) or PDA (Personal Digital Assistant), and has a function of connecting to the Internet, a network, or the like (Ethernet (registered trademark), wireless LAN, or the like). That is, it is a terminal that can use services on the Internet or a network. The client 2 uses the main service 12 in the server 1 via a communication network such as the Internet.

  The gateway 3 includes a name resolution unit 31, an ACL (access control list) 32, and a communication control unit 33. The name resolution unit 31 has a function of transmitting a server address to the client 2 in response to receiving a server name name resolution request from the client 2. Specifically, when receiving a server name name resolution request from the client 2, the name resolution unit 31 issues an address generation request to the local site server 11 in the server 1. It has a function of acquiring a server address from the local site server 11 and providing it to the client 2.

  The name resolution unit 31 pairs the client address (for example, IP address) of the client 2 that made the name resolution request with the server address returned from the local site server 11 in response to the address generation request, and performs ACL (access control). List) 32. The ACL 32 is a database that records information such as a pair of a client address and a server address, and a port. The communication control unit 33 has a function of controlling communication from the client 2 in the off-site network 200 to the server 1 of the in-site network 100 based on the information of the ACL 32. That is, the communication control unit 33 permits communication if it matches information such as a client address / server address pair and port, and does not permit communication if they do not match.

  The intra-site network 100 is a network protected by the gateway 3. That is, the gateway 3 protects the in-site network 100 from unauthorized access from the off-site network 200.

  Next, the operation of the first embodiment of the present invention will be described with reference to the explanatory diagram of FIG. 1 and the sequence diagram of FIG.

  The client 2 of the off-site network 200 acquires the server name (for example, Fully Qualified Domain Name (FQDN) or LDAP (Lightweight Directory Access Protocol) of the server 1 of the intra-site network 100 to acquire an address by name resolution. ) (DN (Distinghished Name) etc.)), an address acquisition request (name resolution request) is transmitted (step A1: see also arrow A in FIG. 1).

  When the name resolution unit 31 of the gateway 3 receives the address acquisition request of the client 2, it identifies the server 1 based on the server name, and transmits a server address generation request for the client 2 to the local site server 11 of the server 1. (Step A2: See also arrow B in FIG. 1). The gateway name resolution unit 31 and the local site server 11 of the server 1 communicate with each other using a local address that can be reached only in the intra-site network when transmitting / receiving a server address generation request. The name resolution unit 31 stores the client address of the client 2.

  Upon receiving a server address generation request from the name resolution unit 31 of the gateway 3, the local site server 11 of the server 1 generates a server address (step A3). The local site server 11 generates a server address so that the generated server address is not biased toward a specific address. That is, a random server address is generated.

  Further, when the local site server 11 of the server 1 assigns a server address to the server 1, the addresses of other servers and network devices connected to the intra-site network 100 and the address generated by the process of step A3 are used. It is confirmed whether or not they overlap (step A4). If the addresses are duplicated, the process of step A3 is executed again to generate a server address.

  When the local site server 11 of the server 1 can confirm that there is no address duplication in the intra-site network 100, it gives a server address to the server 1 (step A5). When a server address for the client 2 is given to the server 1, an incoming call to the block that provides the main service 12 is enabled by the server address.

  The local site server 11 of the server 1 sends the server address to the name resolution unit 31 of the gateway 3 after assigning the server address (step A6: see also the arrow C in FIG. 1).

  The name resolution unit 31 of the gateway 3 registers the pair of the client address and the server address of the client 2 stored in the process of Step A2 in the ACL 32 (Step A7). The address pair registered in the ACL 32 is used by the gateway 3 to allow communication if the packet client address (source address) and server address (destination address) match. The name resolution unit 31 also registers port information such as the port number of the server 11 in the ACL 32.

  Then, the name resolution unit 31 of the gateway 3 transmits the server address to the client 2 (step A8: see also the arrow D in FIG. 1). Also, port information such as the port number of the server 11 may be transmitted to the client 2. The name resolution unit 31 of the gateway 3 stores the data transmitted from the intra-site network 100 side to the client 2 as a session log by the process of step A7.

  Thereafter, the client 2 transmits a service request to the main service 12 of the server 1 using the server address without disconnecting the session (step A9).

  The communication control unit 33 of the gateway 3 confirms whether a service request packet from the client 2 to the main service 12 of the server 1 can be passed. Specifically, it is confirmed whether or not the server address (destination address) paired with the client address (source address) transmitted by the client 2 is registered in the ACL. If a pair of a client address and a server address is registered in the ACL 32, the communication control unit 33 determines that communication is permitted and passes a service request packet addressed to the block that provides the main service 12 (step A11: FIG. 1). (See also arrow E). If not registered in the ACL 32, the service request packet addressed to the block providing the main service 12 is discarded (step A10). Therefore, the communication control unit 33 passes packets that are consistent with the session log stored by the name resolution unit 31. Note that the communication control unit 33 may refer to the port information registered in the ACL 32 to determine whether to permit communication.

  When the block that provides the main service 12 of the server 1 receives a service request from the client 2, it transmits data to be the provided service to the client 2 via the gateway 3 (step A 12: arrow F in FIG. 1 also) reference).

  The client 2 receives service data from the block that provides the main service 12 of the server 1 and then sends a service end notification (for example, a TCP FIN packet) to the server 1 (step A13).

  When the communication control unit 33 of the gateway 3 detects a service end notification packet from the client 2 to the server 1, the communication control unit 33 passes the service end notification packet through the intra-site network 100 and also sets a pair of the client address and server address of the ACL 32. Is deleted (step A14). By deleting the information of the client address of the client 2 and the server address of the server 1 from the ACL 32, the communication packet is then passed when there is a communication from the client 2 to the block that provides the main service 12 of the server 1. Do not allow.

  The block that provides the main service 12 of the server 1 receives the service end notification from the client and ends the service. Then, the block that provides the main service 12 deletes the server address (step A15).

  This embodiment is particularly effective in an environment in which the server address of the server 1 changes each time communication is performed from a client. In this embodiment, when a client of the off-site server 200 requests the main service 12, a session for requesting a service (specifically, a session started from communication related to an address acquisition request (name resolution request)) ) Is generated only in the server address (referred to as address X) (see steps A1 to A5), a session log is saved regarding the response to the client that requested the service (see step A7), and the saved session Only actual service requests that are consistent with the log are accepted (see steps A10 and A11). When the session ends, the server address that was valid during the session is deleted (see steps A, 14, and A15), so even if a service request is made for address X in another session, the request is accepted. I can't.

Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described. The device configuration in the second embodiment is the same as the configuration shown in FIG. However, in the second embodiment, the gateway 3 generates a server address.

  The operation of the second embodiment of the present invention will be described with reference to the sequence diagram of FIG. The processing of steps B1, B7 to B15 shown in FIG. 4 is the same as the processing of steps A1, A7 to A15 shown in FIG. Therefore, the processing of steps B2 to B6 will be mainly described below.

  When receiving the address acquisition request of the client 2 (step B1), the name resolution unit 31 of the gateway 3 stores the client address of the client 2 that made the request and generates a server address (step B2). The name resolution unit 31 generates a server address so that the generated server address is not biased toward a specific address.

  Further, when the name resolution unit 31 of the gateway 3 assigns a server address to the server 1, the address of another server or network device connected to the intra-site network 100 and the address generated in the process of step B2 are It is confirmed whether or not they overlap (step B3). If the addresses are duplicated, the process of step B2 is executed again to generate a server address. The name resolution unit 31 detects duplication of addresses using, for example, a DAD (Duplicate Address Detection) technique in the process of step B3.

  The name resolution unit 31 transmits a server address assignment request including the generated server address to the site local server 11 of the server 1 in order to request that the generated server address be assigned (step B4).

  The site local server 11 of the server 1 receives the server address assignment request from the name resolution unit 31 and assigns a server address to the server 1 (step B5). And the local server 11 will transmit a server address grant completion to the name resolution part 31 of the gateway 3, if a server address is provided (step B6).

  Thereafter, the server 1 and the gateway 3 execute processing (steps B7 to B15) as in the case of the first embodiment (steps A7 to A15).

  Also in this embodiment, when a client of the off-site server 200 requests the main service 12, a session for requesting a service (specifically, a session started from communication related to an address acquisition request (name resolution request)) ) Is generated only in the server address (referred to as address X) (see steps B1 to B5), a session log is saved regarding the response to the client that requested the service (see step B7), and the saved session Only actual service requests that are consistent with the log are accepted (see steps B10 and B11). When the session ends, the server address that was valid during the session is deleted (see steps B14 and B15), so even if a service request is made for address X in another session, the request is not accepted. .

  As described above, in each of the above-described embodiments, stateful inspection can be applied to communication from the client 2 of the off-site network 200 to the server 1 of the intra-site network 100. This is because it is possible to dynamically create an access control list using the server address after name resolution by using name resolution means.

  FIG. 5 is a block diagram showing the main configuration of the communication control apparatus according to the present invention. As shown in FIG. 5, in the present invention, the communication control device 35 is configured such that the server name from the terminal device 25 (corresponding to the client 2 in each of the above embodiments) in the off-site network 200 to the server device 15 in the in-site network 100. A name resolution unit 31 that registers the server address generated in response to the access request specifying the address of the terminal device 25 in the access control list (ACL) 32 and transmits the server address to the terminal device 25; For communication from the terminal device (not necessarily the terminal device 25) in the off-site network 200 to the intra-site network 100, a server address that is paired with the address of the terminal device is registered in the access control list 32. The terminal device and the server device 15 And a communication control unit 33 to allow the communication.

  The communication control unit 33 does not permit communication between the terminal device and the server device 15 when the server address that is paired with the address of the terminal device is not registered in the access control list 32. Then, the communication control unit 33 deletes the pair of the server address and the address of the terminal device 15 from the access control list 32 when the communication session permitted by the communication control unit 33 ends.

  Further, the server address may be generated by the server device 15 or may be generated by the communication control device 35.

  The present invention can be applied to communication applications such as a firewall and remote access that allow only communication from correct devices to pass from an external network to an internal network.

It is explanatory drawing which shows 1st Embodiment of the communication system containing the communication control apparatus by this invention. It is a block diagram which shows the internal structural example of the server and gateway in a site network. It is a sequence diagram for demonstrating operation | movement of 1st Embodiment. It is a sequence diagram for demonstrating operation | movement of 2nd Embodiment. It is a block diagram which shows the main structures of the communication control apparatus by this invention. It is explanatory drawing which shows an example of the communication system which can apply a stateful inspection.

Explanation of symbols

1 server (server device)
2 Client (client device)
3 Gateway 10 Gateway 11 Local Server 12 Main Service 15 Server Device 20 Client (Client Device)
25 Terminal device 30 Server (server device)
31 Name resolution part 32 Access control list (ACL)
33 Communication control unit 35 Communication control unit 40 LAN
100 intra-site network 200 off-site network

Claims (14)

A communication control device that monitors communication from an off-site network to an on-site network,
A server address generated in response to an access request specifying a server name from a terminal device in the off-site network to a server device in the site network and the address of the terminal device are registered in the access control list as a pair, and the terminal A name resolution unit for transmitting the server address to a device;
For communication from the terminal device in the off-site network to the intra-site network, when a server address that is paired with the address of the terminal device is registered in the access control list, communication between the terminal device and the server device is performed. A communication control device comprising: a communication control unit to permit. The communication control device according to claim 1, wherein the communication control unit does not permit communication between the terminal device and the server device when a server address paired with the address of the terminal device is not registered in the access control list. The communication control device according to claim 1, wherein the communication control unit deletes the pair of the server address and the address of the terminal device from the access control list when the communication session permitted by the communication control unit ends. The communication control device according to any one of claims 1 to 3, wherein the name resolution unit generates a server address in response to an access request from the terminal device. The communication control device according to any one of claims 1 to 4, wherein the communication control device is a gateway device in a site network. A communication control method for monitoring communication from an off-site network to an on-site network,
A server address is generated in response to an access request specifying a server name from a terminal device in an off-site network to a server device in the site network,
Register the generated server address and terminal device address in pairs in the access control list, and send the server address to the terminal device,
For communication from the terminal device in the off-site network to the in-site network, check whether a server address that is paired with the address of the terminal device is registered in the access control list,
A communication control method, comprising: permitting communication between the terminal device and the server device when a server address is registered in the access control list. The communication control method according to claim 6, wherein communication between the terminal device and the server device is not permitted when a server address that is paired with the address of the terminal device is not registered in the access control list. 8. The communication control method according to claim 6, wherein when the permitted communication session ends, a pair of a server address and a terminal device address is deleted from the access control list. A communication control apparatus for monitoring communication from an off-site network to an intra-site network and a server apparatus for providing a service are provided in the intra-site network,
The communication control device includes:
A server address generated in response to an access request specifying the server name from the terminal device in the off-site network to the server device and the address of the terminal device are registered in the access control list as a pair, and the terminal device A name resolution unit that sends the server address;
For communication from the terminal device in the off-site network to the intra-site network, when a server address that is paired with the address of the terminal device is registered in the access control list, communication between the terminal device and the server device is performed. And a communication control unit that permits the communication system. The communication system according to claim 9, wherein the communication control unit does not permit communication between the terminal device and the server device when a server address paired with the address of the terminal device is not registered in the access control list. 11. The communication system according to claim 9, wherein the communication control unit deletes the pair of the server address and the address of the terminal device from the access control list when the communication session permitted by the communication control unit ends. The communication system according to any one of claims 9 to 11, wherein the server device generates a server address in response to an access request from the terminal device and transmits the server address to the communication control device. The communication system according to any one of claims 9 to 11, wherein the name resolution unit generates a server address in response to an access request from the terminal device. The communication system according to any one of claims 9 to 13, wherein the communication control device is a gateway device in a site network.

Images