JP2011097423A - Error generating apparatus and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a second apparatus, which receives a packet containing data and a header, to generate an error caused by the data. <P>SOLUTION: An error generating apparatus 1 captures a TLS packet (S103), adds a TCP header to TLS data extracted from the TLS packet (S131), adds an IP header to the TCP data (S133), adds a frame header or the like to the IP data (S135), and transmits the TLS packet to a SIP server 2 (S141). <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an error generating apparatus and method.

  Conventionally, when developing a SIP (Session Initiation Protocol) server or the like that handles a TLS (Transport Layer Security) connection, it is necessary to generate a fatal error based on the TLS protocol in the SIP server. There is.

JP 2009-33258 A

RFC 4346 "The Transport Layer Security (TLS) Protocol Version 1.1", April 2006

  For example, even if the communication path existing between the SIP server and the partner terminal is disconnected, the fatal error cannot be generated. Further, even if a packet including an abnormal header is transmitted to the SIP server, for example, the packet is ignored and a fatal error cannot be generated.

  That is, in order to generate a fatal error, a packet based on the TLS protocol needs to be transmitted to the SIP server. In addition, since a fatal error is generated by data based on the TLS protocol included in the packet, headers other than data (parameters based on TCP (Transmission Control Protocol), IP (Internet Protocol), and Ethernet (registered trademark) regulations are used. Etc.) must be normal. If such parameters are not normal, for example, the packet is ignored as described above, and a fatal error does not occur.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide an error generation apparatus and method for generating an error due to data in a second apparatus that receives a packet including data and a header. There is.

  In order to solve the above problems, the present invention provides a first device (for example, a SIP (Session Initiation Protocol) server or terminal) and a second device (for example, a SIP server) that transmit and receive a packet including data including a sequence number and a header. The second device generates an error, and the first device updates the sequence number included in the transmitted packet and transmits the packet including the updated sequence number. Yes, the second device is assumed to receive a packet including a header included in a packet transmitted from the first device to the second device, and the second device itself updates the sequence number. If a packet including a sequence number other than the updated sequence number is received, the error is generated and the error is generated. A device includes a packet capturing unit that captures a packet between the first device and the second device, and a packet that is transmitted from the first device to the second device and extracts data from the packet captured by the packet capturing unit. Using the processing unit and the packet captured by the packet capturing unit, a header included in a packet transmitted from the first device to the second device is generated, and the header and the extracted data are included. A packet generation unit that generates a packet and a packet transmission unit that transmits the packet to the second device.

  For example, the first device encrypts the data and includes it in the packet, and the second device decrypts the data included in the packet.

  For example, the sequence number is based on TLS (Transport Layer Security) rules.

  For example, the header includes first device information related to the first device (for example, an IP address or a port number of the first device), and the second device is a first device equal to the first device information included in the received packet. Assuming that a packet including device information is received, the packet processing unit extracts a header from the captured packet, extracts first device information included in the header, and the packet generation unit 1 A packet including device information is generated.

  For example, the header includes second device information related to the second device (for example, an IP address or a port number of the second device), and the second device has a second value equal to the second device information included in the received packet. Assuming that a packet including device information is received, the packet processing unit extracts a header from the captured packet, extracts second device information included in the header, and the packet generation unit 2 Generate a packet containing device information.

  According to the present invention, it is possible to generate an error due to data in a second device that receives data, for example, a packet including TLS data based on the TLS protocol and a header, such as a SIP server.

It is a figure which shows the utilization form of the error generation apparatus which concerns on this Embodiment. It is a sequence diagram at the time of transmitting / receiving a TLS packet between the terminal 3 and the SIP server 2. FIG. It is a figure which shows the structure of a TLS packet. FIG. 3 is a sequence diagram showing an operation of the error generating device 1.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a usage form of the error generating apparatus according to the present embodiment. The error generating device 1 is a device that generates a fatal error based on a TLS (Transport Layer Security) protocol in a SIP (Session Initiation Protocol) server 2. The SIP server 2 is connected to the terminal 3 via the communication path N. The communication path N includes, for example, a router (not shown).

  The terminal 3 and the SIP server 2 transmit and receive packets based on the TLS protocol (hereinafter referred to as TLS packets).

  The error generating device 1 includes a packet capturing unit 11 that captures a TLS packet on a communication path between the terminal 3 and the SIP server 2, a packet processing unit 12 that retrieves TLS data included in the TLS packet, and a captured TLS packet. A packet generation unit 13 that generates a header included in a packet transmitted from the terminal 3, generates a packet including the header and the extracted TLS data, and a packet transmission unit that transmits the TLS packet to the SIP server 2 14.

(Operation of this embodiment)
Before describing the operation of the error generating device 1, transmission / reception of TLS packets between the terminal 3 and the SIP server 2 will be described.

  FIG. 2 is a sequence diagram when a TLS packet is transmitted and received between the terminal 3 and the SIP server 2. FIG. 3 is a diagram illustrating a configuration of a TLS packet.

  In FIG. 2, prior to transmission / reception of a TLS packet, the terminal 3 establishes a TLS connection based on the TLS protocol with the SIP server 2 (S1). At that time, a sequence number update method is determined between the terminal 3 and the SIP server 2 based on the TLS protocol.

  When transmitting the TLS packet to the SIP server 2, the terminal 3 adds a sequence number updated based on the TLS protocol, and encrypts the TLS data including the transmission content (S11).

  Next, the terminal 3 adds a TCP header based on the TCP (Transmission Control Protocol) protocol to the TLS data (S13). In this TCP header, a sequence number (hereinafter referred to as a SEQ number) based on a TCP protocol, an acknowledgment number (hereinafter referred to as an ACK number), a destination port number specified by the SIP server 2, and a terminal 3 are specified. Source port number.

  Next, the terminal 3 adds an IP header based on IP (Internet Protocol) rules to the TCP data (S15). This IP header includes a destination IP address indicating the SIP server 2 and a source IP address indicating the terminal 3.

  Next, the terminal 3 adds a frame header or a frame check sequence based on the Ethernet (registered trademark) protocol to the IP data (S17).

  Next, the terminal 3 transmits this TLS packet to the SIP server 2 (S19). Specifically, the terminal 3 sends a TLS packet to the communication path N, and a router or the like existing in the communication path N analyzes the TLS packet and transmits it to the SIP server 2 that is the destination.

  The SIP server 2 receives the TLS packet, extracts the TLS data from the received TLS packet, decodes the TLS data, and extracts the sequence number from the decoded TLS data. The SIP server 2 itself calculates and updates the sequence number, and compares the sequence number updated by itself with the sequence number extracted from the TLS packet transmitted this time (S20).

  If the sequence numbers are not equal, the SIP server 2 generates a fatal error based on the TLS protocol.

  That is, the SIP server 2 transmits a TLS packet indicating the occurrence of a fatal error to the terminal 3, but first, before transmission, encrypts TLS data including transmission contents indicating the occurrence of a fatal error (S21). .

  Next, the SIP server 2 adds a TCP header to the TLS data (S23). In this TCP header, the SEQ number equal to the ACK number extracted from the TLS packet received this time, the ACK number based on the TCP protocol, the destination port number specified by the terminal 3, and the SIP server 2 Source port number.

  Next, the SIP server 2 adds an IP header to this TCP data (S25). This IP header includes a destination IP address indicating the terminal 3 and a transmission source IP address indicating the SIP server 2.

  Next, the SIP server 2 adds a frame header or the like based on the Ethernet (registered trademark) protocol to the IP data (S27).

  Next, the SIP server 2 transmits a TLS packet to the terminal 3 (S29).

  Normally, since the sequence numbers are updated in step S11, it is determined that the sequence numbers are equal (S20), and no fatal error occurs.

  The SIP server 2 transmits a normal TLS packet to the terminal 3, but first, before transmission, extracts the TCP header from the TLS packet received this time, and extracts the ACK number from the TCP header.

  Further, the SIP server 2 encrypts the TLS data including the sequence number updated based on the TLS protocol and the transmission content (S21).

  Thereafter, the SIP server 2 generates a normal TLS packet and transmits it to the terminal 3 in the same procedure as that for transmitting a TLS packet indicating the occurrence of a fatal error (S23 to S29).

The terminal 3 receives the TLS packet, extracts the TLS data from the received TLS packet, decodes the TLS data, and extracts the sequence number from the decoded TLS data. The terminal 3 itself calculates and updates the sequence number, and compares the sequence number updated by itself with the sequence number extracted from the TLS packet transmitted this time.
If the sequence numbers are equal, the terminal 3 does not generate a fatal error based on the TLS protocol.

  The terminal 3 encrypts the TLS data including the sequence number updated based on the TLS protocol and the transmission content (S11).

  Thereafter, the terminal 3 generates a TLS packet and transmits it to the SIP server 2 as in the previous time (S13 to S19).

  The terminal 3 and the SIP server 2 operate similarly when transmitting / receiving TLS packets thereafter.

(Operation of error generating device 1)
Next, the operation of the error generating device 1 will be described.

  FIG. 4 is a sequence diagram illustrating the operation of the error generating device 1.

  As described above, the terminal 3 transmits a TLS packet to the SIP server 2 (S101).

  In the error generating device 1, the packet capturing unit 11 captures the TLS packet (S103).

  Note that the capture of the TLS packet does not affect transmission / reception, the TLS packet is received by the SIP server 2, and the SIP server 2 transmits the TLS packet to the terminal 3 (S105).

  The packet capturing unit 11 captures the TLS packet (S107). The capture of the TLS packet does not affect transmission / reception, and the TLS packet is received by the terminal 3.

  In the error generating device 1, before the terminal 3 transmits the next TLS packet to the SIP server 2, a TLS packet is generated and transmitted to the SIP server 2 as follows.

  First, the packet processing unit 12 extracts a frame header from the TLS packet captured in step S103, and extracts a MAC address indicating the nearest router from the frame header (S121).

  Further, the packet processing unit 12 extracts the IP header from the TLS packet captured in step S103, and extracts the destination IP address and the source IP address from the IP header (S123).

  Further, the packet processing unit 12 extracts the TCP header from the TLS packet captured in step S103, and extracts the destination port number and the transmission source port number from the TCP header (S125).

  Further, the packet processing unit 12 extracts the TCP header from the TLS packet captured in step S107, and extracts the ACK number from the TCP header (S127).

  Further, the packet processing unit 12 extracts TLS data from the TLS packet captured in step S103 (S129).

  Next, the packet generator 13 adds a TCP header to the TLS data (encrypted TLS data) extracted in step S129 (S131).

  This TCP header includes a SEQ number equal to the ACK number extracted in step S127, an ACK number based on the TCP protocol, and the destination port number and transmission source port number extracted in step S125.

  The packet generation unit 13 also sets values for the other parameters of the TCP header that are included in the TLS packet transmitted next time from the terminal 3 based on the TCP protocol. For example, a sufficiently large value is set for the window size.

  Next, the packet generator 13 adds an IP header to the TCP data (S133).

  This IP header includes the destination IP address and the source IP address extracted in step S123.

  The packet generation unit 13 also sets values for other parameters of the IP header that are included in the TLS packet transmitted next time from the terminal 3 based on the IP rules.

  Next, the packet generator 13 adds a frame header or the like to the IP data (S135).

  This frame header includes the MAC address extracted in step S121.

  The packet generator 13 also sets values for other parameters such as a frame check sequence to be included in the TLS packet transmitted from the terminal 3 next time based on Ethernet regulations.

  That is, the packet generation unit 13 generates a header (a part other than the TLS data in the TLS packet) included in the TLS packet transmitted next time from the terminal 3 based on the captured TLS packet, and extracts the generated header and A TLS packet including TLS data is generated.

  This is based on the premise that the SIP server 2 receives a TLS packet including such a header, so that an error does not occur depending on the problem of the header.

  Now, the packet transmitter 14 transmits the TLS packet to the SIP server 2 (S141).

  The SIP server 2 receives the TLS packet, extracts the TLS data from the received TLS packet, decodes the TLS data, and extracts the sequence number from the decoded TLS data. The SIP server 2 compares the sequence number updated by itself with the sequence number extracted from the TLS packet transmitted this time (S20).

  Since this TLS data is equal to the previous TLS data from the terminal 3, the retrieved sequence number is not updated. Therefore, the sequence numbers are not equal, and the SIP server 2 generates a fatal error based on the TLS protocol. Therefore, the target fatal error can be generated.

  Note that the SIP server 2 also checks parameters such as the port number, but since a value included in the TLS packet transmitted next time from the terminal 3 is set for this, the target fatal error is set. Any other error will not occur, and the occurrence of such an error can be prevented.

  When a fatal error occurs, both the terminal 3 and the SIP server 2 transmit ACK packets based on the TCP protocol, and each ACK packet does not include an appropriate SEQ number. Transmission may continue. In that case, it is preferable to end transmission of both ACK packets by transmitting an ACK packet including an appropriate SEQ number from the error generating device 1 to one of the terminal 3 and the SIP server 2.

  Therefore, according to the error generating device 1 of the present embodiment, for the portion (header) other than the TLS data, the value of the header included in the TLS packet transmitted next from the terminal 3 is set, that is, “spoofing”. Since the TLS data is included in the TLS packet as it is, a fatal error can be generated in the SIP server 2.

  Since the TLS data is encrypted, it is difficult to process the sequence number. Therefore, even if it is difficult to alter the sequence number, a fatal error occurs in the SIP server 2. Can be made. Note that the TLS data is not necessarily encrypted, and even in that case, a fatal error can be generated.

  In the present embodiment, the partner of the SIP server 2 is the terminal 3, but this may be replaced with a SIP server.

  In the present embodiment, a fatal error is generated in the SIP server 2 by TLS data. However, if an error occurs due to the same action, the data in the packet may not be TLS data.

  A computer program for causing a computer to function as the error generating device 1 can be recorded on a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, or a magnetic tape, and a communication network such as the Internet. And can be widely distributed.

DESCRIPTION OF SYMBOLS 1 ... Error generating apparatus 2 ... SIP server 3 ... Terminal 11 ... Packet capture part 12 ... Packet processing part 13 ... Packet generation part 14 ... Packet transmission part

Claims (7)

An error generating device that generates an error in the second device of the first device and the second device that transmit and receive a packet including data including a sequence number and a header,
The first device updates a sequence number included in the transmitted packet, and transmits a packet including the updated sequence number,
The second device is premised on receiving a packet including a header included in a packet transmitted from the first device to the second device, and the second device itself updates the sequence number, If a packet including a sequence number that is not the updated sequence number is received, the error is generated.
The error generating device is:
A packet capturing unit that captures a packet between the first device and the second device;
A packet processing unit that extracts data from a packet transmitted from the first device to the second device and captured by the packet capturing unit;
Using the packet captured by the packet capturing unit, a header included in the packet transmitted from the first device to the second device is generated, and a packet including the header and the extracted data is generated. A packet generator;
An error generating device comprising: a packet transmission unit that transmits the packet to the second device.   2. The error generating device according to claim 1, wherein the first device encrypts the data and includes the encrypted data in the packet, and the second device decrypts the data included in the packet.   3. The error generating apparatus according to claim 1, wherein the sequence number is based on a TLS (Transport Layer Security) protocol. The header includes first device information about the first device;
The second device is premised on receiving a packet including first device information equal to the first device information included in the received packet;
The packet processing unit extracts a header from the captured packet, extracts first device information included in the header,
The error generation device according to claim 1, wherein the packet generation unit generates a packet including the first device information. The header includes second device information about the second device;
The second device is premised on receiving a packet including second device information equal to the second device information included in the received packet;
The packet processing unit extracts a header from the captured packet, extracts second device information included in the header,
The error generation device according to claim 1, wherein the packet generation unit generates a packet including the second device information. An error generating method performed by an error generating device that generates an error in the second device of the first device and the second device that transmit and receive a packet including data including a sequence number and a header,
The first device updates a sequence number included in the transmitted packet, and transmits a packet including the updated sequence number,
The second device is premised on receiving a packet including a header included in a packet transmitted from the first device to the second device, and the second device itself updates the sequence number, If a packet including a sequence number that is not the updated sequence number is received, the error is generated.
The error generation method is as follows:
A packet capturing unit of the error generating device captures a packet between the first device and the second device;
The packet processing unit of the error generating device extracts data from the packet transmitted from the first device to the second device and captured by the packet capturing unit,
The packet generation unit of the error generation device generates a header included in a packet transmitted from the first device to the second device, using the packet captured by the packet capturing unit, and the header and the Generate a packet containing the extracted data,
An error generating method, wherein the packet transmitting unit of the error generating device transmits the packet to the second device.   A computer program for causing a computer to function as the error generating device according to claim 1.

Images