JP2012220975A - Network management system, management device, management target device, network management method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To protect a management target device from illegal setting even when a third person acquires authentication identification information by interception.SOLUTION: An SNMP v1 and an SNMP v2c are used as network management protocols. A management device calculates message authentication information of a SET request by using a common key and creates authentication VarBind including the message authentication information to transmit an SNMP message including the authentication VarBind. On receiving a SET request, a management target device verifies whether the SET request includes the authentication VarBind, when the SET request does not include the authentication VarBind, the management target device discards packets, and when the SET request includes the authentication VarBind, the management target device examines whether message authentication information included in the authentication VarBind exists already in a message authentication information cache, and if it exists, the management target device determines that it is replay attack and returns abnormal termination.

Description

  The present invention relates to a network management protocol technology.

  In SNMP (Simple Network Management Protocol) v1 and SNMPv2c, which are widely used as network management protocols, authentication identification information (community name) flows over the network as an unencrypted original. For this reason, when an SNMP message is wiretapped by a third party, there is a problem that information on the management target device is illegally acquired or set by an illegally acquired community name. In particular, an incorrect setting for the apparatus is an important problem because it may cause a serious problem such as bringing down the service.

  Several methods for improving security are considered for SNMPv1 and v2c. For example, in the technique disclosed in Patent Document 1, the community name or the entire SNMP message is encrypted. Further, in the technique disclosed in Patent Document 2, a community name is dynamically generated so that a community name once used cannot be used many times. In SNMPv3, an authentication function is strengthened as a protocol and SNMP message encryption is provided.

  SNMPv1 is standardized by RFC1155 to 1157, SNMPv2c is standardized by RFC1901, 3416, and SNMPv3 is standardized by RFC3411-3418.

JP 2003-122650 A JP 2003-316672-A

However, in the technique disclosed in Patent Document 1 described above, since the community name or the entire SNMP message is encrypted, there is a problem that readability deteriorates when a problem that occurs during operation is solved.
In addition, in the technique disclosed in Patent Document 2, since the dynamically generated community name flows on the network as the original text, if the community name is wiretapped, an illegal operation becomes possible. is there. In addition, the management device needs to request / acquire the community name dynamically generated by the management target device, and there is a problem that the network traffic is increased.

  In addition, SNMPv3 has a problem in that the specifications are complicated and protocol processing takes time compared to conventional SNMPv1 and v2c. Also, SNMPv3 and SNMPv1, v2c are not compatible because the overall framework and packet format are different. Therefore, since existing SNMPv1 and v2c processing functions cannot be utilized, there is a problem that introduction of SNMPv3 is costly.

  In view of the above circumstances, an object of the present invention is to provide a technique that can prevent unauthorized setting of a management target device even when authentication identification information is known to a third party by wiretapping. .

  One aspect of the present invention is a network management system in which SNMP is used as a network management protocol, and a management apparatus and a management target apparatus transmit and receive an SNMP message via a network. The management apparatus uses a common key. The message authentication information of the SET request is calculated, an authentication VarBind including the message authentication information is generated, and an SNMP message including the authentication VarBind is generated; and the SNMP message generation processing unit A packet transmission unit configured to generate and transmit a packet from the generated SNMP message and a destination address, wherein the management target device receives a packet from the management device, and the packet is a SET request. For example, VarBin for authentication If there is an SNMP message analysis processing unit that discards the packet if there is not, a message authentication information cache in which message authentication information already used for authentication is stored, and the authentication VarBind, the authentication If the message authentication information in the VarBind for use exists in the message authentication information cache, and if the message authentication information exists in the message authentication information cache, it is determined as a replay attack, and the SNMP message analysis processing unit An authentication MIB module that returns an abnormal termination to

  One aspect of the present invention is a management device that transmits and receives SNMP messages to and from a management target device via a network using SNMP as a network management protocol, and calculates message authentication information of a SET request using a common key The authentication VarBind including the message authentication information is generated, the SNMP message generation processing unit for generating the SNMP message including the authentication VarBind, the SNMP message generated by the SNMP message generation processing unit, and the packet from the destination address A packet transmission unit for generating and transmitting

  One aspect of the present invention is a management target device that transmits and receives an SNMP message to and from a management device via a network using SNMP as a network management protocol, and a packet reception unit that receives a packet from the management device; If the packet is a SET request, the presence or absence of an authentication VarBind is checked. If not, the SNMP message analysis processing unit discards the packet; a message authentication information cache in which message authentication information already used for authentication is stored; When there is the authentication VarBind, it is checked whether the message authentication information in the authentication VarBind is present in the message authentication information cache, and when the message authentication information is present in the message authentication information cache, Judged as a replay attack And an authentication MIB module returns an abnormal termination serial SNMP message analyzing unit.

  One aspect of the present invention is a network management method in which SNMPv1 and SNMPv2c are used as a network management protocol, and a management apparatus and a management target apparatus transmit and receive an SNMP message via a network. The first calculation step of calculating the message authentication information of the SET request using, the creation step of creating the authentication VarBind including the message authentication information by the management device, and the management device of the authentication VarBind An SNMP message generating step for generating an SNMP message including: a packet transmitting step for generating and transmitting a packet from the SNMP message generated at the SNMP message generating step and a destination address by the management device; and ,in front A packet receiving step for receiving a packet from the management device; a step for checking whether or not the management target device has an authentication VarBind if the packet is a SET request; and If there is no packet, a discard step for discarding the packet; and if the managed device has the authentication VarBind, the message authentication information in the authentication VarBind is already used for authentication. A first message authentication information checking step for checking whether the information exists in the stored message authentication information cache; and if the message management information exists in the message authentication information cache, The first abnormal end that determines an attack and returns an abnormal end Has a step, a.

  According to one aspect of the present invention, message authentication information of a SET request is transmitted using a common key to a computer of a management apparatus that transmits and receives SNMP messages to and from a management target apparatus via a network using SNMP as a network management protocol. A calculation step for calculating, a creation step for creating an authentication VarBind including the message authentication information, an SNMP message generation step for creating an SNMP message including the authentication VarBind, and a packet from the SNMP message and a destination address And a packet transmission step for transmitting the program.

  One aspect of the present invention is a packet receiving step of receiving a packet from the management apparatus to a computer of a management target apparatus that transmits and receives an SNMP message to and from the management apparatus via the network using SNMP as a network management protocol. If the packet is a SET request, the presence / absence checking step for checking the presence / absence of the authentication VarBind, the discarding step for discarding the packet if the authentication VarBind is not present, and the authentication VarBind A first message authentication information investigation step for checking whether the message authentication information in the authentication VarBind exists in a message authentication information cache in which the message authentication information already used for authentication is stored; and the message authentication information Message acknowledge When present in the information in the cache, it is determined that replay attack is a computer program for executing a first abnormal termination step of returning an abnormal termination, the.

  According to the present invention, even when the identification information for authentication is known to a third party by eavesdropping, it is possible to prevent an unauthorized setting to the management target device.

It is a block diagram which shows the structure of the network management system by 1st embodiment of this invention. It is the block diagram which showed the whole structure of the network management system by 2nd embodiment of this invention. It is a conceptual diagram which shows the structure of a packet. It is a conceptual diagram which shows the structure of an SNMP message. It is a conceptual diagram which shows the structure of PDU. It is a conceptual diagram which shows the structure of VarBind. It is a block diagram which shows the functional structure of the management apparatus 100 by 2nd embodiment. It is a conceptual diagram which shows an example of the common key table 141 with which the management apparatus 100 is equipped by 2nd embodiment. It is a block diagram which shows the functional structure of the management object apparatus 200 by 2nd embodiment. It is a conceptual diagram which shows an example of the common key table 242 with which the management object apparatus 200 with 2nd embodiment is provided. It is a flowchart for demonstrating operation | movement until the management apparatus 100 by 2nd embodiment transmits an SNMP message. 10 is a flowchart for explaining an operation of a management target device 200 according to the second embodiment processing an SNMP message received from the management device 100. It is a flowchart for demonstrating operation | movement of the authentication MIB module 241 by 2nd embodiment.

  First, an outline of the network management system will be described. The network management system improves the security of the setting SNMP message (SET request) for the device having the SNMPv1 or SNMPv2c agent function, while keeping the modification of the SNMP protocol processing part small. Specifically, in the network management system, the following items are realized to improve security.

(A) In addition to the authentication method based on the conventional community name, authentication based on the MAC (Message Authentication Code) of the SNMP message is used. The community name is identification information indicating the range of the network system managed by SNMP, and is also identification information (authentication identification information) used for authentication.
(B) In the authentication in (a) above, it is possible to detect alteration of the SNMP message due to the nature of the MAC.
(C) In preparation for a replay attack, an authenticated MAC cache is prepared so that SNMP messages of the same MAC are not accepted.

[First embodiment]
FIG. 1 is a block diagram showing a configuration of a network management system according to the first embodiment. In FIG. 1, a management apparatus 100 and a management target apparatus 200 hold a secret key (common key) 101 that is common to each other. The management target device 200 includes an authentication MIB (Management Information Base) module 241 and includes an interface having an authentication OID (Object IDentifer). Normally, the authentication MIB module 241 is independent of the SNMP protocol processing unit (not shown). Moreover, in 1st embodiment, authentication is implement | achieved only by the function of SNMPv1 / SNMPv2c. Further, the authentication information is included in the packet of the SET request including the contents to be set in the opposite apparatus.

The management device 100 includes a CPU (Central Processing Unit), a memory, an auxiliary storage device, and the like connected by a bus, and executes a management program. All or part of the functions of the management apparatus 100 may be realized by using hardware such as an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA). The management program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a storage device such as a hard disk built in the computer system.
The management target device 200 includes a CPU, a memory, an auxiliary storage device, and the like connected by a bus, and executes a management target program. All or some of the functions of the management target device 200 may be realized by using hardware such as ASIC, PLD, or FPGA. The management target program may be recorded on a computer-readable recording medium.

  The management apparatus 100 uses the common key 101 to calculate a MAC (Message Authentication Code) of the SET request from the SET request including the combination of the community name 11 and other VarBinds (Variable-Bindings) 13. The MAC is an example of message authentication information. In addition, the management apparatus 100 includes a community name 11, VarBind (Variable-Bindings, a pair of OID and a value to be set in the object of the OID), an authentication VarBind (a pair of the authentication OID and the calculated MAC) 12, In addition, an authenticated SET request 10 including VarBind 13 is created and transmitted to the management target device 200.

As described above, even if the SET request 10 is eavesdropped by a third party and the community name 11 is known, the third party does not know the common key 101 and therefore cannot calculate the correct MAC, and can be authenticated. Unable to create a SET request.
Subsequently, a replay attack can be prevented by the following processing.
The SNMP message analysis processing unit 230 in the managed device 200 checks whether or not the VarBind in the received authentication-added SET request 10 includes the authentication VarBind 12 and, if not included, determines that the request is a SET request. If the authentication VarBind 12 is included, the authentication MIB module 241 processes the authentication VarBind 12.

  The authentication MIB module 241 checks whether the MAC in the authentication VarBind 12 is included in the MAC cache 243. The MAC cache 243 stores a MAC that has already been used for authentication. Due to the SNMP specification, the request ID in the SNMP message is different for each message, so the MAC is always different.

  Therefore, when the MAC in the authentication VarBind 12 is included in the MAC cache 243, an abnormal termination is returned to the SNMP message analysis processing unit 230. In this way, even if a third party sniffs the authenticated SET request 10 and resends it without change, the SET request fails in the inspection by the MAC cache 243.

Subsequently, the authenticated SET request 10 is authenticated by the following processing.
The MAC of the received SET request with authentication 10 is calculated with the common key 101 and compared with the MAC in the authentication VarBind 12. If both MACs match, a normal end is returned to the SNMP message analysis processing unit 230 (authentication complete). On the other hand, if both MACs do not match, an abnormal termination is returned to the SNMP analysis processing unit 230 (authentication failure).

In accordance with the SNMP specification, if any one of the MIB modules returns an abnormal termination, the SNMP message analysis processing unit 230 invalidates the SET processing with the entire SET request as an error. Therefore, as described above, the authentication MIB module 241 returns an abnormal end, so that the setting to the apparatus can be failed.
According to the first embodiment described above, even when the community name is known to a third party by eavesdropping, it is possible to prevent an unauthorized setting to the management target device.

[Second Embodiment]
FIG. 2 is a block diagram showing the overall configuration of the network management system according to the second embodiment of the present invention. In FIG. 2, the network management system includes one management device 100, three management target devices 200-1 to 200-3 (hereinafter also collectively referred to as a management target device 200), and a network 300. In FIG. 2, one management apparatus 100 is provided, but a plurality of management apparatuses 100 may be provided. Moreover, although the number of the management target devices 200-1 to 200-3 is three, it may be four or more.

  The management apparatus 100 performs monitoring and setting of the management target apparatuses 200-1 to 200-3 via the network 300. The management target devices 200-1 to 200-3 notify the management device 100 of information held by the management target devices 200-1 to 200-3 via the network 300 based on an instruction from the management device 100. In addition, the management target devices 200-1 to 200-3 update their own information and change their operations based on an instruction from the management device 100.

  Here, examples of the management target devices 200-1 to 200-3 include a router, a switching hub, a personal computer, a printer, and a television. The network 300 is, for example, a local area network (LAN).

  SNMP standardized as a network management protocol is used for exchanging management information (for example, MIB) between the management apparatus 100 and the management target apparatuses 200-1 to 200-3. SNMP is a protocol for monitoring and setting a device connected to a network via the network. Management information is exchanged between the management apparatus 100 and the management target apparatuses 200-1 to 200-3 by transmitting and receiving packets.

FIG. 3 is a conceptual diagram showing a packet configuration. In FIG. 3, a packet 240 includes a transmission source address 251, a destination address 252, and an SNMP message 253. The transmission source address 251 is an address of a device that has transmitted the packet 240. The destination address 252 is a destination address of the packet 240. For example, in an IP network, the packet 240 is an IP packet, the source address 251 is a source IP address, and the destination address 252 is a destination IP address.
Details of the SNMP message 253 are defined in RFC1157, 1901, and 3417. Only the parts necessary for the present invention will be described below.

  FIG. 4 is a conceptual diagram showing the structure of the SNMP message. In FIG. 4, the SNMP message 253 includes a version header 261, a community name 262, and a PDU (Protocol Data Unit) 263. The version header 261 represents the SNMP version, and is a numerical value “0” for SNMPv1 and a numerical value “1” for SNMPv2c.

The community name 262 is identification information known only by the network administrator, and is set in the management apparatus 100 and the management target apparatus 200, respectively. The managed device 200 checks the community name 262 and determines whether the SNMP message is from a valid network administrator. The community name 262 is, for example, a character string such as “public” or “private”.
Although this embodiment is intended to improve the security of SNMPv1 and v2c, the SNMP version may be other than “0” or “1”.

  FIG. 5 is a conceptual diagram showing the structure of a PDU. The PDU 263 includes a PDU type 271, a request ID 272, an error status, an error index, and a plurality of VarBinds 273. The PDU type 271 is a field used for the management apparatus 100 to specify the type of control for the management target apparatus 200. The PDU type 271 is also used to notify that the management target device 200 is a response to the control received from the management device 100. In the case of setting, SET is designated, and in the case of response, RESPONSE is designated. The SNMP message of SET is called a SET request. A RESPONSE SNMP message is called a response.

The request ID 272 is an identifier for distinguishing a response from the management target device 200 to the management device 100 with respect to the SNMP message 253 transmitted from the management device 100 to the management target device 200. The request ID 272 is an integer value. For example, it may be incremented from the reference value every time an SNMP message is created, or may be a random number every time.
VarBind 273 is a pair of an OID to be operated and a value to be set to an object of the OID. There may be a plurality of VarBinds 273 in the PDU 263.

  FIG. 6 is a conceptual diagram showing the configuration of VarBind. The VarBind 273 includes an OID 281 and a setting value 282. The OID 281 is an identification ID for each piece of management information that the management target device 200 has. The set value 282 is used to specify a value to be set in the OID 281 at the time of a SET request.

  The specifications of the OID 281 and its set value 282 include a standard MIB defined by RFC or the like and a vendor-specific MIB. For example, in the SNMPv2-MIB defined in RFC3418, the OID “1.3.3.6.1.2.1.1.6 (sysLocation)” is the OID of the physical installation location information of the management target device 200. The setting value is defined to use a character string of less than 256 characters (for example, “Ciba”).

  FIG. 7 is a block diagram showing a functional configuration of the management apparatus 100 according to the second embodiment. It should be noted that portions corresponding to those in FIG. 7, the management device 100 includes a packet transmission / reception unit 110, an SNMP message generation processing unit 120, an SNMP message analysis processing unit 130, a non-volatile device 140, and a common key table stored in the non-volatile device 140. 141.

  The common key table 141 stores the common key 101 associated with the address of the management target device 200 on the network 300. The packet transmitting / receiving unit 110 creates and transmits a packet 240 from the SNMP message 253 received from the SNMP message generation processing unit 120 and the destination address. Further, the packet transmission / reception unit 110 causes the SNMP message analysis processing unit 130 to process the packet 240 received from the management target device 200.

  The SNMP message generation processing unit 120 has a function of creating an SNMP message 253 and causing the packet transmission / reception unit 6110 to process it. However, when a SET request with authentication is created, the MAC of the SET request is obtained with the common key 101 acquired from the common key table 141, an authentication VarBind is created, and the SNMP message 253 is given.

As the MAC, for example, HMAC (Keyed-Hashing for MAC) is used. As the hash function, SHA1 (Secure Hash Algorithm 1), MD5 (Message Digest algorithm 5), or the like is used. HMAC is standardized by RFC2104, SHA1 is standardized by FIPS180-1, and MD5 is standardized by RFC1321.
The SNMP message analysis processing unit 130 notifies the administrator of the content received from the packet transmission / reception unit 110.

  FIG. 8 is a conceptual diagram showing an example of the common key table 141 provided in the management apparatus 100 according to the second embodiment. The common key 101 in the common key table 141 is a key used for the MAC to be obtained when creating an authenticated SET request for each address. For example, the common key 101 used for the MAC calculation of the SET request for the device having the address “ADDR1” (here, the management target device 200) is “CK (1)”. The common keys CK (1), CK (2),..., CK (n) may all be the same. The common key table 141 can also manage a common key for the address of the management apparatus 100 itself. In the common key table 141, the address is represented by “ADDRM” and the common key is represented by “CK (M)”.

  FIG. 9 is a block diagram illustrating a functional configuration of the management target device 200 according to the second embodiment. 9, the management target device 200 includes a packet transmission / reception unit 210, an SNMP message generation processing unit 220, an SNMP message analysis processing unit 230, a nonvolatile device 250, and a common key stored in the nonvolatile device 250. A table 242, a storage device 260, a MAC cache 243 stored in the storage device 260, and a MIB module 231 are provided. There are usually a plurality of MIB modules 231, and an authentication MIB module 241 is provided as one of them.

  The common key table 242 stores a common key associated with the address of the management apparatus 100 on the network 300. The packet transmitting / receiving unit 210 creates and transmits a packet from the SNMP message received from the SNMP message generation processing unit 220 and the destination address. Further, the packet transmission / reception unit 210 causes the SNMP message analysis processing unit 230 to process the received packet.

  If the packet is a SET request (SET request or SET request with authentication), the SNMP message analysis processing unit 230 checks whether or not there is an authentication VarBind, and if not, discards the packet. On the other hand, if there is an authentication VarBind, the MIB module 231 corresponding to each VarBind in the SNMP message processes the packet and waits for a response. In particular, in the case of authentication VarBind, the authentication MIB module 241 processes the packet.

  For example, when the VarBind OID is “1.3.3.6.1.2.1.1.6”, the SNMPv2-MIB module is processed. When the VarBind OID is an authentication OID (VarBind is authenticated) In the case of VarBind for use), the authentication MIB module 241 is caused to process.

  The SNMP message analysis processing unit 230 receives a response from each MIB module 231 and sets the analysis result to be normal if all are normally completed. When an abnormal end is received from one or more MIB modules of each MIB module 231, the analysis result is abnormal.

  In the specification of SNMP (RFC 1157, 3416), when the analysis result is abnormal, the SNMP message analysis processing unit 230 must invalidate the processing by the SNMP message. For example, it is necessary to specify a character string of less than 256 characters for OID “1.3.3.6.1.2.1.1.6”. For this reason, if the SET request has a VarBind requesting the setting of a character string of 256 characters or more for this OID, the SNMPv2-MIB module returns an abnormal end to the SNMP message analysis processing unit 230. The SNMP message analysis processing unit 230 that has received the abnormal termination invalidates the setting contents of other VarBinds.

  The SNMP message analysis processing unit 230 addresses the analysis result, information necessary for generating a response (for example, the position of each VarBind or the abnormally terminated VarBind), and the transmission source address (address of the management apparatus 100) in the packet. As an address, the SNMP message generation processing unit 220 processes the address.

  The MIB module 231 processes the VarBind received from the SNMP message analysis processing unit 230 according to the definition, and returns the result to the SNMP message analysis processing unit 230. The operation specifications of the MIB module 231 conform to individual MIB definitions defined by RFC or the like. For example, in the operation of OID “1.3.3.6.1.2.1.1.6”, RFC3418 is an IP-MIB that manages IP information, RFC4293, and LLDP management information LLDP-MIB is It is defined in IEEE802.1AB-2005 and the like.

  If the packet received from the SNMP message analysis processing unit 230 is other than a SET request (SET request or SET request with authentication), the authentication MIB module 241 returns normal termination to the SNMP message analysis processing unit 230. On the other hand, when the packet received from the SNMP message analysis processing unit 230 is an authenticated SET request, the authentication MIB module 241 includes the setting value (MAC-M) in the authentication VarBind in the MAC cache 243. Check if it is.

  If the MAC-M is included in the MAC cache 243, the authentication MIB module 241 considers it as a replay attack and returns an abnormal end to the SNMP message analysis process 230. On the other hand, when the MAC-M is not included in the MAC cache 243, the authentication MIB module 241 uses the common key 101 corresponding to the transmission source address of the received packet with reference to the common key table 242. Then, the MAC of the SNMP message excluding the authentication VarBind is calculated by the same method as that of the management apparatus 100 (this MAC is defined as MAC-1).

  The authentication MIB module 241 checks whether MAC-M and MAC-1 match. If MAC-1 and MAC-M do not match, the authentication MIB module 241 determines that the SNMP message has been tampered with, and the SNMP message analysis processing unit An abnormal end is returned to 230. On the other hand, if the MAC-1 and MAC-M match, the authentication MIB module 241 determines that the SNMP message has not been tampered with and is a legitimate SNMP message from the management apparatus 100, and stores the MAC cache 243 in the MAC cache 243. -1 is added and normal termination is returned to the SNMP message analysis processing unit 230.

FIG. 10 is a conceptual diagram illustrating an example of the common key table 242 included in the management target device 200 according to the second embodiment. The common key 101 in the common key table 242 is a key used to calculate the MAC for each address. For example, in FIG. 10, for a device whose address is “ADDRM” (here, the management device 100), the common key used for calculating the MAC is “CK (M)”. The common keys CK (1), CK (2),..., CK (n) may all be the same. The common key table 242 can also manage a common key for the address of the management target device 200 itself. In FIG. 10, the address is represented by “ADDR1”, and the common key is represented by “CK (1)”.
If the address of the management device 100 is “ADDRM” and the address of the management target device 200 is “ADDR1”, “CK (1)” in the common key table 141 in the management device 100 and the common key table in the management target device 200. “CK (M)” of 242 is the same.

  The MAC cache 243 stores a history of MACs that have been successfully authenticated by the authentication MIB module 241. When the authentication MIB module 241 newly authenticates, the history of the MAC is used to search whether the MAC in the authentication VarBind matches the MAC used in the past in the authentication. The MAC cache 243 may be implemented in any way. For example, it may be stored until the management target device 200 is restarted, a MAC that has been stored for a certain period of time may be deleted, or the size of the MAC cache 243 may be determined in advance and the available size may be insufficient. For example, the old MAC may be deleted. Note that the storage device 260 may be either nonvolatile or volatile.

  The SNMP message generation processing unit 220 receives an analysis result, information necessary for response generation, and a destination address (address of the management apparatus 100) from the SNMP message analysis processing unit 230, creates a response, and sends the response and the destination address to the packet. The transmission / reception unit 210 performs processing.

Next, the operation of the network management system according to the second embodiment will be described.
FIG. 11 is a flowchart for explaining an operation until the management apparatus 100 according to the second embodiment transmits an SNMP message. First, the management device 100 requests the SNMP message generation processing unit 120 to create an SNMP message for the management target device 200 based on an operation by the administrator or periodic information collection (step S101).

  Next, the administrator gives the address, version 261, community name 262, PDU type 271 and VarBind 273 of the management target device 200 to the SNMP message generation processing unit 120. The SNMP message generation processing unit 120 creates an SNMP message I110 using an appropriate random number or the like as the request ID 272 (step S102). The request ID 272 may be anything as long as it is different from the request IDs of other SNMP messages.

  Next, the SNMP message generation processing unit 120 checks whether or not the PDU type 271 of the created SNMP message I110 is SET (step S103). Then, in the case of SET (YES in step S103), the SNMP message generation processing unit 120 performs an authentication VarBind creation process (proceeds to steps S104 to S107). On the other hand, if it is not a SET (NO in step S103), nothing is done and preparations for packet creation are made (proceed to step S108).

  First, a case where the PDU type 271 is SET will be described. The SNMP message generation processing unit 120 acquires the common key I101 corresponding to the address of the management device 200 designated by the administrator from the common key table 141 (step S104). For example, in the common key table 141, if the address of the management target device 200 is “ADDR1”, the common key I101 to be acquired is “CK (1)”.

  Next, the SNMP message generation processing unit 120 calculates the MAC of the SNMP message I110 created in step S102 using the acquired common key I101 “CK (1)” (step S105). Next, the SNMP message generation processing unit 120 creates an authentication VarBind with the obtained MAC and authentication OID (step S106). Thereafter, the SNMP message generation processing unit 120 adds the created authentication VarBind to the SNMP message I110 created in step S102 to create an authenticated SNMP message I111 (step S107).

  Next, when the PDU type 271 is not SET (NO in step S103) or when step S107 is completed, the SNMP message generation processing unit 120 sets the address of the management target device 200 received from the administrator as the destination address. Then, an SNMP message is supplied to the packet transmitting / receiving unit 110 to request packet creation (step S108).

  The SNMP message to be processed by the packet transmitting / receiving unit 110 is the SNMP message I110 if NO in step S103, and the SNMP message I111 if YES in step S103.

  The packet transmission / reception unit 110 creates a packet I112 from the SNMP message (I110 or I111) received from the SNMP message generation processing unit 120 and the destination address using the address of the management apparatus 100 as a transmission source address (step S109). The packet transmitting / receiving unit 110 transmits the packet I112 to the management target device 200 (step S110).

  Next, FIG. 12 is a flowchart for explaining an operation in which the management target device 200 according to the second embodiment processes an SNMP message received from the management device 100. First, the packet transmission / reception unit 210 receives the packet I112 received from the management apparatus 100 and causes the SNMP message analysis processing unit 230 to process it (step S201). Next, the SNMP message analysis processing unit 230 checks whether or not the PDU type of the packet I112 received from the packet reception unit 210 is SET (step S202).

  If the PDU type is SET (YES in step S202), it is checked whether or not there is an authentication VarBind in the VarBind in the packet I112 (step S203). If there is no authentication VarBind in VarBind (NO in step S203), the packet I112 is discarded (step S204).

  On the other hand, if the PDU type is not SET (NO in step S202), or if there is an authentication VarBind (YES in step S203), the SNMP message analysis processing unit 230 uses the MIB module corresponding to each VarBind. 231 causes the packet I112 to be processed and waits for the result (step S205). In particular, the authentication VarBind causes the authentication MIB module 241 to process the packet I112 and waits for the processing result. The operation of the authentication MIB module 241 will be described later.

  Next, the SNMP message analysis processing unit 230 checks whether there is a MIB module that has returned abnormal termination (step S206). The objects to be examined are the MIB module 231 and the authentication MIB module 241. If there is no MIB module that returned an abnormal end (NO in step S206), the analysis result (normal end), information necessary for creating the response, and the destination address (source address of the packet I112) In order to be processed by the SNMP message generation processing unit 220, a request for creating a response for normal termination is issued (step S207).

  On the other hand, if there is an MIB module that returns an abnormal end (YES in step S206), the processing based on the SNMP message is invalidated (step S208) in accordance with the SNMP specifications (RFC 1157, 3416). The SNMP message analysis processing unit 230 receives the analysis result (abnormal end), information necessary for generating a response (for example, the location of each VarBind or the abnormally ended VarBind), and the destination address (source address of the packet I112). In order to cause the SNMP message generation processing unit 220 to process, a request for creating a response for abnormal termination is requested (step S209).

  In both cases of abnormal termination and normal termination, the SNMP message generation processing unit 220 creates a response from the analysis result (normal termination or abnormal termination) received from the SNMP message analysis processing unit 230 and response information (step S210). The SNMP message generation processing unit 8220 supplies the created response together with the destination address to the packet transmitting / receiving unit 8210, and requests packet creation (step S211).

  The packet transmission / reception unit 210 creates a packet from the response received from the SNMP message generation processing unit 220 and the destination address using the address of the management target device 200 as the transmission source address (step S212). The packet transmitting / receiving unit 210 transmits the created packet to the management apparatus 100 (step S213).

  FIG. 13 is a flowchart for explaining the operation of the authentication MIB module 241 according to the second embodiment. The authentication MIB module 241 receives the packet I112 from the SNMP message analysis processing unit 230 (S301). Next, the authentication MIB module 241 checks whether or not the PDU type of the packet I112 received from the SNMP message analysis processing unit 230 is SET (step S302). If the PDU type is not SET (NO in step S302), a normal end is returned to the SNMP message analysis processing unit 230 (step S303).

  On the other hand, when the PDU type is SET (YES in step S302), the authentication MIB module 241 extracts the setting value (referred to as MAC-M) in the authentication VarBind from the packet I112 and stores the same value in the MAC cache 243. It is searched whether there is any (step S304). Next, the authentication MIB module 241 checks whether the MAC-M is included in the MAC cache 243 (step S305).

  When MAC-M is included in the MAC cache 243 (YES in step S305), the authentication MIB module 241 returns an abnormal end to the SNMP message analysis processing unit 230 (step S306).

  On the other hand, when the MAC-M is not included in the MAC cache 243 (NO in step S305), the authentication MIB module 241 refers to the common key table 242, and corresponds to the transmission source address of the packet I112. The key I101 is acquired (step S307). For example, in the common key table 242, if the transmission source address of the packet I112 is “ADDRM”, the common key I101 is “CK (M)”.

  Next, the authentication MIB module 241 extracts the SNMP message I111 excluding the authentication VarBind from the packet I112 (step S308). Next, the MAC of the SNMP message I111 is calculated using the common key I101 (step S309). This is referred to as MAC-1. The MAC is calculated by the same method as that of the management apparatus 100 (S105).

Next, the authentication MIB module 241 checks whether MAC-M and MAC-1 match (step S310). If MAC-M and MAC-1 do not match (NO in step S310), an abnormal termination is returned to the SNMP message analysis processing unit 230 (step S311). On the other hand, when MAC-M and MAC-1 match (YES in step S310), MAC-1 is registered in the MAC cache 243 (step S312). Then, normal termination is returned to the SNMP message analysis processing unit 230 (step S313).
As described above, the authentication MIB module 241 returns abnormal termination or normal termination to the SNMP message analysis processing unit 230.

According to the second embodiment described above, the following effects can be obtained.
(1) The management apparatus 100 gives an authentication VarBind to the SET request,
(2) Checking whether there is an authentication VarBind in the SNMP message received by the SNMP message analysis processing unit 230 in the management target device 200;
(3) In the authentication MIB module 241, checking whether the same MAC as the setting value (MAC) in the authentication VarBind is included in the MAC cache 243;
(4) Checking whether the MAC recalculated by the authentication MIB module 241 matches the setting value (MAC) in the authentication VarBind,
(5) Realizing most of the MAC authentication processing with the authentication MIB module 241 independent of the SNMP protocol processing;
Thus, the following effects can be obtained.

From (1), (2), and (4) above, MAC authentication can be performed in the SET request to the management target device 200. Thereby, even if the community name is known to a third party by eavesdropping, it is possible to prevent the management target device 200 from being set by an unauthorized SET request.
From (1), (2), and (4) above, it is possible to detect falsification of the SET request by a third party by MAC authentication in the SET request for the management target device 200.

From the above (1), (2), and (3), the same MAC SET request is not accepted. Thereby, even if a third party sends the same SET request as the SET request that could be authenticated in the past to the management target device 200, the management target device 200 can not accept the setting.
From (5) above, when the authentication by the MAC fails (when the same MAC is in the MAC cache 243, the MAC does not match), the management apparatus 100 can be notified by a response that the authentication has failed.

From (5) above, the SNMP protocol processing implementation of the management target apparatus 200 is hardly required to be modified, and even if it is replaced with another protocol processing implementation, it can be easily transplanted.
In the first and second embodiments described above, MAC is used for authentication, but a digital signature using a public key / private key can also be used.

In the first and second embodiments described above, only SET request authentication is performed, but the present invention can also be applied to TRAP and INFORMATION requests that the management target device 200 voluntarily notifies the management device 100 of.
For this purpose, the SNMP message generation processing unit 220 of the management target device 200 adds the authentication VarBind for the SNMP message of the TRAP and the INFORM request to the SNMP message and transmits the SNMP message to the management device 100 as in the management device 100. To. On the other hand, the management apparatus 100 needs to perform authentication processing on the received TRAP and INFORM requests in the same manner as the SNMP message analysis processing unit 230 and the authentication MIB module 241 of the management target apparatus 200.

  Further, for example, in combination with the technique of Patent Document 1, it is possible to operate with encryption and authentication according to the present invention. Further, in combination with the technique of Patent Document 2, it is possible to operate with a dynamic community name and authentication according to the present invention.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

  DESCRIPTION OF SYMBOLS 10 ... SET request with authentication, 11 ... Community name, 12 ... VarBind for authentication, 13 ... Other VarBind, 100 ... Management device, 101 ... Common key, 110 ... Packet transmission / reception unit, 120 ... SNMP message generation processing unit, 130 ... SNMP Message analysis processing unit, 140 ... non-volatile memory, 200, 200-1 to 200-3 ... managed device, 210 ... packet transmission / reception unit, 220 ... SNMP message generation processing unit, 230 ... SNMP message analysis processing unit, 231 ... MIB Module, 240 ... packet, 241 ... authentication MIB module, 242 ... common key table, 243 ... MAC cache, 250 ... non-volatile device, 251 ... destination address, 252 ... source address, 253 ... SNMP message, 261 ... Version header, 262 ... Community name, 263 ... PDU, 271 ... PDU type, 272 ... Request ID, 273 ... VarBind

Claims (9)

A network management system in which SNMP is used as a network management protocol, and a management apparatus and a management target apparatus transmit and receive an SNMP message via a network.
The management device
An SNMP message generation processing unit that calculates message authentication information of the SET request using the common key, creates an authentication VarBind including the message authentication information, and creates an SNMP message including the authentication VarBind;
A packet transmission unit that creates and transmits a packet from the SNMP message created by the SNMP message generation processing unit and a destination address;
The managed device is:
A packet receiver for receiving packets from the management device;
If the packet is a SET request, an SNMP message analysis processing unit that checks whether or not there is an authentication VarBind, and if not, discards the packet;
A message authentication information cache in which the message authentication information already used for authentication is stored;
When there is the authentication VarBind, it is checked whether the message authentication information in the authentication VarBind is present in the message authentication information cache, and when the message authentication information is present in the message authentication information cache, A network management system comprising: an authentication MIB module that determines a replay attack and returns an abnormal end to the SNMP message analysis processing unit. The authentication MIB module is:
When the message authentication information is not included in the message authentication information cache, the message authentication information of the SNMP message excluding the authentication VarBind is obtained using a common key corresponding to the source address of the received packet. Calculate
It is checked whether the message authentication information included in the authentication VarBind matches the message authentication information calculated by the MIB module. If they do not match, it is determined that the SNMP message has been tampered with, and the SNMP message Return abnormal termination to the analysis processing unit,
If they match, it is determined that the SNMP message has not been tampered with and is a legitimate SNMP message from the management device, the message authentication information is added to the message authentication information cache, and the SNMP message is added. The network management system according to claim 1, wherein normal termination is returned to the message analysis processing unit.   3. The network management according to claim 1, wherein the authentication MIB module does nothing when the packet received from the SNMP message analysis processing unit is other than a SET request, and returns a normal end to the SNMP message analysis processing unit. system.   The network management system according to claim 1, wherein if any one of the SNMP message analysis processing units returns an abnormal end, the entire SET request is regarded as an error and the SET processing is invalidated. A management device that uses SNMP as a network management protocol and transmits / receives an SNMP message to / from a management target device via a network,
An SNMP message generation processing unit that calculates message authentication information of the SET request using the common key, creates an authentication VarBind including the message authentication information, and creates an SNMP message including the authentication VarBind;
A management apparatus comprising: a packet transmission unit that creates and transmits a packet from an SNMP message created by the SNMP message generation processing unit and a destination address. A management target device that transmits and receives SNMP messages to and from a management device via a network using SNMP as a network management protocol,
A packet receiver for receiving packets from the management device;
If the packet is a SET request, an SNMP message analysis processing unit that checks whether or not there is an authentication VarBind, and if not, discards the packet;
A message authentication information cache in which the message authentication information already used for authentication is stored;
When there is the authentication VarBind, it is checked whether the message authentication information in the authentication VarBind is present in the message authentication information cache, and when the message authentication information is present in the message authentication information cache, A managed device comprising: an authentication MIB module that determines a replay attack and returns an abnormal termination to the SNMP message analysis processing unit. A network management method in which SNMPv1 and SNMPv2c are used as a network management protocol, and a management apparatus and a management target apparatus transmit and receive an SNMP message via a network,
A first calculation step in which the management device calculates message authentication information of a SET request using a common key;
A creation step in which the management apparatus creates an authentication VarBind including the message authentication information;
An SNMP message generating step in which the management device creates an SNMP message including the authentication VarBind;
A packet transmission step in which the management device creates and transmits a packet from the SNMP message and the destination address created in the SNMP message generation step;
A packet receiving step in which the management target device receives a packet from the management device;
If the managed device is a SET request, the presence / absence checking step for checking the presence / absence of an authentication VarBind,
If the managed device does not have the authentication VarBind, a discard step for discarding the packet;
If the managed device has the authentication VarBind, does the message authentication information in the authentication VarBind exist in the message authentication information cache in which the message authentication information already used for authentication is stored? A first message authentication information checking step to check;
A network management method, comprising: a first abnormal termination step in which the managed device determines that the message authentication information is in a message authentication information cache and determines that it is a replay attack and returns an abnormal termination. Using SNMP as a network management protocol, for a computer of a management device that transmits and receives SNMP messages to and from a management target device via a network,
A calculation step of calculating message authentication information of the SET request using the common key;
A creation step of creating an authentication VarBind including the message authentication information;
An SNMP message generating step for generating an SNMP message including the authentication VarBind;
A packet transmission step of creating and transmitting a packet from the SNMP message and a destination address;
A computer program for running. Using SNMP as a network management protocol, for a managed device computer that sends and receives SNMP messages to and from a management device over a network,
A packet receiving step for receiving a packet from the management device;
If the packet is a SET request, the presence / absence investigation step for examining the presence / absence of the authentication VarBind,
A discard step for discarding the packet if the authentication VarBind is absent;
When there is the authentication VarBind, the first message authentication for checking whether the message authentication information in the authentication VarBind exists in the message authentication information cache in which the message authentication information already used in the authentication is stored. Information research step,
If the message authentication information is present in the message authentication information cache, a first abnormal termination step of determining a replay attack and returning an abnormal termination;
A computer program for running.

Images