JP2016149633A - Refining method of controlling object flow and apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a refining method of controlling object flow capable of efficiently refining a communication flow as an object of control processing even when an encrypted communication flow is the control object.SOLUTION: The refining method of controlling object flow determines the necessity whether an encrypted communication flow should be inspected by being decrypted based on the content of the communication flow, which can be obtained without decrypting the communication flow. The refining method of controlling object flow transfers a communication flow, which is determined the inspection is not necessary, to a transmission destination without carrying out the decryption; and carries out the inspection by decrypting a communication flow which is determined that the inspection is required.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control processing target flow narrowing method and apparatus.

  Various technologies have been devised to achieve high security in networks in which various types of information are transmitted and received.

  For example, DPI (Deep Packet Inspection) is used to detect and control danger information. The DPI is a function that determines the processing method of the IP packet based on the data portion instead of the header portion of the IP packet.

  In addition, an OTT (Over The Top) service is increasingly provided using SSL (Secure Sockets Layer). SSL is one of protocols for encrypting and transmitting / receiving data on a TCP / IP network. With SSL, data to be transmitted / received is encrypted, and at the same time, confirmation that the communication partner is a reliable partner is executed (see Non-Patent Document 1).

Satoshi Hanzawa, “The Basics of Networks Learned by Illustration: SSL Lesson 1: Encrypting Exchanges between Apps, Confirming that Others Can Be Reliable”, [online], October 20, 2007, Nikkei NETWORK, [December 2014 Search 10 days], Internet <http://itpro.nikkeibp.co.jp/article/COLUMN/20071012/284425/?ST=selfup> “Blue Coat Product Information SSL Visibility Appliance”, [online], Macnica Networks, [December 10, 2014 search], Internet <http://www.macnica.net/bluecoat/ssl_va.html/> “SSL intercept solution that enables inspection of SSL encrypted communication contents”, [online], A10 Networks, Inc., [December 10, 2014 search], Internet <http://www.a10networks.co.jp /products/pdf/SBAX_SSLIntercept.pdf>

  However, since the above-described processing by DPI is heavy, it is desirable to narrow down the communication flow targeted for DPI for efficient processing.

  In addition, when the communication flow is encrypted using SSL, it is possible to prevent personal information or the like from being viewed by a third party, but it is difficult to check the content of the encrypted communication flow at the same time. This makes it difficult to detect information that is not appropriate for the user, such as virus detection, danger information detection, and parental control (see Non-Patent Document 2 and Non-Patent Document 3). For this reason, even if it is a case where SSL etc. are utilized, realization of the technique which can detect dangerous information etc. efficiently is desired.

  The disclosed embodiment has been made in view of the above, and is capable of efficiently narrowing down the communication flow to be controlled even if the encrypted communication flow is the control target. It is an object of the present invention to provide a target flow narrowing method and apparatus.

  The disclosed control processing target flow narrowing method and apparatus is based on the content of the communication flow that can be acquired without decryption of the necessity of inspecting the communication flow by decrypting the encrypted communication flow. The communication flow determined to be unnecessary is transferred to the transmission destination without being decrypted, and the communication flow determined to be inspected is decrypted and inspected.

  The disclosed control processing target flow narrowing method and apparatus have an effect of efficiently narrowing down the communication flow to be controlled even if the encrypted communication flow is the control target.

FIG. 1 is a diagram illustrating an example of a schematic configuration of a control processing target flow narrowing system according to the first embodiment. FIG. 2 is a flowchart illustrating an example of the flow of the control process target flow narrowing process according to the first embodiment. FIG. 3 is a diagram for explaining a first modification of the control processing target flow narrowing system according to the first embodiment. FIG. 4 is a diagram for explaining a second modification of the control processing target flow narrowing system according to the first embodiment. FIG. 5 is a diagram illustrating an example of a schematic configuration of a control processing target flow narrowing system according to the second embodiment. FIG. 6 is a flowchart illustrating an example of the flow of the control process target flow narrowing process according to the second embodiment. FIG. 7 is a sequence chart for explaining an example of the flow of the control process target flow narrowing process according to the second embodiment. FIG. 8 is a diagram illustrating that the information processing by the control processing target flow narrowing program according to the disclosed technique is specifically realized using a computer. FIG. 9 is a diagram for explaining an example of a flow of processing by conventional SSL communication. FIG. 10 is a diagram for explaining an example of processing when detecting danger information in the conventional SSL communication.

(Handshake in conventional SSL communication)
First, with reference to FIG. 9, an example of the flow of processing when transmitting information encrypted using SSL will be described. FIG. 9 is a diagram for explaining an example of a flow of processing by conventional SSL communication.

  When performing communication using SSL, a root certificate of the SSL encryption / decryption device is issued to the client and held in the client. The root certificate is used to check the validity of the digital certificate of the communication partner. In the example of FIG. 9, the client receives a root certificate in advance and holds the root certificate for the reliability check of the SSL encryption / decryption device.

  When communicating between a client and a server, first, a client hello message is transmitted from the client to the server, and an encryption method to be used is proposed. The Client Hello message includes, for example, information such as the version of the protocol to be used, a random number generated by the client, a session ID, a list of available cipher suites, and a compression method. In FIG. 9, the SSL encryption / decryption device receives the Client Hello message transmitted by the client ((1) in FIG. 9). The SSL encryption / decryption device replaces the record header of the record protocol in the received Client Hello message. Then, the SSL encryption / decryption device transmits a Client Hello message with the record header replaced to the server ((2) in FIG. 9).

  When the server receives the Client Hello message with the record header changed, the server selects and returns one appropriate encryption method proposed by the SSL encryption / decryption device based on the Client Hello message (see FIG. 9 (3)). As a result, the encryption method to be used when performing encrypted communication between the server and the SSL encryption / decryption device is determined.

  Also, the SSL encryption / decryption device selects and returns an appropriate one of the encryption methods proposed by the client ((4) in FIG. 9). As a result, the encryption method to be used when performing encrypted communication between the client and the SSL encryption / decryption device is determined.

  Further, the server transmits a server certificate using a Certificate message to the SSL encryption / decryption device ((5) in FIG. 9). The server certificate is data for certifying that the server is reliable, and includes information such as a certificate authority (CA) name, a public key used by the server, and an electronic signature of the server. When the server finishes sending the Certificate message, it sends a message to that effect. The SSL encryption / decryption device transmits a server certificate to the client using a Certificate message ((6) in FIG. 9).

  The client extracts the public key of the SSL encryption / decryption device from the received server certificate. Then, the client uses the extracted public key to encrypt and transmit a secret value (premaster secret) that is the basis of the common key used for encrypted communication ((7) and (8) in FIG. 9).

  The SSL encryption / decryption device extracts the server public key from the server certificate. Then, the SSL encryption / decryption device encrypts and transmits a secret value (premaster secret) that is the basis of the common key used for encrypted communication using the extracted public key ((9) in FIG. 9). (10)).

  When the server receives the encrypted data, it decrypts it with its own secret key. As a result, the server can obtain the premaster secret. With this series of processing, the SSL encryption / decryption device and the server can share the premaster secret that is the basis of the encryption common key.

  Similarly, when the SSL encryption / decryption device receives the encrypted data, it decrypts it with its own private key. Thereby, the SSL encryption / decryption device can obtain the premaster secret. Through this series of processing, the SSL encryption / decryption device and the client can share the premaster secret that is the basis of the encryption common key.

  When the above processing is completed, the client notifies the SSL encryption / decryption device of the adoption of the encryption method determined by the series of processing (Change Cipher Spec message, etc.) and the end of handshake (Finished message, etc.) (FIG. 9 (11), (12)). Similarly, the SSL encryption / decryption device notifies the client of the adoption of the determined encryption method and the end of the handshake ((11), (12) in FIG. 9). This completes the handshake process. Thereafter, the client, the server, and the SSL encryption / decryption device generate respective common keys from the shared premaster secret, and execute the cryptographic communication.

(Danger information detection in conventional SSL communication)
FIG. 10 is a diagram for explaining an example of processing when detecting danger information in the conventional SSL communication.

  In SSL communication, since the communication content is encrypted based on the encryption method determined as described above, it is impossible to detect whether or not danger information or the like is included as it is. For example, in the example shown in FIG. 10, the client 1 is connected to the edge 3 via the access point (AP) 2. The edge 3 and the SSL encryption / decryption device 4 are connected via a network. The SSL encryption / decryption device 4 is connected to a DPI device 5 having a function of performing DPI processing. The client 1 communicates with the server 6 via the access point 2, the edge 3, and the SSL encryption / decryption device 4 when using the service of the server 6 that provides a service such as OTT (Over The Top).

  Here, when the SSL encryption / decryption device 4 receives the communication flow from the client 1, the communication flow is once terminated on the client 1 side. The SSL encryption / decryption device 4 once terminates the communication flow transmitted / received to / from the server 6 on the server 6 side. As a result, the SSL encryption / decryption device 4 establishes separate SSL sessions for the user (client 1) side and the server 6 side, respectively. Then, the SSL encryption / decryption device 4 decrypts the communication flow transmitted / received in each SSL session and transmits it to the DPI device 5. The DPI device 5 performs a check on the decrypted communication flow to detect danger.

(Challenges in conventional danger information detection)
However, the following problems exist in the danger information detection method as described above. First, although depending on the number of bits of data used as the common key, the SSL encryption / decryption device is required to have higher performance as the number of bits increases. For this reason, the SSL encryption / decryption device becomes a bottleneck that limits the improvement of the communication quality of the network.

  In the above configuration, the SSL encryption / decryption device performs decryption and inspection by DPI for all traffic flowing through the network. DPI is a technique for performing an inspection based on not only the header portion of an IP packet but also the data portion, and has a heavy processing load. For this reason, when DPI is executed for all traffic, the DPI device also becomes a bottleneck that limits improvement in processing efficiency.

  Furthermore, as in the above configuration, when the SSL encryption / decryption device performs similar decryption and inspection processing (DPI) for all traffic, processing such as selectively steering only predetermined data is performed. Cannot be realized. For example, in an optimization service or the like, SSL decryption is indispensable, but the SSL encryption / decryption device configured as described above performs SSL decryption for such a service, and selectively executes the performed flow to the service. I cannot steer. The same applies to the Twitter log service.

(First embodiment)
Hereinafter, embodiments of a control processing target flow narrowing device and a control processing target flow narrowing method disclosed will be described in detail based on the drawings. In addition, this invention is not limited by this embodiment. Moreover, each embodiment can be combined suitably.

(Example of the configuration of the control processing target flow narrowing-down apparatus according to the first embodiment)
FIG. 1 is a diagram illustrating an example of a schematic configuration of a control processing target flow narrowing system according to the first embodiment.

  The control processing target flow narrowing system shown in FIG. 1 includes a control processing target flow narrowing device 10, a client 20, an SSL encryption / decryption device 30, a DPI device 40, and a server 50. The control processing target flow narrowing apparatus 10 and the client 20 are connected via a network. The control processing target flow narrowing-down device 10 is connected to the SSL encryption / decryption device 30 via a network. The SSL encryption / decryption device 30 is connected to a DPI device 40 that performs an inspection of the decrypted data. The control processing target flow narrowing device 10 is also connected to a server 50 that provides services such as OTT. Data steered to the server 50 through the processing in the control processing target flow narrowing device 10 is transmitted from the control processing target flow narrowing device 10 to the server 50.

  The control processing target flow narrowing-down device 10 is a device that can control received information for each communication flow. The control processing target flow narrowing device 10 is, for example, a PCEF (Policy and Charging Enforcement Function) or a PCRF (Policy and Charging Rule Function). Further, the control processing target flow narrowing device 10 may be configured to have a DPI function.

  The control processing target flow narrowing device 10 identifies the content of the received communication flow, and creates information necessary for executing control according to the content of each communication flow. Then, the control processing target flow narrowing device 10 determines the control content of each communication flow based on the created information. Then, the control processing target flow narrowing device 10 executes control according to the determined control content. For example, the control processing target flow narrowing device 10 performs control such as steering, blocking, and rate limiting of each communication flow. Further, the control processing target flow narrowing device 10 communicates with other nodes based on the result of executing control of each communication flow. For example, the control processing target flow narrowing device 10 transmits the communication flow determined to execute the decryption or the DPI processing to the SSL encryption / decryption device 30. Further, the control processing target flow narrowing down apparatus 10 transmits to the server 50 the communication flow determined to be transmitted directly to the transmission destination, for example, the server 50 without being decrypted.

  The client 20 is an information processing terminal such as a portable terminal or a personal computer used by the user. The user uses the client 20 to transmit information for using the service provided by the server 50 or the like via the network over the network.

  The SSL encryption / decryption device 30 is a device that decrypts information encrypted using SSL or encrypts information using SSL. For example, the SSL encryption / decryption device 30 encrypts or decrypts information transmitted / received in order to realize a service provided by the server 50 to the client 20. In addition, when the SSL encryption / decryption device 30 determines to decrypt the communication flow received by the control processing target flow narrowing device 10 and to inspect the content, the SSL encryption / decryption device 30 defines the communication flow as the control processing target flow narrowing device 10. Are received and decoded, and passed to the DPI device 40.

  When the DPI device 40 determines that the communication flow received by the control processing target flow narrowing device 10 is to be decrypted and inspected, the DPI device 40 displays the communication flow decrypted from the SSL encryption / decryption device 30. Receive and execute DPI. For example, the DPI device 40 performs virus presence / absence determination and transmits the inspection result to the control processing target flow narrowing-down device 10. In the example of FIG. 1, the DPI device 40 is connected to the control processing target flow narrowing device 10 via the SSL encryption / decryption device 30, but the DPI device 40 directly connects to the control processing target flow narrowing device 10. You may comprise so that it may be connected.

  The server 50 provides services such as OTT to the client 20 and the like via the network.

(Example of the configuration of the control processing target flow narrowing device)
The control processing target flow narrowing device 10 includes a communication flow reception unit 11, a decoding necessity determination unit 12, a steering setting unit 13, an SSL instruction unit 14, a relay unit 15, and a storage unit 16.

  The decoding necessity determination unit 12, the steering setting unit 13, the SSL instruction unit 14, and the relay unit 15 can be realized using an arbitrary processing device such as a CPU (Central Processing Unit). Moreover, the memory | storage part 16 is not specifically limited, If it can memorize | store the information demonstrated below, it can implement | achieve using arbitrary memory | storage devices. Each of these components is not necessarily configured integrally with the control processing target flow narrowing device 10. For example, the storage unit 16 may be configured separately from the control processing target flow narrowing device 10.

  The communication flow receiving unit 11 receives a communication flow transmitted from the client 20, the SSL encryption / decryption device 30 and the server 50. In FIG. 1, only three devices, the client 20, the SSL encryption / decryption device 30, and the server 50, are connected to the control processing target flow narrowing device 10, but any other devices can be connected. Also good. A plurality of clients 20 and servers 50 may be connected to one control processing target flow narrowing device 10.

  The communication flow received by the communication flow receiving unit 11 is transmitted to the decryption necessity determination unit 12. The decryption necessity determination unit 12 determines whether the communication flow needs to be decrypted based on a part of the communication flow received by the communication flow reception unit 11 that can be determined without decryption. For example, the decryption necessity determination unit 12 extracts a value assumed in normal policy control or a value specific to the SSL session from the communication flow. As a value assumed in normal policy control, for example, a value defined by a Gx interface of 3GPP (Third Generation Partnership Project) can be cited. For example, Session-ID, Origin-Host, Origin-Realm, Destination-Realm, Auth-Application-Id, CC-Request-Type, CC-Request-Number, Vender-ID, Feature-List-ID, Feature-List, Framed-IPv6-Prefix, Logical-Access-ID, etc. For example, the decryption necessity determination unit 12 extracts record header information defined by the record protocol in the Client Hello message. Alternatively, the decryption necessity determination unit 12 extracts information included in the server certificate of the Certificate message transmitted from the server. Moreover, the decoding necessity determination part 12 may extract user identification information. For example, the decryption necessity determination unit 12 may extract a SIM number, a VLAN number, a tunnel number, a telephone number, and the like. In addition, information such as URL, 5tuple, and application can be used. Then, the decryption necessity determination unit 12 determines whether the communication flow needs to be decrypted based on the extracted information and value. For example, the decryption necessity determination unit 12 extracts the server certificate included in the communication flow and does not need to be decrypted when the server authenticated by the certificate is registered in advance in the storage unit 16 as a secure device. Is determined. The determination method of the decryption necessity determination unit 12 is not particularly limited as long as the communication flow can be determined based on information that can be extracted without performing SSL decryption.

  Based on the determination result of the decoding necessity determination unit 12, the steering setting unit 13 steers each communication flow. That is, the steering setting unit 13 performs steering so that the communication flow determined to be necessary for decryption is transmitted to the SSL encryption / decryption device 30. Further, the steering setting unit 13 steers the communication flow determined to be unnecessary to be transmitted directly to the server 50 or the like without being transmitted to the SSL encryption / decryption device 30.

  The SSL instruction unit 14 instructs the SSL encryption / decryption device 30 to decrypt the communication flow steered to the SSL encryption / decryption device 30 by the steering setting unit 13 and execute the inspection by the DPI device 40. In addition, the SSL instruction unit 14 transmits the communication flow to the SSL encryption / decryption device 30.

  The relay unit 15 transmits each communication flow to another node based on the setting of the steering setting unit 13. The steering setting unit 13, the SSL instruction unit 14, and the relay unit 15 execute the DPI by decoding the communication flow determined to be DPI execution required by the decoding necessity determination unit 12, and it is determined that the DPI execution is unnecessary. It is a control part which controls to transfer a communication flow to a transmission destination without decoding.

  The storage unit 16 stores information for determining necessity of decoding. For example, when it is known in advance that a predetermined URL or server is reliable, the communication flow from the URL or the server may be directly sent to the transmission destination without performing decryption and DPI inspection. Therefore, for example, a URL “decryption required” and a URL “decryption not required” are stored in the storage unit 16 in advance. Then, the decryption necessity determination unit 12 refers to the information stored in the storage unit 16 to determine whether the received communication flow needs to be decrypted.

(Example of flow of control process target flow narrowing method according to the first embodiment)
FIG. 2 is a flowchart illustrating an example of the flow of the control process target flow narrowing process according to the first embodiment. The control process target flow narrowing device 10 first receives an encrypted communication flow (step S21). Then, the control processing target flow narrowing device 10 determines whether or not the communication flow needs to be decrypted, that is, whether or not DPI is necessary (step S22). If it is determined that decryption is necessary (step S23, YES), the control processing target flow narrowing device 10 transmits the communication flow to the SSL encryption / decryption device 30 and the DPI device 40, and performs decryption and DPI. This is executed (step S24). On the other hand, when it is determined that decryption is unnecessary (NO in step S23), the control processing target flow narrowing device 10 does not transmit the communication flow to the SSL encryption / decryption device 30 and directly transfers the communication flow to the transmission destination (step). S25).

  In step S24, when the decryption and inspection of the communication flow requiring decryption is completed, the inspection result is notified to the control processing target flow narrowing device 10 (step S26). As a result of the inspection, when it is determined that the communication flow is a malicious communication flow, for example, a communication flow including a virus (step S27, YES), the communication flow is blocked without being transferred to the transmission destination (step S28). On the other hand, when it is determined that the communication flow is not a malicious communication flow, that is, a malignant flow (NO in step S27), the control process target flow narrowing device 10 proceeds to step S25 and transfers the communication flow to the transmission destination. . Thus, the control process target flow narrowing process ends.

(Effects of the first embodiment)
As described above, in the first embodiment, the control processing target flow narrowing-down apparatus acquires, without decryption, whether or not it is necessary to inspect the communication flow by decrypting the encrypted communication flow. The determination is made based on the content of the communication flow that can be performed. Then, the control processing target flow narrowing-down apparatus transfers the communication flow determined not to be inspected to the transmission destination without decoding, and decodes and inspects the communication flow determined to be inspected. For this reason, compared with the case where decryption and inspection are performed for all communication flows, even if the encrypted communication flow is a control target, the communication flow targeted for control processing is efficiently narrowed down. Can do. For this reason, the processing load concerning a communication flow can be reduced and processing efficiency can be improved.

(Modification 1 of the first embodiment-steering based on feedback)
The control processing target flow narrowing device 10 according to the first embodiment determines whether or not decoding is necessary, and steers the communication flow based on the determination result. On the other hand, based on the processing results in the SSL encryption / decryption device 30 and the DPI device 40, steering control of the communication flow received thereafter may be executed. This embodiment will be described as a first modification of the first embodiment.

  FIG. 3 is a diagram for explaining a first modification of the control processing target flow narrowing system according to the first embodiment. A control processing target flow narrowing device 10A shown in FIG. 3 has substantially the same configuration as the control processing target flow narrowing device 10 according to the first embodiment, except that a feedback processing unit 17 is provided. Further, the control processing target flow narrowing device 10A is different from the first embodiment in that the storage unit 16A includes a steering database (DB). Hereinafter, differences from the first embodiment will be mainly described.

  The configuration and functions of the communication flow receiving unit 11A, the decoding necessity determination unit 12A, the steering setting unit 13A, the SSL instruction unit 14A, and the relay unit 15A included in the control processing target flow narrowing device 10A are the communication flows of the first embodiment. This is the same as the receiving unit 11, the decoding necessity determination unit 12, the steering setting unit 13, the SSL instruction unit 14, and the relay unit 15. For this reason, the description about these components is abbreviate | omitted. The configurations and functions of the client 20A, SSL encryption / decryption device 30A, DPI device 40A, and server 50A are the same as those of the client 20, SSL encryption / decryption device 30, DPI device 40, and server 50 of FIG. Therefore, explanation is omitted.

  The feedback processing unit 17 receives the feedback information of the processing result of the communication flow transmitted to the SSL encryption / decryption device 30A, decrypted, and DPI-processed by the DPI device 40A. Then, based on the feedback information, the feedback processing unit 17 adjusts the steering control of the communication flow that is subsequently received by the control processing target flow narrowing device 10A. Further, the feedback processing unit 17 analyzes the received processing result and stores it in the steering database (DB) of the storage unit 16A for use in subsequent determination of necessity of decoding.

  For example, if a predetermined URL is determined to be a malicious URL as a result of analysis by the DPI device 40A, the URL is stored in the storage unit 16A, and access from the URL is blocked thereafter. If the predetermined URL is determined to be non-malicious as a result of analysis by the DPI device 40A, the URL is stored in the storage unit 16A. Thereafter, the communication flow from the URL is decrypted by the DPI device 40A. Inspection is not required.

  In this way, in addition to the information that has been known in advance, the accuracy and efficiency of the necessity determination of decryption is improved by using the feedback of the processing results in the SSL encryption / decryption device 30A and the DPI device 40A. be able to. Further, by increasing the accuracy of the necessity determination of decryption in this way, the processing load on the SSL encryption / decryption device 30A can be reduced.

(Modification 2 of the first embodiment-coping with a device not supporting SSL communication)
In the control process target flow narrowing process according to the first embodiment, the communication flow after decryption and DPI is encrypted again and transmitted to the transmission destination. However, the present invention is not limited to this, and for example, the control processing target flow narrowing-down device 10 is connected to a network that does not support SSL communication, and a decrypted communication flow is provided to a device that provides a service on the network. May be transmitted.

  For example, FIG. 4 is a diagram for explaining a modification 2 of the control processing target flow narrowing system according to the first embodiment. In FIG. 4 (1), both the network connecting the client and PCEF / DPI and the network connecting PCEF / DPI and OTT support SSL communication. On the other hand, a case where the network connecting PCEF / DPI and OTT is not compatible with SSL communication as shown in (2) of FIG. For example, there may be a case where OTT does not support SSL and the user wants to perform secure communication using a wireless LAN (no encryption) at an airport. In such a case, SSL communication is performed between the client and the control processing target flow narrowing device, and decrypted data is sent between the control processing target flow narrowing device and the OTT.

(Modification 3 of First Embodiment 3-Decoding and DPI)
In the control processing target flow narrowing-down process according to the first embodiment, all communication flows determined to be decrypted are subjected to decryption and DPI processing. However, the present invention is not limited to this. For example, when a decrypted communication flow can be used for processing, but a highly reliable server or the like is a destination, only the communication flow is decrypted and DPI is not performed. You may steer like this.

  By flexibly steering the communication flow in this way, efficient steering can be realized according to the transmission destination device and the service provided, and communication efficiency can be improved.

(Second Embodiment)
FIG. 5 is a diagram illustrating an example of a schematic configuration of a control processing target flow narrowing system according to the second embodiment. As shown in FIG. 5, the control processing target flow narrowing system according to the second embodiment includes a PCEF (Policy and Charging Enforcement Function) / DPI 100 and a PCRF (Policy and Charging Rule Function) 200. In the example of FIG. 5, the control processing target flow narrowing apparatus according to the first embodiment is realized by the PCEF / DPI 100 and the PCRF 200.

  The PCRF 200 decrypts the communication flow encrypted based on the SSL to determine whether or not it is necessary to execute DPI on the communication flow in the content of the communication flow that can be acquired without decrypting the communication flow. It functions as a determination unit that makes a determination based on this.

  In addition, the PCRF 200 instructs the DPI on what kind of content to execute the DPI for the communication flow determined to be DPI execution, and instructs the PCEF 100 how to transfer the communication flow. . That is, the PCRF 200 instructs the PCEF 100 to execute the steering instruction of the communication flow determined to require execution of DPI, and instructs the PCEF / DPI 100 to transfer the communication flow determined to not execute DPI to the transmission destination. Execute. In other words, the PCRF 200 serves as a control unit that controls to transfer the communication flow determined to be unnecessary to execute DPI to the transmission destination without decoding, and to decode and check the communication flow determined to be required to execute DPI. Function.

  In FIG. 5, the client 20 </ b> B is connected to the network via the access point 21. The communication flow from the client 20B is received by the PCEF / DPI 100. The PCEF / DPI 100 is connected to the SSL encryption / decryption device 30B. The SSL encryption / decryption device 30B is connected to the DPI device 40B. The DPI device 40B is connected to functional units such as a virus check function 41, a Twitter storage 42, and an optimization function 43. The DPI device 40B is connected to the PCRF 200. The PCEF / DPI 100 is also connected to the OTT 50B via a network.

  The PCEF / DPI 100 shown in FIG. 5 identifies the content of the received communication flow and creates information for determining the control of the communication flow. The PCEF / DPI 100 controls the communication flow based on an instruction from the PCRF 200. For example, the PCEF / DPI 100 performs control such as communication flow steering, blocking, and rate limiting. The PCEF / DPI 100 controls the communication flow based on the processing results in the SSL encryption / decryption device 30B and the DPI device 40B.

  The PCEF / DPI 100 can control the communication flow by dividing it in units of flows. For this reason, by using the PCEF / DPI 100, it is possible to change the control content such as whether or not to decode, for each communication flow. Specifically, in the PCEF / DPI 100, the PCEF identifies up to layer 3 information such as 5 tuples. In the PCEF / DPI 100, the DPI identifies up to layer 7 information. Therefore, various control contents can be executed by instructing the PCEF / DPI 100 after executing the determination of whether or not the PCRF 200 performs decoding. The PCEF / DPI 100 can use, for example, a value assumed in normal policy control or a value specific to an SSL session in order to divide a communication flow into flow units. As a value assumed in normal policy control, for example, a value defined by a Gx interface of 3GPP (Third Generation Partnership Project) can be cited. For example, Session-ID, Origin-Host, Origin-Realm, Destination-Realm, Auth-Application-Id, CC-Request-Type, CC-Request-Number, Vender-ID, Feature-List-ID, Feature-List, Framed-IPv6-Prefix, Logical-Access-ID, etc. As a value peculiar to the SSL session, for example, record header information defined by the record protocol of the Client Hello message can be cited. It is also possible to use server certificate information sent by a Certificate message sent from the server. Further, for example, the PCEF / DPI 100 may separate communication flows using user identification information such as a SIM number, a VLAN number, a tunnel number, and a telephone number. In addition, information such as URL, 5tuple, and application can be used.

  The PCEF / DPI 100 separates the communication flow and creates information for identifying the content of the communication flow and determining the control content. For example, the PCEF / DPI 100 creates information for identifying the content of the communication flow and determining the control content using values assumed in normal policy control or values specific to the SSL session. Values assumed in normal policy control used here and values specific to the SSL session are the same as the values used by the PCEF / DPI 100 to divide the communication flow into units of flows. The PCEF / DPI 100 transmits information for determining the created control content to the PCRF 200.

  Further, the PCEF / DPI 100 executes control based on the flow control content determined by the PCRF 200. For example, the PCEF / DPI 100 executes control such as steering, blocking, rate limiting, etc. of the communication flow. Further, communication with other nodes is executed based on the result of executing control based on the flow control content determined by the PCRF 200 for the communication flow. For example, the PCEF / DPI 100 executes discarding of the communication flow or the like when a virus is found as a result of executing decryption and DPI inspection on the communication flow.

  For the communication flow received by the PCEF / DPI 100, the PCRF 200 refers to information for control judgment of the communication flow created by the PCEF / DPI 100, and determines the control content. The PCRF 200 sets the content of communication processing with other nodes based on the control result of the communication flow. The control content determined by the PCRF 200 is notified to the PCEF / DPI 100, and the PCEF / DPI 100 executes control based on the control content determined by the PCRF 200.

  The PCRF 200 determines the control content for each communication flow based on the information transmitted from the PCEF / DPI 100. For example, the PCRF 200 determines whether or not to perform a check by decoding and DPI on the communication flow. In addition, the PCRF 200 determines execution of processing for transmitting the communication flow as it is to the transmission destination. In addition, the PCRF 200 controls the DPI device 40B so that the DPI device 40B performs steering to a device (such as the virus check function 41) that requires access control and encryption for each communication flow. The PCRF 200 controls the PCEF / DPI 100 to communicate with other nodes based on the communication flow control result. That is, the PCRF 200 feeds back the processing result in the DPI device 40B to the PCEF / DPI 100.

  The SSL encryption / decryption device 30B decrypts and encrypts information transmitted and received for a service provided between the OTT 50B and the client 20B. Further, the SSL encryption / decryption device 30B transmits the decrypted communication flow to the DPI device 40B.

  The DPI device 40B executes DPI based on the control of the PCRF 200. The DPI device 40B notifies the PCRF 200 of the DPI result.

  The client 20B, the SSL encryption / decryption device 30B, the DPI device 40B, and the OTT 50B generally correspond to the client 20, the SSL encryption / decryption device 30, the DPI device 40, and the server 50 in FIG. It is the same.

  In the control processing target flow narrowing system according to the second embodiment, the PCEF / DPI 100 that can control the communication flow in units of flows and the PCRF 200 are installed, so that the control processing target flow to be decoded in units of flows is determined. Narrow down. That is, the number of communication flows to be encrypted / decrypted using the PCEF / DPI 100 is suppressed as much as possible. In addition, by notifying the PCRF 200 of the processing results in the SSL encryption / decryption device 30B and the DPI device 40B, flow control considering the decryption result is realized. In order to realize such processing, the PCEF / DPI 100 extracts information for determining whether or not decoding is necessary from the communication flow and transmits it to the PCRF 200. The PCRF 200 determines the contents of access control and steering control for each communication flow, and instructs the DPI device 40B to perform control. The DPI device 40B notifies the PCRF 200 of the DPI result. The PCRF 200 considers the DPI result, further determines the control content, and notifies the PCEF / DPI 100 of it. As described above, the PCEF / DPI 100, the PCRF 200, the SSL encryption / decryption device 30B, and the DPI 40B operate to narrow down the communication flow to be decrypted.

  FIG. 6 is a flowchart illustrating an example of the flow of the control process target flow narrowing process according to the second embodiment. As shown in FIG. 6, first, the PCEF / DPI 100 receives a communication flow from the client 20B (step S601). Here, although the communication flow from the client 20B will be described as an example, the same processing is executed for the communication flow transmitted by the OTT 50B.

  The PCEF / DPI 100 extracts information for determining necessity of decoding from the received communication flow (step S602). For example, the PCEF / DPI 100 extracts values assumed in the above-described normal policy control and values specific to the SSL session.

  Next, the PCEF / DPI 100 transmits the extracted information to the PCRF 200. The PCRF 200 determines whether or not decoding is necessary based on the received information (step S603). For example, if the received information indicates that the information is from a highly reliable server, the PCRF 200 determines that decoding is not necessary.

  Then, the PCRF 200 performs steering setting for determining and setting the transmission path of the communication flow based on the result of the necessity determination of decoding (step S604). For example, when the PCRF 200 determines to decrypt the communication flow and perform DPI processing, the PCRF 200 performs steering setting to transmit the communication flow to the SSL encryption / decryption device 30B and the DPI device 40B. Then, the PCRF 200 notifies the PCEF / DPI 100 and the DPI device 40B to process the communication flow based on the steering setting. The PCEF / DPI 100 transmits the communication flow to the SSL encryption / decryption device 30B based on the instruction from the PCRF 200 and decrypts it (step S605). Further, the PCEF / DPI 100 transmits the communication flow to the DPI device 40B and executes the DPI process (step S605).

  The processing results and control results in the DPI device 40B are transmitted from the DPI device 40B to the PCRF 200 (step S606). The PCRF 200 updates the control content of the communication flow in consideration of the processing result and control result in the DPI device 40B, and instructs the PCEF / DPI 100 (step S607). Based on the control instruction from the PCRF 200, the PCEF / DPI 100 performs control such as transmitting the encrypted communication flow to the OTT 50B again (step S608). Thus, an example of narrowing down the control processing target flow is completed.

  The flow in FIG. 6 is an example in which decoding and DPI are executed on the communication flow, but the communication flow is transmitted as it is without executing decoding and DPI according to the control content determined by the PCRF 200. There are cases where the communication flow of decryption and DPI is blocked.

(Example of flow of control process target flow narrowing process according to the second embodiment)
FIG. 7 is a sequence chart for explaining an example of the flow of the control process target flow narrowing process according to the second embodiment. With reference to FIG. 7, an example of the flow of processing according to the second embodiment will be described.

  First, when receiving a call such as Client Hello, the PCEF / DPI 100 transmits a CCR-I (Credit-Control-Request Initialization) message to the PCRF 200 ((1) in FIG. 7). By transmitting this message, the PCEF / DPI 100 requests the PCFR 200 to determine whether SSL encryption / decryption is necessary. At this time, the PCEF / DPI 100 extracts information that is included in the received call and serves as a basis for determining whether encryption / decryption is necessary, and transmits the extracted information to the PCRF 200.

  The PCRF 200 receives the CCR-I and determines the control content for the communication flow. Then, the PCRF 200 transmits a CCA (Credit-Control-Answer) for instructing control contents (for example, steering contents) to the PCEF / DPI 100. In FIG. 7, it is assumed that the PCRF 200 transmits a CCA instructing decoding ((2) in FIG. 7).

  The PCRF 200 also transmits an RAR (Reauthorization Request) DPI that instructs the DPI device 40B to execute the determined control (steering or the like). Here, it is assumed that the PCRF 200 has transmitted an RAR instructing execution of DPI ((3) in FIG. 7). The DPI device 40B returns an RAA (Reauthorization Answer) to the PCRF 200 in response to the RAR ((4) in FIG. 7).

  Further, the PCEF / DPI 100 instructs the SSL encryption / decryption device 30B to execute the SSL proxy operation. The SSL encryption / decryption device 30B executes processing according to the instruction (U-Plane- (1) in FIG. 7).

  Further, the SSL encryption / decryption device 30B transmits a communication flow to the DPI device 40B (U-Plane- (2) in FIG. 7). The DPI device 40B executes processing based on the contents instructed from the PCRF 200. Further, when the PCRF 200 has instructed processing by the virus check function 41, the Twitter storage unit 42, the optimization function 43, etc., steering control for transmitting data from the DPI device 40B to these functional units is performed and the processing is executed. (U-Plane- (3) in FIG. 7). After the processing is completed, the DPI device 40B notifies the PCRF 200 of the processing result and the control result.

  The PCRF 200 receives the notification from the DPI device 40B and transmits a control instruction to the PCEF / DPI 100. That is, the PCRF 200 transmits an RAR to the PCEF / DPI 100 ((5) in FIG. 7). The PCEF / DPI 100 returns RAA to the PCRF 200 ((6) in FIG. 7) and executes control. The SSL encryption / decryption device 30B encrypts the communication flow again and transmits it to the PCEF / DPI 100 when the processing in the DPI device 40B or the like is completed. In FIG. 7, “U-Plane” means a user plane.

(Effect of 2nd Embodiment)
As described above, the control processing target flow narrowing method according to the second embodiment determines whether it is necessary to execute DPI on the communication flow by decrypting the communication flow encrypted based on SSL. And a determination step of determining based on the content of the communication flow that can be acquired without decoding the communication flow. In addition, the control processing target flow narrowing-down method decodes a communication flow determined to require execution of DPI, executes DPI, and transfers a communication flow determined to not require execution of DPI to a transmission destination without decoding. Process.

  For this reason, even if the communication flow is SSL-encrypted, it is possible to determine and control the necessity of decryption based on information that can be extracted without decryption. For this reason, even if the encrypted communication flow is a control target, it is possible to efficiently narrow down the communication flow to be controlled.

  In the control processing target flow narrowing method according to the second embodiment, whether or not it is necessary to execute DPI for a communication flow is determined by the record header information or the server certificate included in the client hello message of the communication flow. Based on the letter. For this reason, even in an encrypted communication flow, it is possible to easily determine the reliability, determine whether to perform decryption and inspection such as virus check.

  Also, in the control processing target flow narrowing method according to the second embodiment, feedback of the DPI execution result for the communication flow determined to be DPI execution is received and used to determine whether or not DPI is to be executed. For this reason, the flow to be processed can be further narrowed down using the DPI result, and the processing efficiency can be progressively increased.

  In addition, the control processing target flow narrowing method according to the second embodiment receives feedback and classifies communication flows that require execution of DPI and communication flows that do not require execution of DPI based on the destination URL of the communication flow. And a storing step of storing in the storage unit. The storage unit may be shared by a plurality of PCRFs and PCEFs. For this reason, the execution result of DPI can be stored and shared and used by other PCRFs and PCEF / DPI, and the processing efficiency can be further improved.

(Third embodiment)
In the configuration example of the second embodiment in FIG. 5, the SSL encryption / decryption device 30 </ b> B and the PCRF 200 are not directly connected. However, the present invention is not limited to this. For example, the SSL encryption / decryption device 30B and the PCRF 200 may be connected so that the SSL encryption / decryption device 30B and the PCRF 200 cooperate with each other.

  For example, if it is determined that DPI is unnecessary as a result of the DPI processing, the SSL encryption / decryption device 30B notifies the PCRF 200 to stop the DPI steering. And you may comprise so that PCRF200 may perform steering stop setting and instruct | indicate to PCEF / DPI100.

  For example, in FIG. 5, it is assumed that the SSL encryption / decryption device 30B and the PCRF 200 are connected. In this case, the SSL encryption / decryption device 30B transmits the decryption result to the PCRF 200. The PCRF 200 determines whether to steer the data to the DPI device 40B based on the received decoding result. Further, the PCRF 200 determines whether to use a service arranged under the DPI device 40B such as the virus check 41 based on the received decryption result. That is, the PCRF 200 determines whether to transmit the decrypted flow to the service under the DPI device 40B. The PCRF 200 instructs the determined content to the SSL encryption / decryption device 30B.

  The SSL encryption / decryption device 30B receives the instruction from the PCRF 200, and determines whether or not to use the processing by the DPI device 40B and the service under the DPI device 40B. For example, the SSL encryption / decryption device 30B determines whether or not to use services under the DPI device 40B such as the virus check function 41, the Twitter storage, and the optimization function 43. Then, the SSL encryption / decryption device 30B instructs the DPI device 40B to execute the processing determined to be used out of the DPI and additional services.

  Alternatively, the DPI may be virtualized so that a plurality of SSL encryption / decryption devices can share the DPI.

(program)
FIG. 8 is a diagram illustrating that the information processing by the control processing target flow narrowing program according to the disclosed technique is specifically realized using a computer. As illustrated in FIG. 8, the computer 1000 includes, for example, a memory 1010, a CPU (Central Processing Unit) 1020, a hard disk drive 1080, and a network interface 1070. Each part of the computer 1000 is connected by a bus 1100.

  The memory 1010 includes a ROM 1011 and a RAM 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System).

  Here, as illustrated in FIG. 8, the hard disk drive 1080 stores, for example, an OS 1081, an application program 1082, a program module 1083, and program data 1084. That is, the control processing target flow narrowing program according to the disclosed embodiment is stored in, for example, the hard disk drive 1080 as the program module 1083 in which a command to be executed by the computer is described.

  Data used for information processing by the control processing target flow narrowing program is stored as program data 1084 in, for example, the hard disk drive 1080. Then, the CPU 1020 reads the program module 1083 and program data 1084 stored in the hard disk drive 1080 to the RAM 1012 as necessary, and executes various procedures.

  The program module 1083 and the program data 1084 related to the control processing target flow narrowing program are not limited to being stored in the hard disk drive 1080. For example, the program module 1083 and the program data 1084 may be stored in a removable storage medium. In this case, the CPU 1020 reads data via a removable storage medium such as a disk drive. Similarly, the program module 1083 and the program data 1084 related to the control processing target flow narrowing program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). May be. In this case, the CPU 1020 reads various data by accessing another computer via the network interface 1070.

[Others]
Note that the control processing target flow narrowing program described in this embodiment can be distributed via a network such as the Internet. The control processing target flow narrowing program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD, and is executed by being read from the recording medium by the computer. You can also.

  Of the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

  The above embodiments and modifications thereof are included in the invention disclosed in the claims and equivalents thereof as well as included in the technology disclosed in the present application.

DESCRIPTION OF SYMBOLS 10 Control processing object flow narrowing-down apparatus 11 Communication flow receiving part 12 Decoding necessity judgment part 13 Steering setting part 14 SSL instruction | indication part 15 Relay part 16 Memory | storage part 17 Feedback processing part 20 Client 21 AP
30 SSL encryption / decryption device 40 DPI device 41 Virus check function 42 Twitter storage 43 Optimization function 50 Server 100 PCEF / DPI
200 PCRF

Claims (8)

Determining whether it is necessary to inspect the communication flow by decrypting the encrypted communication flow based on the content of the communication flow that can be acquired without decryption;
Transferring the communication flow determined to be unnecessary to the transmission destination without decoding, and decoding and inspecting the communication flow determined to be inspected;
A control processing target flow narrowing-down method, comprising: Whether or not it is necessary to perform DPI (Deep Packet Inspection) on the communication flow by decrypting the communication flow encrypted based on SSL (Secure Sockets Layer) without decrypting the communication flow. A determination step of determining based on the content of the communication flow that can be acquired;
Decoding a communication flow determined to require execution of DPI, executing DPI, and transferring a communication flow determined to be unnecessary to execute DPI to a destination without decoding;
A control processing target flow narrowing-down method, comprising:   The determination as to whether or not it is necessary to execute DPI for the communication flow is performed based on record header information or a server certificate included in a client hello message of the communication flow. Control process target flow narrowing method.   4. The control processing target flow narrowing-down method according to claim 2, wherein the determination step uses feedback of a DPI execution result for a communication flow determined to be required to execute the DPI.   In response to the feedback, the information processing method further includes a storing step of classifying the communication flow requiring execution of DPI and the communication flow not requiring execution of DPI based on the destination URL of the communication flow and storing them in a storage unit. The control process target flow narrowing-down method according to claim 4.   6. The control processing target flow narrowing method according to claim 5, wherein the storage unit is shared by a plurality of PCRF (Policy and Charging Rule Function) and PCEF (Policy and Charging Enforcement Function). A decryption necessity determination unit that determines whether it is necessary to inspect the communication flow by decrypting the encrypted communication flow based on the content of the communication flow that can be acquired without decryption;
A control unit that controls the communication flow determined to be unnecessary to be transferred to the transmission destination without being decrypted, and the communication flow determined to be inspected is decrypted and inspected.
A control processing target flow narrowing-down apparatus comprising: Whether or not it is necessary to perform DPI (Deep Packet Inspection) on the communication flow by decrypting the communication flow encrypted based on SSL (Secure Sockets Layer) without decrypting the communication flow. A determination unit for determining based on the content of the communication flow that can be acquired;
A control unit that decodes the communication flow determined to be DPI-executable and executes DPI, and controls to transfer the communication flow that is determined not to be DPI-executed to the destination without decoding;
A control processing target flow narrowing-down apparatus, comprising:

Images