JP2022078793A - Gateway device, communication system, communication method, and program - Google Patents

Abstract

To provide a gateway device or the like that makes it difficult for an attacker to grasp the determination of the vulnerability by changing a packet that an IoT device responds to an investigation packet from the attacker.SOLUTION: A gateway device 10 includes a communication response determination unit 12a that determines whether a response packet to a packet transmitted from an external device contains information that can identify a module, and a communication response control unit 12b that rewrites information that can identify the module into information that cannot identify the module when the communication response determination unit determines that the response packet contains information that can identify the module.SELECTED DRAWING: Figure 1

Description

The present invention relates to gateway devices, communication systems, communication methods, and programs.

In recent years, the risk of damage from cyber attacks from hackers and the like has increased. Attackers send investigation packets to IoT devices, determine which modules exist in IoT devices and which vulnerabilities exist based on the response, and attack according to the vulnerabilities. I'm doing it. On the other hand, there is known a system that determines that communication is not permitted and discards a packet that does not satisfy the correspondence between the MAC address and the IP address (see, for example, Patent Document 1).

On the other hand, the present inventor has considered making it difficult for an attacker to grasp the vulnerability determination by changing the packet in which the IoT device responds to the investigation packet from the attacker.

Japanese Unexamined Patent Publication No. 2017-21275

However, Patent Document 1 does not propose at all that it is difficult for an attacker to grasp the determination of a vulnerability by changing the packet in which the IoT device responds to the investigation packet from the attacker.

An object of the present invention is a gateway device that makes it difficult for an attacker to grasp the vulnerability determination by changing the packet in which the IoT device responds to the investigation packet from the attacker in view of the above-mentioned problems. , Communication systems, communication methods, and programs.

The gateway device of the present invention includes a communication response determination unit that determines whether or not a response packet to a packet transmitted from an external device contains information that can identify a module, and the response packet includes information that can identify the module. When the communication response determination unit determines, the communication response control unit rewrites the information that can identify the module into the information that cannot identify the module.

The communication system of the present invention includes a gateway device and a communication device connected to the gateway device, and the gateway device is a device that relays packets transmitted and received between the external device and the communication device. The communication response determination unit that determines whether or not the response packet from the communication device to the packet transmitted from the external device contains information that can identify the module, and the response packet includes information that can identify the module. When the communication response determination unit determines, the communication response control unit rewrites the information that can identify the module into the information that cannot identify the module.

The communication method of the present invention includes a step of determining whether or not a response packet to a packet transmitted from an external device contains information that can identify a module.
When it is determined that the response packet contains information that can discriminate the module, the step includes rewriting the information that can discriminate the module into the information that cannot discriminate the module.

The program of the present invention is a process of determining whether or not a response packet to a packet transmitted from an external device contains information that can identify a module, and a case where it is determined that the response packet contains information that can identify the module. , A program for causing a computer to perform a process of rewriting information that can discriminate the module into information that cannot discriminate the module.

According to the present invention, a gateway device, a communication system, a communication method, and a communication method that can make it difficult for an attacker to grasp a vulnerability by changing a packet in which an IoT device responds to an investigation packet from an attacker. A program can be provided.

It is a schematic block diagram of a gateway device 10. It is a detailed block diagram of the communication system 1. It is a block diagram of a router 10. This is a configuration example of the IoT device 20. It is a sequence diagram which shows the process when the router 10 receives the investigation packet addressed to the IoT device 20 transmitted from the attacker terminal 30. (A) An example of information that can identify a module and (b) an example of information that cannot identify a module, which is included in a response packet returned by the module (httpd). This is an example in which the table 11b is provided on the cloud server 40 on the Internet network NW. By doing this, it is possible to always return the latest version information. This is an example of the IP address and MAC address of the attacker terminal 30.

(Embodiment 1)
Hereinafter, the gateway device 10 according to the first embodiment of the present invention will be described with reference to the accompanying drawings. The corresponding components in each figure are designated by the same reference numerals, and duplicate explanations are omitted.

First, the configuration of the gateway device 10 will be described with reference to FIG.

FIG. 1 is a schematic configuration diagram of the gateway device 10.

As shown in FIG. 1, in the gateway device 10, the communication response determination unit 12a for determining whether or not the response packet to the packet transmitted from the external device contains information capable of identifying the module, and the response packet can determine the module. When the communication response determination unit 12a determines that the information is included, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module.

According to the first embodiment, by changing the packet in which the IoT device responds to the investigation packet from the attacker, it is possible to make it difficult for the attacker to grasp the determination of the vulnerability.

This is because when the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module to the information that cannot identify the module and responds.

(Embodiment 2)
Hereinafter, as the second embodiment of the present invention, the communication system 1 including the gateway device 10 will be described in more detail. Hereinafter, an example in which a router is used as the gateway device 10 will be described. Hereinafter, it is referred to as a router 10.

FIG. 2 is a schematic configuration diagram of the communication system 1.

As shown in FIG. 2, the communication system 1 includes a router 10 and an IoT (Internet of Things) device 20. The router 10 and the IoT device 20 are connected to each other via the home network HNW (wired or wireless), and can communicate with each other via the home network HNW. Further, the router 10 and the external device (for example, the attacker terminal 30) are connected to each other via the Internet network NW, and can communicate with each other via the Internet network NW. Similarly, the IoT device 20 (IoT device 20 under the router 10) connected to the router 10 and the external device (for example, the attacker terminal 30) can communicate with each other via the Internet network NW. The number of IoT devices 20 under the router 10 may be one or a plurality.

First, a configuration example of the router 10 will be described.

FIG. 3 is a configuration diagram of the router 10.

As shown in FIG. 3, the router 10 includes a storage unit 11, a control unit 12, a memory 13, and a communication unit 14.

The storage unit 11 is, for example, a non-volatile storage unit such as a hard disk device or a ROM. The program 11a and the table 11b are stored in the storage unit 11.

The program 11a is a program executed by the control unit 12 (processor). Table 11b includes "communication module", "tampering response version / banner", "permitted connection destination IP", and "permitted MAC" as items. In the "communication module", a module (communication module) stored in the storage unit 21 of the IoT device 20 is registered. The "tampering response version / banner", "permitted connection destination IP", and "permitted MAC" are registered for each "communication module". The contents to be rewritten are registered in the "tampering response version / banner" as described later. An IP address for which connection is permitted is registered in "permitted connection destination IP". The MAC address for which connection is permitted is registered in "Allowed MAC".

Although not shown, the control unit 12 includes a processor. The processor is, for example, a CPU (Central Processing Unit). There may be one processor or multiple processors. The processor functions as a communication response determination unit 12a and a communication response control unit 12b by executing the program 11a read from the storage unit 11 into the memory 13 (for example, RAM). Some or all of these may be implemented in hardware.

The communication response determination unit 12a determines whether or not the response packet to the packet transmitted from the external device via the Internet network NW contains information that can identify the module. This process will be described later. The packet transmitted from the external device is, for example, an IP packet addressed to the IoT device 20 connected to the router 10. The packet transmitted from the external device may be an IP packet addressed to the router 10. The response packet is, for example, an IP packet addressed to an external device transmitted (returned) from the IoT device 20. The response packet may be an IP packet addressed to an external device transmitted (returned) from the router 10.

When the communication response determination unit 12a determines that the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module. This process will be described later.

The communication unit 14 is a communication device that communicates with an external device via the Internet network NW.

Next, a configuration example of the IoT device 20 will be described.

FIG. 4 is a configuration example of the IoT device 20.

As shown in FIG. 4, the IoT device 20 includes a storage unit 21, a control unit 22, a memory 23, and an IoT device main body 24. The IoT device 20 is, for example, a home appliance such as a refrigerator, but is not limited to this. That is, the IoT device 20 may be any device that is connected to the router 10 and performs an IP response. The IoT device 20 is an example of the communication device of the present invention.

The storage unit 21 is, for example, a non-volatile storage unit such as a hard disk device or a ROM. The OS (Operating System) 21a and the Web server program 21b are stored in the storage unit 21. OS21a is, for example, Linux®. The Web server program 21b is, for example, Apache. The Web server program includes one or more modules (for example, communication modules such as httpd and Telnetd).

Although not shown, the control unit 22 includes a processor. The processor is, for example, a CPU (Central Processing Unit). There may be one processor or multiple processors. By executing the OS 21a or the Web server program 21b (module or the like) read from the storage unit 21 into the memory 23 (for example, RAM), the processor may, for example, return a response packet to a packet transmitted from an external device. , Controls the IoT device body 24. The IoT device main body 24 is, for example, a home appliance such as a refrigerator, but is not limited to this.

Next, processing when the router 10 receives the investigation packet addressed to the IoT device 20 transmitted from the attacker terminal 30 will be described.

FIG. 5 is a sequence diagram showing processing when the router 10 receives a survey packet addressed to the IoT device 20 transmitted from the attacker terminal 30.

Generally, an attacker attacks a router 10 in a home network HNW and an IoT device 20 connected to the router 10 from the attacker terminal 30 via the Internet network NW. At that time, the investigation packet is transmitted to the router 10 or the IoT device 20, and the response thereof is used to grasp the module configuration, the module version, and the vulnerabilities that actually exist. After grasping the vulnerability, the attacker attacks the router 10 and the IoT device 20 according to the vulnerability.

A specific example of the attack will be described. For example, suppose the module is Apache. Apache may return Server: apache 2.4.20 in response to an HTTP request. For example, if there is a vulnerability against Version: 2.4.20 such as http://jvn.jp/vu/JVNVU92184689/, the attacker will attack the vulnerability existing in Version 2.4.20. This attack can be suppressed by the following processing.

First, as shown in FIG. 5, when the router 10 receives the investigation packet (IP packet) addressed to the IoT device 20 transmitted (step S1) from the attacker terminal 30, the router 10 is connected to the router 10. The survey packet is relayed (transferred) to the IoT device 20 (step S2).

Next, the IoT device 20 responds to the relayed survey packet (step S3). That is, the IoT device 20 (module) returns a response packet (IP packet addressed to the attacker terminal 30).

Hereinafter, an operation example when the module (httpd) returns a response packet including the content shown in FIG. 6A will be described. FIG. 6A is an example of information that can identify the module, which is included in the response packet returned by the module (httpd). FIG. 6B is an example of information in which the module cannot be identified.

When the response packet returned by the module (httpd) contains an IP address other than the permitted connection destination IP address registered in Table 11b and a MAC address other than the permitted MAC address registered in Table 11b, the communication response determination unit 12a determines whether or not the response packet contains information that can identify the module (step S4).

Here, since the response packet contains the description following Server: Apache as shown in FIG. 6 (a) (for example, 2.4.6 (CentOS) OpenSSL / 1.0.1e-fipsPHP / 7.1.8), the communication response is determined. Unit 12a determines that the response packet contains information that can identify the module.

Next, when the communication response determination unit 12a determines that the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module (step S5).

Here, since the communication response determination unit 12a determines that the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module. Specifically, the communication response control unit 12b tables the information (here, Server: Apache / 2.4.6 (CentOS) OpenSSL / 1.0.1e-fipsPHP / 7.1.8) that can identify the module in the response packet. It is rewritten to the content registered in 11b (here, Apache, see FIG. 3) (see FIG. 6 (b)).

This rewritten response packet is sent to the Internet network NW by the router 10 and delivered to the attacker terminal 30 via the Internet network NW (steps S6 and S7).

In this way, when the response packet contains information that can discriminate the module, the communication response control unit 12b rewrites the information that can discriminate the module into the information that cannot discriminate the module and responds. As a result, even if the module of the router 10 or the IoT device 20 is actually vulnerable, the attacker cannot notice the vulnerabilities and therefore stops the attack.

If the response packet returned by the module (httpd) includes the permitted connection destination IP address registered in table 11b and the permitted MAC address registered in table 11b, the response packet is not rewritten and is not rewritten by the router. It is sent to the Internet network NW by 10 and delivered to an external device via the Internet network NW.

Next, an operation example when the module (Telnetd) returns a response packet will be described.

When the response packet returned by the module (Telnetd) contains an IP address other than the permitted connection destination IP address registered in table 11b and a MAC address other than the permitted MAC address registered in table 11b, the communication response determination unit 12a determines whether or not the response packet contains information that can identify the module (step S4).

For example, when the response packet returned by the module (Telnetd) contains banner information (for example, CentOS release 6.9 (Final)), the communication response determination unit 12a determines that the response packet contains information that can identify the module. Banner information is a typical response of a packet to a communication module.

Next, when the communication response determination unit 12a determines that the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module (step S5).

Here, since the communication response determination unit 12a determines that the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module into the information that cannot identify the module. Specifically, the communication response control unit 12b registers the information (here, CentOS release 6.9 (Final)) that can identify the module in the response packet in the table 11b (here, Xxxx, see FIG. 3). ).

This rewritten response packet is sent to the Internet network NW by the router 10 and delivered to the attacker terminal 30 via the Internet network NW (steps S6 and S7).

In this way, when the response packet contains information that can discriminate the module, the communication response control unit 12b rewrites the information that can discriminate the module into the information that cannot discriminate the module and responds. As a result, even if the module of the router 10 or the IoT device 20 is actually vulnerable, the attacker cannot notice the vulnerabilities and therefore stops the attack.

If the response packet returned by the module (Telnetd) includes the permitted connection destination IP address registered in table 11b and the permitted MAC address registered in table 11b, the response packet is not rewritten and is not rewritten by the router. It is sent to the Internet network NW by 10 and delivered to an external device via the Internet network NW.

As described above, according to the second embodiment, it is possible to make it difficult for the attacker to grasp the vulnerability determination by changing the packet in which the IoT device responds to the investigation packet from the attacker.

This is because when the response packet contains information that can identify the module, the communication response control unit 12b rewrites the information that can identify the module to the information that cannot identify the module and responds.

Further, according to the second embodiment, only the attacker's investigation packet can be tampered with without impairing the normal function.

Next, a modification will be described.

In the second embodiment, an example in which the module is stored in the storage unit 21 of the IoT device 20 has been described, but the present invention is not limited to this. For example, the module may be a module stored in the storage unit 11 of the router 10.

Further, in the second embodiment, an example in which httpd and Telnetd are used as modules has been described, but the present invention is not limited to this. For example, it may be a communication module other than httpd and Telnetd.

Further, in the second embodiment, an example in which the table 11b is provided in the storage unit 11 of the router 10 has been described, but the present invention is not limited to this. For example, as shown in FIG. 7, a table 11b is provided in a cloud server 40 on an Internet network NW, and this table 11b is provided with vulnerability information (for example, https://www.ipa.go.jp/) that is updated daily. The operator may update as appropriate based on security / announce / alert.html). FIG. 7 is an example in which the table 11b is provided on the cloud server 40 on the Internet network NW. By doing this, it is possible to always return the latest version information.

If the IP address or MAC address of the attacker terminal 30 is known, the IP address or MAC address of the attacker terminal 30 is stored in the router 10 table (see FIG. 8), and this table is referred to. By doing so, the router 10 (for example, the communication information determination unit) may make a determination and block the investigation packet. FIG. 8 is an example of the IP address and MAC address of the attacker terminal 30. By providing this table (IP address and MAC address of the attacker terminal 30) on the cloud server 40 on the Internet network NW and updating this table (IP address and MAC address of the attacker terminal 30) on a daily basis. It is possible to block investigation packets from attackers based on the latest information at all times.

In the first and second embodiments, the program is stored using various types of non-transitory computer readable medium and can be supplied to the computer. Non-temporary computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), optomagnetic recording media (eg, optomagnetic disks), CD-ROMs (Read Only Memory), CD-Rs. Includes CD-R / W, semiconductor memory (eg, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). The program may also be supplied to the computer by various types of transient computer readable medium. Examples of temporary computer readable media include electrical, optical, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

All the numerical values shown in the above embodiments are examples, and it goes without saying that appropriate numerical values different from these can be used.

The above embodiments are merely exemplary in all respects. The present invention is not limitedly construed by the description of the above embodiment. The present invention can be practiced in various other forms without departing from its spirit or key features.

1 ... Communication system 10 ... Gateway device (router)
11 ... Storage unit 11a ... Program 11b ... Table 12 ... Control unit 12a ... Communication response determination unit 12b ... Communication response control unit 13 ... Memory 14 ... Communication unit 20 ... IoT device 21 ... Storage unit 21b ... Web server program 22 ... Control unit 23 ... Memory 24 ... IoT device body 30 ... Attacker terminal 40 ... Cloud server HNW ... Home network NW ... Internet network

Claims (9)

A communication response determination unit that determines whether or not a response packet to a packet transmitted from an external device contains information that can identify a module.
A gateway device including a communication response control unit that rewrites information that can discriminate the module into information that cannot discriminate the module when the communication response determination unit determines that the response packet contains information that can discriminate the module. The packet is a packet addressed to a communication device connected to the gateway device.
The gateway device according to claim 1, wherein the response packet is a packet addressed to the external device transmitted from the communication device. The packet is a packet addressed to the gateway device, and is a packet addressed to the gateway device.
The gateway device according to claim 1, wherein the response packet is a packet addressed to the external device transmitted from the gateway device. It also has a table that registers the contents to rewrite the information that can identify the module.
The gateway device according to any one of claims 1 to 3, wherein the communication response control unit rewrites the information that can identify the module into the contents registered in the table. In the table, the contents for rewriting the information that can identify the module, the permitted connection destination IP address, and the permitted MAC address are registered in association with each other.
When the response packet contains an IP address other than the permitted connection destination IP address and a MAC address other than the permitted MAC address, the communication response control unit converts the information that can identify the module into the information that cannot identify the module. The gateway device according to claim 4, which is rewritten. The gateway device according to claim 5, wherein the table is provided in a cloud server on an Internet network. A gateway device and a communication device connected to the gateway device are provided.
The gateway device is a device that relays packets sent and received between the external device and the communication device.
A communication response determination unit that determines whether or not a response packet from the communication device to a packet transmitted from the external device contains information that can identify a module.
A communication system including a communication response control unit that rewrites information that can discriminate the module into information that cannot discriminate the module when the communication response determination unit determines that the response packet contains information that can discriminate the module. A step to determine whether the response packet to the packet sent from the external device contains information that can identify the module, and
A communication method comprising: when it is determined that the response packet contains information that can discriminate the module, the step of rewriting the information that can discriminate the module to the information that cannot discriminate the module. Processing to determine whether the response packet to the packet sent from the external device contains information that can identify the module, and
A program for causing a computer to perform a process of rewriting information that can discriminate the module into information that cannot discriminate the module when it is determined that the response packet contains information that can discriminate the module.

Images