JP3928866B2 - DoS attack source detection method, DoS attack prevention method, session control device, router control device, program, and recording medium thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention is a bearer / control separation type network in which an IP network is a core network, and mechanically continuously services and the like to a session control apparatus (CA: Control Agent) that manages session control from a certain attack source such as a terminal. The present invention relates to a countermeasure technology against a so-called DoS (Denial of Service) attack and a cyber terrorism prevention technology that cause a high load on the CA by requesting the service and disable the services of terminals other than the attack source.
[0002]
[Prior art]
In recent years, a bearer / control separated network having an IP network as a core network has been proposed. The IP network is a core network, the control network is configured by a CA that performs session control and terminal control, transmission and reception of control signals between terminals is always performed via the CA, and the bearer network is a subscriber router that accommodates terminals, This is a system that comprises a relay router that relays bearer signals such as voice or images between terminals, and transmits and receives bearer signals between terminals after session establishment via a bearer network without going through a CA. Here, the case of VoIP (Voice Over IP) is taken as an example. The case where image communication is performed between terminals by CA session control is the same as that of VoIP.
[0003]
In a bearer / control (call control in VoIP) separation type network, call processing control capability of terminals other than the attack source by CA by continuously sending a large number of packets from the attack source such as a specific terminal to CA. The countermeasures for the act of making the system impossible (DoS attack) are roughly classified into a method for detecting the DoS attack source and a method for regulating the DoS attack source.
[0004]
Regarding a method for detecting a DoS attack source, conventionally, one type of counter that counts the number of call signals or the number of terminal registration signals per unit time per terminal in a CA is used. Has been proposed (see Non-Patent Document 1, for example). In the case of this method, a DoS attack (single DoS attack) from a single attack source can be detected, but in the case of a DDoS attack (DistributedDoS attack) in which a DoS attack is performed from a plurality of attack sources, the transmission frequency per attack source is below a threshold value. In this case, even if the transmission frequency of the entire attack source is greater than or equal to the threshold, it cannot be detected. Also, since the DDoS attack is difficult to distinguish from the case of access concentration due to events (eg, ticket reservation for popular events) and the DDoS attack, all users accessing for the event may be regarded as the DDoS attack source. There is.
[0005]
Furthermore, conventionally, there is no counter for detecting a DS attack caused by a signal having an abnormal signal format or parameter, and thus such an attack cannot be detected.
[0006]
On the other hand, as a method for restricting a DoS attack source, a method has been proposed in which a DoS attack is detected by a firewall and a packet is discarded before the packet enters the CA (see, for example, Non-Patent Document 2). However, since the firewall discards the signal without looking at the contents of the signal, if the signal in the middle of the call connection is discarded, the connection process may not be completed completely by the CA, and there is a risk of causing a memory leak.
[0007]
[Non-Patent Document 1]
Naohiro Terayama, 1 other person, "Congestion control method when providing IP telephony",
IEICE Network System Technical Report,
NS2001-142, p. 7-12, issued on November 14, 2001 [Non-Patent Document 2]
NTT Communications News Release, OCN ADSL service (A) offering “Personal Firewall Service” on July 24, 2002, Internet <URL: http://www.ntt.com/release/2002NEWS/0007 / 0724 .html>
[0008]
[Problems to be solved by the invention]
It is an object of the present invention to distinguish between access concentration due to an event and a DDoS attack by CA in a bearer / control separation type network having an IP network as a core network, and to detect only a DDoS attack and a format or parameter is abnormal. An object of the present invention is to provide a method of detecting a DoS attack source by an illegal signal, its CA, a program, and a recording medium.
[0009]
Another object of the present invention is to prevent DoS attack packets from entering the CA and cause a memory leak in the CA in a bearer / control separation type network with the IP network as the core network. There is no regulation method, its router OpS and CA, as well as a program and a recording medium.
[0010]
[Means for Solving the Problems]
In the present invention, a CA detects a DoS attack from a single attack source (Single DoS counter), a counter detects a DoS attack from multiple attack sources (DDoS counter), and an illegal signal whose format or parameter is abnormal. Three illegal signal counters for detecting a DoS attack are installed, and the DDoS counter is characterized in that the monitoring period is longer than that of the Single DoS counter and the threshold value is set lower than that of the Single DoS counter. This feature makes it possible to cope with various types of DoS attacks.
[0011]
Although the detection function is partially degenerated, the illegal signal counter may be omitted in some cases, or the amount of calls for counting the total number of calls per unit time entering the illegal signal counter, the Single DoS counter, and the CA. A combination with a counter is also possible.
[0012]
Further, the present invention protects the CA by applying a call volume restriction (a restriction that limits the total number of calls entering the CA per unit time) until a DDoS attack is detected by the DDoS counter. The target signal is limited to a registration signal for a service and / or a service start request signal in a service provided by a CA (server). This feature makes it possible to protect the CA and avoid packet discard during the service.
[0013]
In addition, after detecting a DoS attack using the Single DoS counter, the DDoS counter, and the illegal signal counter, the present invention not only performs lockout processing at the CA, but also stores the attack source IP address information. The subscriber router is notified, and the subscriber router performs IP address filtering (regulation for discarding packets from the corresponding IP address). This feature can prevent a DoS attack packet from entering the CA.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the following, the case of voice service (VoIP) will be described as an example, but the same applies to the case where image communication is performed between terminals by CA session control.
[0015]
<Network configuration>
FIG. 1 is a conceptual diagram of a bearer / control separation type network in which an IP network premised on the present invention is a core network. As described above, in the bearer / control (call control in VoIP) separation type network in which the IP network is a core network, the control network 1 is a session control device (CA: Control Agent) that performs session control / terminal control. 10, transmission / reception of control signals between the terminals 11 and 12 is always performed via the CA 10. On the other hand, the bearer network 2 includes subscriber routers 13 and 14 that accommodate terminals 11 and 12 and relay routers 15 and 16 that relay bearer signals (voice signals in VoIP). The bearer signal is transmitted and received via the bearer network 2 without using the CA 10.
[0016]
In such a bearer / control separation type network with the IP network as a core network, the CA 10 that controls the session mechanically requests a service or the like continuously from an attack source such as a single or a plurality of terminals. In this case, the CA 10 becomes heavily loaded, and service control (session control processing) of the terminals 11 and 12 other than the attack source becomes impossible.
[0017]
Hereinafter, specific embodiments of the DoS attack source detection method and the DoS attack prevention method according to the present invention will be described in detail.
[0018]
<DoS attack source detection>
FIG. 2 is a configuration diagram of an embodiment of the session control apparatus (CA) according to the present invention, and particularly shows only a part related to DoS attack detection. In FIG. 2, an illegal signal counter 101 is a fourth counter for detecting a DoS attack due to an illegal signal having an abnormal format or parameter, and a DoS counter 102 is a first counter for detecting a DoS attack from a single attack source. (Single DoS counter), the call volume counter 103 is a second counter for counting the total number of calls per unit time entering the CA 10, and the DDoS counter 104 is a third counter for detecting DoS attacks from a plurality of attack sources. It is a counter (Distributed DoS counter). Here, the illegal signal counter 101, the DoS counter 102, and the DDoS counter 104 are prepared for each IP address. Further, when the monitoring period of the DoS counter 102 is t ₁ , the threshold is v1, the monitoring period of the DDoS counter 104 is t ₂ , and the threshold is v2, t ₁ <t ₂ and v1> v2 are set.
[0019]
The signal format / parameter check unit 105 is a processing unit that checks the format and parameters of a signal that has entered the CA 10. The packet discard unit 106 is a processing unit that discards a corresponding illegal packet to an IP address whose illegal signal counter 101 is equal to or less than a predetermined threshold. The call volume restriction processing unit 107 is a processing unit that performs call volume restriction (limits the total number of session establishment request signals and the like) when the call volume counter 103 is equal to or greater than a predetermined threshold. The lockout processing unit 108 is a processing unit that locks out the IP address of any one of the illegal signal counter 101, the DoS counter 102, and the DDoS counter 104 for an IP address that is equal to or greater than a predetermined threshold value. The IP address notifying unit 109 is a processing unit that notifies a corresponding IP address to a router control device (router OpS) described later. The call processing unit 110 is a processing unit that executes predetermined processing for a regular call.
[0020]
The operations of the counters 101 to 104 and the processing units 105 to 110 are controlled by the control unit 100.
[0021]
FIG. 3 is a processing flowchart of DoS attack detection in CA. The operation in the CA of the configuration example of FIG. 2 will be described below with reference to FIG.
[0022]
All signals including regular calls and DoS attack calls that have entered the CA 10 are first subjected to signal format and parameter checks by the signal format / parameter check unit 105 (S11, S12). In the case of NG, the unauthorized signal counter 101 counts the number of unauthorized signals per unit time for each IP address (S18). Here, if it is above a certain threshold value, it is regarded as a DoS attack by an unauthorized signal, the lockout processing unit 108 performs lockout processing for the corresponding IP address, and the IP address notification unit 109 sets the corresponding IP address to an external device ( For example, it notifies the router OpS (described later) (S19, S20). If it is less than or equal to the threshold value, only the corresponding packet is discarded (S19, S21).
[0023]
On the other hand, if the signal format / parameter check unit 105 is OK, the DoS counter 102 makes a call signal per unit time (INVITE signal in the case of SIP) or a terminal registration signal (in the case of SIP, a REGISTER signal) for each IP address. ) Is counted (S13). Here, if the IP address is greater than or equal to the threshold value, it is regarded as a DoS attack from a single attack source, the lockout processing unit 108 performs lockout and processing for the corresponding IP address, and the IP address notification unit 109 performs the corresponding IP address. To the external device (S14, S20).
[0024]
When the count value of the DoS counter 102 is equal to or less than the threshold value for each IP address, the call volume counter 103 counts the total number of calls per unit time entering the CA 10 (in the case of SIP, the number of INVITEs or REGISTERs) (S15). . Here, if it is below the threshold value, the call processing unit 110 executes predetermined call processing (S16, S17).
[0025]
On the other hand, when the call volume counter 103 is equal to or greater than the threshold, the DDoS counter 104 and the call volume restriction processing unit 107 are activated simultaneously. The call volume regulation processing unit 107 starts regulating the call volume of the CA 10 and prevents congestion (S22). The DDoS counter 104 has a longer monitoring period than the DoS counter 102 and a low threshold value (a value when continuous transmission is performed at a short transmission interval so as not to be used for call and terminal registration) for each IP address. The number of call signals or terminal registration signals per unit time is counted (S23). For example, if the threshold of the DoS counter 102 is 50 INVITE / s, the threshold of the DDoS counter 104 is 30 INVITE / 30s.
[0026]
Here, when the DDoS counter 104 is equal to or smaller than the threshold value, the call amount rule in the call amount rule processing unit 107 is continued as it is (S24, S22). On the other hand, if there is an IP address whose DDoS counter 104 is equal to or greater than the threshold, it is regarded as a DoS attack from a plurality of attack sources, the call volume rule is canceled (S24, S25), and the process proceeds to step S20. As described above, in step S20, the lockout processing unit 108 performs lockout processing for the corresponding IP address, and the IP address notification unit 109 sends the corresponding address to an external device (for example, a router OpS described later). Notice.
[0027]
<DoS attack prevention>
FIG. 4 is a conceptual diagram of an embodiment of the DoS attack prevention method according to the present invention, and FIG. 5 is an operation sequence diagram. Hereinafter, the operation of an embodiment of the DoS attack prevention method according to the present invention will be described with reference to FIGS. In FIG. 4 and FIG. 5, the relay router is omitted.
[0028]
When the user terminal accesses and authenticates the subscriber router, the authentication server 20 collects the IP address information of the user terminal and the IP address information of the subscriber router. The router control device (router OpS) 30 generally manages maintenance control of subscriber routers and relay routers. Here, the DoS attack terminal (31 in FIG. 4) detected by the CA 10 from the session control device (CA) 10. 32, 33) upon receiving the notification of the IP address information, the authentication server 20 is accessed, and the IP of the subscriber router (34, 35, 36 in FIG. 4) accommodating it from the IP address information of the DoS attack terminal. The address is searched, and for the corresponding subscriber router 34, 35, 36,
An IP address filtering command for restricting packets from the DoS attack terminal (strictly, the IP address of the DoS attack terminal) is distributed. When the subscriber routers 34, 35, 36 receive the regulation command from the router OpS 30, the subscriber routers 34, 35, 36 implement IP filtering regulation that regulates packets from the corresponding DoS attack terminals 34, 35, 36.
[0029]
As described above, when a DoS attack is detected by CA 10, first, CA 10 performs a lockout process for the attack source. As a result, even if a call signal or a terminal registration signal enters the CA 10 from the DoS attack source, the CA 10 is not processed, so the load on the CA 10 is reduced. However, at this time, the load for discarding packets from the DoS attack source remains.
[0030]
Next, the CA 10 notifies the router OpS 30 of the IP address information of the attack source. In the router OpS 30, the IP address of the subscriber router that accommodates the attack source is retrieved from the IP address information of the attack source using the authentication server 20. The router OpS 30 applies an IP filtering restriction command for restricting packets from the attack source to the subscriber router, and the subscriber router executes DoS attack source IP filtering restriction. This prevents the DoS attack packet from entering the CA.
[0031]
FIG. 6 is a block diagram of an embodiment of the router control device (router OpS) 30 according to the present invention. This router OpS 30 uses the CA notification receiving unit 301 that receives the IP address of the DoS attack source such as the DoS attack terminal from the CA, and the authentication server 20 to search for the IP address of the subscriber router that accommodates the DoS attack source. The server search unit 302 includes a restriction command distribution unit 303 that distributes restriction commands to subscriber routers as search results, and a control unit 300 that controls operations of these units 301, 302, and 303. Note that the router OpS 30 also includes original processing means for router maintenance or the like, but is omitted here.
[0032]
FIG. 7 is a process flowchart of the router OpS30. When the CA notification receiving unit 301 receives an IP address of a DoS attack source such as a DoS attack terminal from the CA 10 (S31), the authentication server search unit 302 is activated. The authentication server search unit 302 transmits the IP address of the DoS attack source to the authentication server 20, requests the IP address search of the subscriber router that accommodates the DoS attack source terminal, and the like as a response. Correspondence between the IP address of the DoS attack source and the IP address of the corresponding subscriber router is acquired from the authentication server 20 (S32). The restriction command distribution unit 303 is an IP filtering restriction command for restricting a packet from a DoS attack source terminal to the subscriber router based on the subscriber router IP address of the search result by the authentication server search unit 302. Is distributed (S33).
[0033]
In the above-described embodiment, the router OpS 30 receives a notification of the IP address information of the DoS attack source terminal from the CA 10 and issues a command for regulating packets from the DoS attack terminal to the corresponding subscriber router from the router OpS 30. Although it was a distribution method, by implementing the same function as the router OpS30 in the CA 10, the CA 10 directly distributes the restriction command to the subscriber router that accommodates the DoS attack terminal etc. using the authentication server 20. Is possible. FIG. 8 shows an operation sequence diagram of this embodiment.
[0034]
In the case of FIG. 8, when the CA 10 detects a DoS attack, the CA 10 performs a lockout process for the attack source, and also uses the authentication server 20 from the IP address information of the attack source to check the subscriber router that accommodates the attack source. Search for an IP address. Then, the CA 10 itself distributes an IP filtering restriction command for restricting packets from the attack source to the corresponding subscriber router. According to the present embodiment, since the router OpS30 is not interposed, it is possible to regulate packets from the attack source more quickly in the corresponding subscriber router.
[0035]
In the configuration of the CA 10 of this embodiment, the authentication server search unit 302 and the restriction command distribution unit 303 in FIG. 6 may be added to the configuration in FIG. Further, in the processing flow, the “IP address notification” in step S20 in FIG. 3 is eliminated, and steps S32 and S33 in FIG. 7 may be added instead of step S20. To do.
[0036]
In any of the embodiments, if the router OpS 30 or the CA 10 has a correspondence table between the terminal IP address and the subscriber router IP address, the processing for searching the authentication server 20 as described above is unnecessary. is there.
[0037]
The processing functions of some or all of the components in the CA and router OpS shown in FIGS. 2 and 6 can be configured by a computer program, and the program can be executed using the computer to implement the present invention. Alternatively, it goes without saying that the processing procedure shown in FIGS. 3 and 7 can be configured by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.
[0038]
【The invention's effect】
According to the present invention, since long-term monitoring with the DDoS counter shows whether or not continuous transmission is intended for calls and terminal registration, it is possible to distinguish between a DDoS attack and an access concentration due to an event. There is an advantage that only can be detected. In addition, CAs can be provisionally protected from attacks by performing call volume control for attacks received before the detection of a DDoS attack. Next, there is an advantage that a DoS attack by an illegal signal with an abnormal format or parameter can be detected by installing an illegal signal counter.
[0039]
Also, according to the present invention, the CA can be protected from a DoS attack without causing a memory leak by performing a lockout first with the CA. However, at this point, the CA packet discard processing load remains, but by applying IP filtering restriction based on the IP address information of the attack source detected by the CA in the subscriber router, the packet from the attack source enters the CA. Since CA does not come, there is an advantage that CA can be released from the load of packet discard processing. Since only the attack source packet is discarded, other users can perform VoIP without being affected by the DoS attack.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram of a bearer / control separation type network assumed in the present invention.
FIG. 2 is a configuration diagram of an embodiment of a session control apparatus (CA) that realizes the DoS attack source detection method of the present invention.
FIG. 3 is a processing flowchart of CA in FIG. 2;
FIG. 4 is a conceptual diagram of an embodiment of a DoS attack prevention method according to the present invention.
FIG. 5 is an operation sequence diagram of the embodiment of FIG. 4;
FIG. 6 is a configuration diagram of an embodiment of a router control device (router OpS) for realizing the DoS attack prevention method of the present invention.
7 is a processing flowchart of the router OpS of FIG. 6;
FIG. 8 is an operation sequence diagram of another embodiment of the DoS attack prevention method according to the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Control network 2 Bearer network 10 Session control apparatus (CA)
11, 12 Terminals 13, 14, 34, 35, 36 Subscriber routers 15, 16 Relay router 20 Authentication router 30 Router control device (router OpS)
31, 32, 33 DoS attack terminal 100 Control unit 101 Unauthorized signal counter 102 DoS counter 103 Call volume counter 104 DDoS counter 105 Signal format / parameter check unit 106 Packet discard unit 107 Call volume restriction processing unit 108 Lockout processing unit 109 IP address notification Unit 110 call processing unit 300 control unit 301 CA notification reception unit 302 authentication server search unit 303 restriction command distribution unit

Claims (15)

In a bearer / control-separated type network with the IP network as the core network, attacking the session control device (hereinafter referred to as CA) that controls the session mechanically continuously from a certain attack source to increase the load on the CA A DoS attack source detection method in a DoS (Denial of Service) attack that disables session control processing of terminals other than the original terminal,
Counting the number of terminal registration signals and / or session establishment request signals for a predetermined monitoring period for each IP address for the CA by a first counter;
Counting the number of terminal registration signals or / and session establishment request signals for the CA with a second counter, and starting a third counter when a predetermined threshold is exceeded during a predetermined monitoring period;
Counting the number of terminal registration signals and / or session establishment request signals for a predetermined monitoring period longer than the monitoring period of the first counter for each IP address for the CA by the third counter;
Determining an IP address source that is equal to or greater than a threshold value in any one of the first counter and the third counter (where the threshold value of the first counter> the threshold value of the third counter) as a DoS attack source;
A DoS attack source detection method characterized by comprising: The DoS attack source detection method according to claim 1,
The DoS attack source detection method further comprising the step of limiting the total number of session establishment request signals from when the third counter is activated until a DoS attack source is detected. D according to claim 1 or 2 o In the S attack source detection method,
A step of counting by a fourth counter the number of signals in which the format or parameter check of the predetermined monitoring period for each IP address for the CA is invalid,
The IP address source that has exceeded the threshold value in any of the first counter, the third counter, and the fourth counter is D o D characterized by being determined as an S attack source o S attack source detection method. In a bearer / control-separated network with the IP network as the core network, the CA continuously increases the load by mechanically transmitting to a CA, making session control processing for terminals other than the attack source impossible. D o D in S attack o S attack source detection method,
Checking the terminal registration signal or session probability request signal format and parameter anomaly input to the CA; and
If no abnormality is detected in the check, counting a terminal registration signal or / and a session probability request signal number in a predetermined monitoring period for each IP address for the CA by a first counter;
Counting the number of terminal registration signals or / and session probability request signals for the CA with a second counter when the count value of the first counter is less than or equal to a predetermined threshold for each IP address;
When an abnormality is detected in the check, a step of counting the number of illegal signals in which the format and parameters of the predetermined monitoring period for each IP address for the CA are abnormal by a fourth counter;
Executing a predetermined call process if the count value of the second counter is equal to or less than a predetermined threshold value during a predetermined monitoring period, and limiting the total number of session probability request signals when the threshold value is exceeded;
If the count value of the fourth counter is less than or equal to a predetermined threshold, discarding the unauthorized terminal registration signal or / and session establishment request signal packet;
When the count value in either the first counter or the fourth counter is equal to or greater than the threshold, the IP address source that is equal to or greater than the threshold is determined as the Dos attack source, and lockout processing is performed on the IP address. Steps to do,
D characterized by having o S attack source detection method.   A session control apparatus comprising a function for realizing the DoS attack source detection method according to any one of claims 1 to 4.   The program for performing the function of the session control apparatus of Claim 5 with a computer.   A recording medium recording a program for executing the function of the session control device according to claim 5 on a computer. When a DoS attack is detected in the DoS attack source detection method according to any one of claims 1 to 4,
The service for which the CA is in session control continues processing, lockout processing for rejecting a new session connection request or terminal registration request by discarding the packet, and the IP address information of the DoS attack source is obtained from the router control device (hereinafter, referred to as “CA”). The router OpS),
The router OpS selects a subscriber router accommodating the DoS attack source from the IP address information, and distributes a filtering restriction command for discarding a packet from the DoS attack source to the subscriber router;
Said subscriber router discarding a packet from a DoS attack source according to a filtering restriction command;
A DoS attack prevention method comprising:   A router control device comprising a function for realizing the DoS attack prevention method according to claim 8.   The program for performing the function of the router control apparatus of Claim 9 with a computer.   The recording medium which recorded the program for performing the function of the router control apparatus of Claim 9 with a computer. When a DoS attack is detected in the DoS attack source detection method according to any one of claims 1 to 4,
The CA continues to process the service under session control, performs a lockout process to reject a new session connection request or terminal registration request by discarding the packet, and accommodates the DoS attack source from the IP address information of the DoS attack source. Distributing a filtering restriction command for discarding a packet from a DoS attack source to the subscriber router;
Said subscriber router discarding a packet from a DoS attack source according to a filtering restriction command;
A DoS attack prevention method comprising:   A session control apparatus comprising a function for realizing the DoS attack prevention method according to claim 12.   A program for realizing the function of the session control device according to claim 13 by a computer.   A recording medium storing a program for realizing the function of the session control device according to claim 13 by a computer.

Images