JP4137948B2 - Packet passage control apparatus and packet passage control method - Google Patents

Description

  The present invention relates to a packet passage control apparatus and a packet passage control method using an SPI (Stateful Packet Inspection) technique that is a function of a firewall, a router, or the like.

SPI exists as a technique for reading the data of a packet passing through a firewall, determining the contents, and dynamically opening / closing a port. This technique is usually processed by a central processing unit such as a CPU using software. Non-patent document 1 is disclosed as a conventional SPI technology.
“2nd: Difference between SPI and dynamic packet filtering”, “online”, “Search on 03rd August 2005”, Internet <URL: http://www.itmedia.co.jp/broadband/0305/ 16 / lp13.html>

  However, the processing amount of this SPI is different from the process of simply determining whether packets can be passed or discarded based on the set filtering information, and determines the return packet of the detected packet and dynamically opens the port for that packet. This increases the amount of processing that occurs, causing a load on the central processing unit. Therefore, there has been a problem that it is more susceptible to a DoS (Denial of Service) attack that increases the processing load by sending a large amount of packets to a firewall or the like.

  Therefore, an object of the present invention is to provide a packet passage control device and a packet passage control method that can reduce the SPI processing in the central processing unit.

  In order to achieve the above object, the present invention comprises a central processing unit and a packet passage control unit, and controls whether or not to allow a packet received from one communication network path to pass through the other communication network path. A passage control device, comprising: a filtering table that holds first filtering information indicating a control type for permitting or discarding the packet and a communication type indicating a filter rule conformity determination condition for the packet; Read the first filtering, and if the first filtering indicates the passage permission, rewrite the information to the central processing transfer and register it in the filtering storage unit of the packet passage control unit. 1 filtering registration means, and when receiving a packet, the communication type and control type of the packet A central processing unit transfer means of the packet passage control unit for transferring at least the communication type of the received packet to the central processing unit when the first filtering registered in the filtering storage unit is matched. And the passage permission of both the passage of the received packet from the one communication network path to the other communication network path and the passage from the other communication network path to the one communication network path. Each of the second filtering information is preferentially registered in the filtering storage unit as information having a higher filter rule priority than the first filtering information, and the second filtering information registration unit of the central processing unit receives the second filtering information. For a series of packet processing related to packets, Whether to match the second filtering information registered in the filtering storage unit is determined in order of priority, and if it matches, the packet passing is performed without going through the central processing unit A packet passage control device comprising: passage processing means of a control unit.

  In the present invention, the central processing unit transfer means transfers the final packet received in a series of packet processing related to the received packet to the central processing unit, and the central processing unit transfers the final packet. It is characterized by comprising second filtering deleting means for receiving the packet and deleting the second filtering information from the filtering storage unit.

  Further, the present invention provides a time measuring means for measuring an elapsed time from the reception time of the last packet that matches the second filtering information registered in the filtering storage unit, and when the elapsed time becomes a predetermined time, Second filtering deletion means for deleting second filtering information from the filtering storage unit.

  In addition, according to the present invention, information that can be stored in the filtering storage unit by an increase in registration of the second filtering information in the filtering storage unit, so that the amount of information including the second filtering information and the first filtering information is stored in the filtering storage unit. Third filtering registration means for registering, in the filtering storage unit, third filtering information indicating a control type of central processing transfer for all communication type packets as filtering information having the lowest priority when exceeding the amount; And filtering adjusting means for deleting the first filtering information stored in the filtering storage unit in order from the lowest priority information.

  Further, according to the present invention, the amount of information of the second filtering information can be stored in the filtering storage unit by increasing the registration of the second filtering information in the filtering storage unit. When exceeding, it deletes in order from information with a low priority among the said 2nd filtering information memorize | stored in the said filtering memory | storage part, It is characterized by the above-mentioned.

  The present invention also provides a packet passing control in a packet passing control device that includes a central processing unit and a packet passing control unit, and controls whether or not a packet received from one communication network path is passed to the other communication network path. A first filtering registration unit of the central processing unit, wherein the first filtering registration unit indicates a control type of any one of the packet pass permission, discard, and central processing transfer and a communication type of the packet. Read the first filtering from the filtering table holding the information, and if the first filtering indicates the passage permission, rewrite the information to the central processing transfer and register it in the filtering storage unit of the packet passage control unit The central processing unit transfer means of the packet passage control unit receives the packet. When the communication type and control type of the packet match the first filtering registered in the filtering storage unit, at least the communication type of the received packet is transferred to the central processing unit. The second filtering information registering means of the central processing unit passes the received packet from the one communication network path to the other communication network path, and the one communication from the other communication network path. Each of the second filtering information indicating permission to pass both through the network path is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information, and passes through the packet passage control unit. A processing means is a series of packet processing related to the received packet. Next, whether or not the second filtering information registered in the filtering storage unit matches is determined in order of priority, and if they match, the passing process is performed without going through the central processing unit. Is a packet passage control method characterized by the above.

  In the present invention, the central processing unit transfer means of the packet passage control unit transfers the final packet received in a series of packet processing related to the received packet to the central processing unit, and The second filtering deleting means of the processing unit deletes the second filtering information from the filtering storage unit by receiving the final packet.

  In the present invention, the time measurement means measures the elapsed time from the reception time of the last packet that matches the second filtering information registered in the filtering storage section, and the second filtering deletion means of the central processing section The second filtering information is deleted from the filtering storage unit when the elapsed time reaches a predetermined time.

  In the present invention, the third filtering registration unit increases the registration of the second filtering information in the filtering storage unit, so that an information amount including the second filtering information and the first filtering information is When the amount of information that can be stored in the filtering storage unit is exceeded, the third filtering information indicating the control type of central processing transfer is registered in the filtering storage unit as the lowest priority filtering information for all communication type packets. And a filtering adjustment means deletes in order from information with a low priority among said 1st filtering information memorize | stored in the said filtering memory | storage part.

  Further, according to the present invention, the amount of information of the second filtering information can be stored in the filtering storage unit by increasing the registration of the second filtering information in the filtering storage unit. When exceeding, it deletes in order from information with a low priority among the said 2nd filtering information memorize | stored in the said filtering memory | storage part, It is characterized by the above-mentioned.

Conventionally, all processing of packet filtering has been performed by a central processing unit such as a CPU, so the load on the packet filtering processing of the central processing unit is large. According to the present invention, the passage processing means, the filtering storage unit, etc. For example, the packet passing control unit having the above is collectively configured as one chip, and the packet filtering process is entrusted to the passing processing unit, so that the CPU processing can be reduced.
In addition, when the packet passage control unit is configured as a single chip, when the packet processing is performed by the passage processing unit, the limited data capacity of the filtering storage unit is dynamically increased. Adjustment with the process in the central processing unit when the data amount of the generated second filtering information exceeds can be performed.

  Hereinafter, a packet passing control apparatus according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a packet passage control apparatus according to the embodiment. In this figure, reference numeral 1 denotes a packet passage control device, which is incorporated in, for example, a firewall or a router. In the packet passing control device 1, reference numeral 11 denotes a WAN side I / F (interface), and 12 denotes a LAN side I / F (interface). Reference numeral 13 denotes a filtering processing unit (central processing unit transfer means, passage processing means), which performs at least packet passing, discarding, and CPU transfer processing. The filtering storage unit 14 is a storage unit in which filtering information is recorded.

  Filtering information includes packet communication type <communication service (services such as TCP, UDP, HTTP, and FTP), flag type (SYN, FIN, etc.), destination IP address, destination port number, source IP address, source port Information indicating a filter rule conformity determination condition> such as a number and control type information of passing, discarding, and CPU transfer are held, and the filtering processing unit 13 performs a filtering process based on the filtering information. . Reference numeral 15 denotes a central processing interface (CPU / IF), which performs processing for receiving information transmitted to the CPU (central processing unit). The I / F 11, I / F 12, filtering processing unit 13, filtering storage unit 14, and central processing interface 15 are, for example, a single chip as a packet passage control circuit configured with semiconductor elements in order to increase the speed of transfer processing. The circuit configuration is collectively.

  Reference numeral 16 denotes a CPU (first filtering registration means, second filtering information registration means, time measurement means, second filtering deletion means, third filtering registration means, filtering adjustment means). The CPU 16 receives in advance SPI processing such as receiving from the packet passage control circuit a packet that has been excluded from the filtering processing mainly performed by the filtering processing unit 13 (that is, transferred to the CPU) and detecting a transfer destination for the received frame. Based on software that runs on. Reference numeral 17 denotes a table storage unit (filtering table), which stores filtering information registered by a user such as a network administrator. Then, when performing the SPI processing, the CPU 16 performs filtering processing of only the packet information received from the filtering processing unit 13 via the central processing interface 15 based on the filtering information recorded in the table storage unit 17. To do.

Next, the configuration of the filtering storage unit will be described.
FIG. 2 is a diagram illustrating the configuration of the filtering storage unit.
As shown in this figure, the filtering storage unit 14 records three types of filtering information including a CPU transfer candidate entry, an SPI entry, and a filter entry. The CPU transfer candidate entry is filtering information about a specific packet that is determined in advance to be transferred to the CPU 16. For example, the CPU transfer candidate entry is filtering information about a packet that is processed by the own device without being transferred to another device, such as an ARP packet. is there. The SPI entry is filtering information dynamically generated by the CPU 16. For example, when the HTTP connection from the A device in the internal network to the B device in the external network is permitted, Filtering information indicating the passage of an HTTP connection in the communication direction from the B device to the A device, which is dynamically generated so that a reply packet from the device to the A device can pass. The filter entry is recorded in advance in the table storage unit 17 by the user registration work, and is automatically written by the CPU 16 when the packet passage control device 1 is activated. The filter entry detects the packet (SYN) transmitted at the beginning of one session. In the figure, priorities are given in the order of a CPU transfer candidate entry, an SPI entry, and a filter entry. The priority is a priority order for determining whether or not packets received as SPI processing match.

FIG. 3 is a diagram showing the configuration of the filtering information registration status table and the filtering storage unit.
Next, the first registration process of filtering information will be described.
When the packet passing control device 1 is activated or when an instruction to initialize the filtering information registration status table held by the CPU 16 is received, the CPU 16 first reads the filtering information from the table storage unit 17. This filtering information is the filtering information of the CPU transfer candidate entry and the filter entry shown in FIG. The filtering information registration status table is a table for storing filtering information registered in the filtering storage unit 14 by the CPU 16. Then, the CPU 16 registers the filtering information (CPU transfer candidate entry and filter entry) read from the table storage unit 17 in the filtering storage unit 14 at the time of starting and initialization. In this registration, information whose control type is “pass” in the filter entry is rewritten as “CPU transfer” and registered.

  The CPU 16 also performs registration processing for filtering information that is an SPI entry. As described above, this SPI entry is filtering information dynamically generated by the CPU 16 based on a packet received at the first time of a session when the packet passing control device 1 starts the filtering process and operates. Yes, when this generation is performed, the CPU 16 registers the SPI entry between the CPU transfer candidate entry and the filter entry. That is, the CPU transfer candidate entry is registered with the highest priority in the filtering information, the SPI entry is registered with the next highest priority, and the filter entry is registered as the filtering information with the lowest priority. For the filtering information registered in the filtering storage unit 14, the CPU 16 writes and stores a flag indicating whether or not the filtering information is registered in the filtering information registration status table. The order of priority is also written and stored in the filtering information registration status table.

FIG. 4 is a diagram showing an outline of the processing flow of the packet passage control device.
FIG. 5 is a table showing packets received by the packet passage control apparatus and SPI entries dynamically generated based on the reception of the packets.
Next, the processing flow of the packet passing control device will be described with reference to FIGS.
First, the CPU 16 reads the filtering information of the CPU transfer candidate entry and the filter entry from the packet passing control device table storage unit 17 when receiving an initialization instruction or at the time of activation, and sends the filtering information to the filtering storage unit 14 via the CPU / IF 15. And register. At this time, the CPU transfer candidate entry is registered with a higher priority, and the filter entry is registered with a lower priority for applying the filter rule than the CPU transfer candidate entry. Then, the CPU 16 records the priority order in the filtering information registration status table. If the control type is pass, the filter entry is rewritten as CPU transfer and registered.

  When the registration of the first filtering information is completed, packet filtering processing accompanied by SPI processing is started. In this situation, it is assumed that the packet A is received by the LAN side I / F 12 (step S1). As shown in FIG. 5, in the packet A, the reception logic I / F is I / F (LAN) 12, the transmission logic I / F is I / F (WAN) 11, and the source IP address (S-IP) is IP- x, the destination IP address (D-IP) is IP-y, the source port number (S-Port) is Port-x, the destination port number (D-Port) is Port-y, and the TCP flag is SYN. is there.

  When receiving the packet A, the filtering processing unit 13 next refers to the filtering information recorded in the filtering storage unit 14 in descending order of priority, and receives the communication type of the received packet A (communication service, flag type, The destination IP address, destination port number, source IP address, source port number, etc.) are compared to determine whether there is filtering information matching packet A. If it is determined that the filter entry recorded in the filtering storage unit 14 has an entry that matches the communication type of the packet A, the control type is CPU transfer (when the control type of the filter entry is passing). Is rewritten at the time of registration and all are transferred to the CPU), and the packet A is transferred to the CPU 16 (step S2).

  When receiving the packet A, the CPU 16 starts a process of generating an SPI entry related to the packet A. At this time, the CPU 16 generates an SPI entry (1) and an SPI entry (2) as shown in FIG. In the SPI entry (1), the reception logic I / F is I / F (WAN) 11, the transmission logic I / F is I / F (LAN) 12, the source IP address (S-IP) is IP-y, and the destination Pass the packet whose IP address (D-IP) is IP-x, source port number (S-Port) is Port-y, destination port number (D-Port) is Port-x, and all TCP flags Filtering information to be passed. That is, the SPI entry (1) is filtering information for a packet passing from the I / F 11 to the I / F 12 among other packets in the session in which the packet A is the first session (SYN).

  The SPI entry (2) has a reception logic I / F of I / F (LAN) 12, a transmission logic I / F of I / F (WAN) 11, a transmission source IP address (S-IP) of IP-x, The destination IP address (D-IP) is IP-y, the source port number (S-Port) is Port-x, the destination port number (D-Port) is Port-y, the protocol is TCP, and the TCP flag is SYN / ACK / PSH / URG or FIN, RST = 0 packet. That is, it is filtering information for a packet (FIN, RST = 0) that passes from the I / F 12 to the I / F 11 among the packets of the session in which the packet A is the first session.

  Then, the CPU 16 registers the generated SPI entries (1) and (2) in the filtering storage unit 14 (step S3). At this time, the CPU 16 registers at a position (address: address) having a higher priority than the filter entry and a lower priority than the CPU transfer candidate entry. The CPU 16 stores the priority information of the registered SPI entries (1) and (2) in the filtering information registration status table. When the SPI entries (1) and (2) are registered, the packet A is filtered based on the filtering information stored in the filtering information registration status table. In the filtering information stored in the filtering information registration status table, the filter entry (control type = pass) that matches the communication type of the packet A is recorded, so the CPU 16 sends the packet A to the I via the CPU / IF 15. The data is transferred to / F (WAN) 11 and transmitted to the communication network on the WAN side (step S4).

  Next, when the packet A is the first (SYN) session, another packet of the session is received by the I / F (WAN) 11 or the I / F (LAN) 12. The filtering processing unit 13 performs a filtering process on the series of packets. This filtering process is performed in comparison with the filtering information registered in the filtering storage unit 14 as described above. Here, when the packet A is the first (SYN) session, the other packets of the session match the SPI entry (1) or the SPI entry (2). In addition, the SPI entry (1) (2) has a control type of “pass”. Therefore, when the packet processing unit 13 receives another packet of the session when the packet A is the first (SYN) session, the filtering processing unit 13 does not transfer the packet A to the CPU 16 but receives it by the I / F (WAN) 11. Packets are directly output from the I / F (LAN) 12, and packets received by the I / F (LAN) 12 are directly output from the I / F (WAN) 11. In other words, the packet A is a packet received for the first time of the session, and the subsequent session packets are subjected to SPI processing (bidirectional hardware transfer processing) by the packet passage control circuit (step S5).

  Next, it is assumed that the last (FIN) packet B of the session when the packet A is the first (SYN) session is received by the I / F (LAN) 12 (step S6). Then, the filtering processing unit 13 compares with the filtering information registered in the filtering storage unit 14. Here, since the SPI entry (1) is not subject to filtering for packets with FIN = 1, the filtering processing unit 13 sequentially checks the filter entries according to the priority. Since there is an entry with the same communication type in the filter entry (the same entry as the filter entry that processed packet A) and its control type is CPU transfer, packet B is transferred to CPU 16 via CPU / IF 15. (Step S7). Since the control type for the packet B is “pass” in the filtering information registration status table, the CPU 16 outputs the packet B to the I / F (WAN) 11 (step S8). Further, since the TCP flag of the packet B is FIN, the CPU 16 elapses a predetermined time after sending the SPI entries (1) and (2) of the session related to the packet to the I / F (WAN) 11 of the packet B. In this case, a process of deleting from the filtering storage unit 14 is performed (step S9).

  With the above processing, since all of the SPI processing was conventionally performed by the CPU 16, the load on the SPI processing of the CPU 16 was large. However, the packet passing control circuit having the filtering processing unit 13, the filtering storage unit 14 and the like was installed. For example, since the circuit is configured as one chip and the SPI processing is entrusted to the filtering processing unit 13, the CPU processing can be reduced.

  In the above processing, the SPI entries (1) and (2) are deleted by the CPU 16 based on the reception of the packet B by the I / F (LAN) 12, but the I / F (WAN) 11 The SPI entry may be deleted by the CPU 16 based on the reception of the FIN packet received on the side. In such a case, since the SPI entry (1) is filtering information that permits passage of all TCP flags, separately, the CPU transfer of the FIN = 1 packet received on the I / F (WAN) 11 side is performed. An SPI entry (3) to be shown is generated and registered in the filtering storage unit 14.

  Further, since the filtering storage unit 14 is configured by a memory or the like, the amount of filtering information that can be registered is limited. Therefore, the smaller the SPI entry, the more efficiently the memory capacity can be used. Therefore, the SPI entries (1) and (2) may be generated as a bidirectional entry in which the entries are collected as one entry, and bidirectional filtering processing may be performed with one entry.

Next, processing when the data amount of the SPI entry increases and filtering information of the SPI entry and the filter entry cannot be stored in the filtering storage unit 14 will be described.
FIG. 6 is a first diagram showing an outline of adjustment of registered filtering information.
FIG. 6 shows an overview of processing when the generation and registration of SPI entries increase, and all filter entries having a lower priority than the SPI entry cannot be registered. In such a case, the CPU 16 deletes the filter entries from the filtering storage unit 14 in descending order of priority. Further, the CPU 16 manages the information of the deleted filter entry in the filtering information registration status table. Then, the CPU 16 registers a filter entry indicating that all packets are transferred to the CPU as the lowest priority information in the filtering storage unit 14. Thereby, in the SPI processing in the filtering processing unit 13, all packets that do not match the filtering information registered in the filtering storage unit 14 are transferred to the CPU 16, and the SPI processing is performed in the CPU 16.

FIG. 7 is a second diagram showing an outline of adjustment of registered filtering information.
FIG. 7 shows an overview of processing when all the SPI entries cannot be registered due to the increase in the generation and registration of SPI entries. In such a case, the CPU 16 counts the number of times the SPI entry has been used within a certain period of time in the SPI process, determines priorities in descending order of the number of times of use, and filters the SPI entries in descending order of priority. 14, other SPI entries and filter entries are stored in the filtering information registration status table. Then, the CPU 16 registers a filter entry indicating that all packets are transferred to the CPU as the lowest priority information in the filtering storage unit 14.

  When the packet passage control circuit having the filtering storage unit 14 and the like is configured as a single chip by the above processing, for example, when the filtering processing unit 13 performs the SPI processing, the filtering storage unit 14 It is possible to perform adjustment with the processing in the CPU when the data amount of the dynamically generated SPI entry exceeds the limited data capacity.

Next, the processing of the above-described packet passage control device will be described in more detail.
In the above-described processing, the case where the received packet is TCP has been shown in the filtering processing, but actually, processing according to services such as TCP, UDP, and ICMP is performed.
FIG. 8 shows a flow of packet processing by the CPU.
First, when the power is turned on, the CPU 16 initializes an SPI entry stored in the filtering storage unit 14 (step S81). Then, it is determined whether or not a packet has been received (step S82) and waits. If there is a received packet, filter / SPI search pre-processing <reception logic I / F search (step S83), NAT / NAPT search (step S84), route search (step S85)> is performed. The reception logical I / F search is a process for determining the received logical I / F for each received packet. The NAT / NAPT search converts a global IP address / port number into a local IP address / port number. The route search is processing for determining a logical I / F of a transfer destination (further determining a destination MAC address, MTU, and the like). When a packet divided by the IP fragment is received, NAPT can be performed on the packet divided by the IP fragment by reconfiguration (returning to the packet before the division).

  Next, the CPU 16 performs a filter / SPI search (step S86). This process is a determination of passage / discard of the received packet. In addition, about the packet divided | segmented by the IP fragment, based on the information contained not only in an IP header but in a layer 4 header also with respect to the packet divided | segmented by an IP fragment by implementing fragment tracking or a reconfiguration | reconstruction You may judge. A classification search for determining the quality class of a packet may be performed simultaneously with the filter / SPI search.

  Next, the CPU 16 performs SPI entry management (step S87). This SPI entry management is a process for determining whether or not to register an SPI entry for a received packet. Then, necessary processing is performed after filter / SPI search such as classification search (step S88) and NAT / NAPT search (step S89). The classification search is a process for determining a quality class of a packet, and the NAT / NAPT search is a process for converting a global IP address / port number into a local IP address / port number as described above. When a packet divided by the IP fragment is received, NAPT can be performed on the packet divided by the IP fragment by reconfiguration (returning to the packet before the division).

FIG. 9 is a processing flow of SPI entry management.
9, the CPU 16 determines whether or not the received packet is a packet for which filtering information is registered as an SPI entry in the processing of SPI entry management in step S87 (step S90). If it is not a SPI entry registration target packet, it is determined whether or not it is an SPI entry deletion packet (step S91). If so, an SPI entry deletion process is performed (step S92). If No in step S91, the process ends.

  If the packet is a SPI entry registration target packet, it is sequentially determined whether it is a TCP packet (step S93), a UDP packet (step S94), or an ICMP packet (step S95). If the packet is a TCP packet, a TCP SPI entry registration process (step 96) is performed. If the packet is a UDP packet, a UDP SPI entry registration process is performed (step S97). In step S98, ICMP SPI entry registration processing is performed. If it is not a TCP, UDP or ICMP packet, a general-purpose SPI entry registration process is performed (step S99).

FIG. 10 is a diagram showing the flow of the SPI registration packet determination process.
In determining whether the packet is an SPI registration packet in step S90 described above, first, the CPU 16 determines whether there is an SPI (step S901). Information regarding whether or not there is an SPI is stored in advance by being set from the outside. Next, it is determined whether or not the SPI entry is compatible and the filter entry is satisfied (step S902), whether or not the result of the filter entry is passed (step S903), and whether the packet is a non-TCP or TCP SYN packet. (Step S904) is performed, and if all the determinations are Yes, it is determined that the packet is a packet for registering the SPI filter (that is, the SPI registration packet determination is Yes). Otherwise, it is determined that the packet does not register the SPI filter (that is, the SPI registration packet determination is No).

FIG. 11 is a first diagram illustrating a flow of determination processing for an SPI entry deletion packet.
In determining whether or not the packet is the SPI entry deletion target in step S91 described above, first, the CPU 16 determines whether the received packet is a TCP FIN packet or an RST packet based on a flag of the packet (step S911a). In the case of Yes, it is next determined whether or not there is a matching entry in the filter / SPI search table and the result passes (step S912a). If the determination is Yes, the SPI entry specified in the received packet is determined to be the SPI entry to be deleted (step S913a). Then, it is determined whether or not the bi-directional transfer between the receiving side and the transmitting side of the FIN / RST packet for the SPI entry to be deleted is completed (step S914a), and if NO, the FIN / RST packet transfer history is recorded. This is performed (step S915a). If YES in step S914a, the process proceeds to SPI entry deletion processing (Yes). If NO in steps S911a and 912a, or after step S915a, the processing ends without performing SPI entry deletion processing.

FIG. 12 is a second diagram illustrating the flow of the SPI entry deletion packet determination process.
Instead of the SPI entry deletion packet determination process described above, the following method may be used.
In determining whether or not the SPI entry is a packet to be deleted in step S91, first, the CPU 16 determines whether the received packet is a TCP FIN packet or an RST packet using a flag (step S911b). . In the case of Yes, it is next determined whether or not there is a matching entry in the filter / SPI search table and the result is passed (step S912b). If the determination is Yes, the SPI entry specified in the received packet is determined to be the SPI entry to be deleted (step S913a). Then, the TCP SPI entry deletion packet transfer protection timer is started (step S914b). After step S914b, the process proceeds to the SPI entry deletion process (Yes). In the case of No in steps S911b and 912b, the process ends without deleting the SPI entry.

FIG. 13 is a third diagram showing the flow of the SPI entry deletion packet determination process.
When the received packet is ICMP, the SPI entry deletion packet determination process is performed by the following process.
If the determination in step S911a (or step S911b) is No, the CPU 16 determines whether the received packet is an ICMP packet (step S912c). If it is an ICMP packet, it is determined whether or not there is a matching entry in the filter / SPI search table and the result passes (step S913c). If the determination is Yes, the SPI entry specified in the received packet is determined to be the SPI entry to be deleted (step S914c), and the process proceeds to the SPI entry deletion process (Yes). In the case of No in steps S912c and 913c, the process ends without deleting the SPI entry.

FIG. 14 is a first diagram showing a flow of TCP SPI entry registration processing.
The received packet P to be registered for SPI entry includes a source IP address (S-IP), a destination IP address (D-IP), a protocol (TCP), a source port number (S-Port), and a destination port number. (D-Port), a TCP SYN packet. In this case, first, the CPU 16 registers the SPI entry of the received packet (step S931a). This registration is an entry for passing packets in the TCP session of the received packet P (a set of packets belonging to the same session in which the packet transfer flows are opposite to each other), and a filter that holds the entry in the CPU 16 Register in the SPI search table. FIG. 15 is a first diagram showing a filter / SPI search table held by the CPU.

  Next, the CPU 16 registers an SPI entry in the packet passage control circuit (step S932a). In this process, for the TCP session to which the received packet P belongs, an entry for passing a bi-directional packet (a set of packets belonging to the same session with the packet transfer flows in opposite directions) (excluding FIN / RST packets) and In this process, an entry for transferring FIN / RST packets belonging to the same TCP session to the CPU 16 in the direction opposite to the transfer direction of the received packet P is registered in the filter / SPI search table of the packet passage control circuit. FIG. 16 is a first diagram showing a filter / SPI search table held in the packet passage control circuit. The correspondence between the entry number of the SPI entry registered in the filter / SPI search table held by the CPU 16 and the entry number of the packet entry control circuit SPI entry registered in the filter / SPI search table of the packet passage control circuit is stored. deep. Also, the Used counter is cleared. This Used counter will be described later. Then, the CPU 16 starts a timer (SPI entry valid timer) that measures the valid period of the registered SPI entry (step S933a). The operation of this timer will be described later.

FIG. 17 is a second diagram showing the flow of the TCP SPI entry registration process.
The processing shown in steps S931a to S933a may be performed by the following processing.
First, the CPU 16 registers the SPI entry of the received packet (step S931b). In this registration, the CPU 16 holds an entry for allowing a packet in a bidirectional direction (a set of packets belonging to the same session in which the packet transfer flows are opposite to each other) between the receiving side and the transmitting side of the TCP session to which the received packet P belongs. To be registered in the filter / SPI search table (FIG. 15).

  Next, the CPU 16 registers the SPI entry for the packet passage control circuit (step S932b). This registration is performed in the same way in which the TCP session to which the received packet P belongs is bidirectional (packet transfer flow is opposite to each other). Processing for registering an entry for allowing a packet (except for a FIN / RST packet in the same direction as the received packet) to pass through the filter / SPI search table (FIG. 18) of the packet passage control circuit. It is. FIG. 18 is a second diagram showing a filter / SPI search table held by the packet passage control circuit.

  The processing when all entries in the filter / SPI search table of the packet passage control circuit have been registered will be described later. Next, the correspondence table of the entry number of the SPI entry registered in the filter / SPI search table of the CPU 16 and the entry number of the packet entry control loop SPI entry registered in the filter / SPI search table of the packet passage control circuit is stored. . Also, the Used counter is cleared. This Used counter will be described later. Then, the CPU 16 starts a timer (SPI entry valid timer) that measures the valid period of the registered SPI entry (step S933b). The operation of this timer will be described later.

FIG. 19 is a flowchart showing the UDP SPI entry registration process.
The received packet P to be registered for SPI entry includes a source IP address (S-IP), a destination IP address (D-IP), a protocol (UDP), a source port number (S-Port), and a destination port number. It is assumed that the packet is (D-Port). In this case, first, the CPU 16 registers the SPI entry of the received packet (step S941). This registration is an entry for passing packets in a UDP session to which the received packet P belongs (a set of packets belonging to the same session with the packet transfer flows in opposite directions), and the CPU 16 holds the entry. Register in the filter / SPI search table. FIG. 20 is a second diagram showing a filter / SPI search table held by the CPU.

  Next, the CPU 16 registers an SPI entry in the packet passage control circuit (step S942). In this process, for the UDP session to which the received packet P belongs, an entry for passing a bi-directional packet (a set of packets belonging to the same session in which the packet transfer flows are opposite to each other) is sent to the filter / SPI of the packet passage control circuit. Register in the search table. FIG. 21 is a third diagram showing a filter / SPI search table held by the packet passage control circuit. The processing when all entries in the filter / SPI search table of the packet passage control circuit have been registered will be described later. The CPU 16 stores the correspondence between the entry number of the SPI entry registered in the filter / SPI search table of the CPU and the entry number of the SPI entry for the packet passage control circuit registered in the filter / SPI search table of the packet passage control circuit. deep. Also, the Used counter is cleared. This Used counter will be described later. Then, the CPU 16 starts a timer (SPI entry valid timer) for measuring the valid period of the registered SPI entry (step S943). The operation of this timer will be described later.

FIG. 22 is a diagram showing the flow of the ICMP SPI entry registration process.
The received packet P subject to SPI entry registration is an ICMP packet having a source IP address (S-IP), a destination IP address (D-IP), a protocol (ICMP), an ICMP type = 8, and an ICMP code = 0. And First, the CPU 16 registers the SPI entry of the received packet (step S951). This registration is an entry for causing the CPU 16 to transfer an echo response message to the echo request message of the received packet P, and the entry is registered in the filter / SPI search table (FIG. 23) of the CPU 16. FIG. 23 is a third diagram showing a filter / SPI search table held by the CPU.

  Next, the CPU 16 registers an SPI entry in the packet passage control circuit (step S952). In this process, an entry for transferring an echo response message to the CPU in response to an echo request message of the received packet P is registered in the filter / SPI search table (FIG. 24) of the packet passage control circuit. FIG. 24 is a fourth diagram showing a filter / SPI search table held in the packet passage control circuit. The processing when all entries in the filter / SPI search table of the packet passage control circuit have been registered will be described later. The CPU 16 stores the correspondence between the entry number of the SPI entry registered in the filter / SPI search table of the CPU and the entry number of the SPI entry for the packet passage control circuit registered in the filter / SPI search table of the packet passage control circuit. deep. Also, the Used counter is cleared. This Used counter will be described later. Then, the CPU 16 starts a timer (SPI entry valid timer) for measuring the valid period of the registered SPI entry (step S953). The operation of this timer will be described later.

FIG. 25 is a diagram showing a flow of SPI entry registration processing for a general-purpose packet.
It is assumed that the received packet P subject to SPI entry registration is a packet of a source IP address (S-IP), a destination IP address (D-IP), and a protocol (PROT). First, the CPU 16 registers the SPI entry of the received packet (step S991). This registration is a process of registering an entry for allowing a bidirectional packet of the received packet P (a set of packets whose packet transfer flows are opposite to each other) in the filter / SPI search table (FIG. 26) held by the CPU 16. It is. FIG. 26 is a fourth diagram showing a filter / SPI search table held by the CPU.

  Next, the CPU 16 registers an SPI entry in the packet passage control circuit (step S992). In this process, an entry for allowing a packet of the received packet P to pass through (a pair of packets whose packet transfer flows are opposite to each other) is registered in the filter / SPI search table (FIG. 27) of the packet passage control circuit. It is processing. FIG. 27 is a fifth diagram showing a filter / SPI search table held by the packet passage control circuit. The processing when all entries in the filter / SPI search table of the packet passage control circuit have been registered will be described later. The CPU 16 stores the correspondence between the entry number of the SPI entry registered in the filter / SPI search table of the CPU and the entry number of the SPI entry for the packet passage control circuit registered in the filter / SPI search table of the packet passage control circuit. deep. Also, the Used counter is cleared. This Used counter will be described later. Then, the CPU 16 starts a timer (SPI entry valid timer) that measures the valid period of the registered SPI entry (step S993). The operation of this timer will be described later.

FIG. 28 shows an entry number correspondence management table.
In each of the above SPI entry registration processes, the entry number of the SPI entry registered in the filter / SPI search table of the CPU and the entry number of the SPI entry for the packet passage control circuit registered in the filter / SPI search table of the packet passage control circuit Correlation is performed using this entry number correspondence management table. The corresponding entry is registered in association with the SPI entry valid timer. This timer is a timer value obtained by measuring the valid period of the SPI entry.

The above-mentioned Used counter will be described.
The Used counter is a value obtained by measuring the number of packets passed through each SPI entry and SPI entry for each packet passage control circuit. A counter is provided for each entry in the filter / SPI search table of the CPU 16 and the packet passage control circuit, or is provided for each entry in the SPI management table.

Next, processing of the SPI entry valid timer will be described.
FIG. 29 is a diagram showing a processing flow of the SPI entry valid timer.
First, when the CPU 16 completes execution of the SPI entry valid timer process for all SPI entry groups [m] (step S2901), the CPU 16 reads a Used counter value (step S2902). As a result, the number C [m] of packets passed by the SPI entries belonging to the SPI entry group [m] is acquired. Next, it is determined whether an SPI entry is used (step S2903). That is, if the value of the number of packets C [m] passed by the SPI entries belonging to the SPI entry group [m] has not changed since the previous reading, it is determined that the SPI entry is not used. Otherwise, it is determined that the SPI entry has been used.

  If the SPI entry is unused, the SPI entry valid timer is advanced (step S2904). That is, the SPI entry valid timer T [m] is decremented by 1 (in the case of down counter implementation). Then, it is determined whether or not the SPI entry valid timer T [m] has expired (step S2905). (It is a time of mounting with a down counter, and when it is mounted with an up counter, it expires when Tmax is reached). Then, the SPI entry is deleted. That is, the SPI entries belonging to the SPI entry group [m] are respectively deleted from the filter / SPI search table of the CPU 16 and the filter / SPI search table of the packet passage control circuit (step S2906).

  If an SPI entry is used in step S2903, an SPI entry valid timer is initialized (step S2907). That is, the SPI entry valid timer T [m] is initialized to Tmax (when mounted by a down counter, it is initialized to 0 when an up counter is mounted). Tmax is the SPI entry effective maximum time, and if there is no packet passed by the SPI entry belonging to the SPI entry group [m] during this time, the SPI entry group [m] is targeted for deletion. Then, the process waits for the elapse of a fixed time tw (step S2908) and repeats the processing from step S2901.

Next, an SPI entry registration process for the above-described packet passage control circuit will be described.
FIG. 30 is a diagram showing a processing flow of SPI entry registration for the packet passage control circuit.
First, the CPU 16 determines whether or not the data entry in the filtering storage unit 14 of the packet passage control circuit is empty and the SPI entry for the packet passage control circuit can be registered at the beginning of the SPI entry registration for the packet passage control circuit. (Step S3001). In step S3001, No (that is, when there is no space), it is confirmed whether or not the SPI entry for the packet passage control circuit is registered in the filter / SPI search table of the packet passage control circuit (step S3002). If the answer is No in step S3002, the deleteable SPI entry is searched (step S3003). It is then determined whether there is a deleteable SPI entry (step S3004). If there is no deletable SPI entry, the process ends. If there is a deletable SPI entry, the deletable SPI entry is deleted (step S3005), and an unregistered SPI entry for the packet passage control circuit is registered in the empty entry ( Step S3006). Next, it is determined whether or not all the SPI entries for the packet passage control circuit have been registered (step S3007). If the registration has been completed, the process ends. Repeat the process.

  In the process of step S3003, the value of the SPI entry valid timer [m] is read for all SPI entry groups [m], and the SPI entry group with the longest SPI entry unused period (when the timer is implemented by a down counter) Finds the SPI entry group having the smallest timer value, or the SPI entry group having the largest timer value when the timer is implemented by an up-counter, and sets it as a deleteable SPI entry. However, if the unused period is less than or equal to the threshold, it is not considered as a deleteable SPI entry.

  If registration is possible in step S3001, processing in steps S3006 and S3007 is performed. In step S3002, if the SPI entry for the packet passage control circuit is registered in the filter / SPI search table of the packet passage control circuit, the CPU processing entry for transferring all packets to the CPU as the lowest priority is displayed. It is determined whether it is registered (step S3008). If not, a CPU processing entry is registered (step S3009), and the lowest priority filter entry other than the CPU processing entry is deleted (step S3010). Steps S3006 and S3007 are performed.

Next, a series of processes over the entire processing unit in the packet passing control device will be described.
FIG. 31 is a first diagram illustrating a processing flow in the packet passage control apparatus.
This figure shows the processing flow for the first example when the received packet is TCP.
First, when the TCP session start packet (TCP SYN packet) is received by the I / F 12 on the LAN side (step S3101), the TCP session start packet is transferred to the packet passage control circuit. In the packet passage control circuit, it is determined that the filtering processing unit 13 matches the entry of the filter / SPI search table stored in the filtering storage unit 14, and it is determined that the data is transferred by the CPU (step S3102). Then, the TCP session start packet is transferred to the CPU 16. The CPU 16 determines that the transfer destination of the received packet is the WAN-side I / F 11, determines that the packet is passing through the filter entry, and thereby determines that the packet is an SPI entry registration packet (step S 3103). Then, the CPU 16 registers the circuit SPI entry in the circuit filter / SPI search table in the filtering storage unit 14 (step S3104), instructs transfer to the WAN side I / F 11, and sends a TCP to the packet passage control circuit. The session start packet is transferred (step S3105). In the packet passage control circuit, the filtering processing unit 13 transfers the packet to the WAN side I / F 11 in accordance with an instruction from the CPU 16 (step S3106), and transmits it to the destination address of the packet.

  Next, a TCP session packet (a packet other than FIN / RST) is transmitted and received between the destination indicated by the packet and the transmission source. In the packet passing control device connected in the meantime, the filtering processing unit 13 of the packet passing control circuit transfers the packet received from the WAN side I / F 11 to the LAN side I / F 12 and sends it to the transmission source (step S3107). In addition, the filtering processing unit 13 transfers the packet received from the transmission source by the LAN side I / F 12 to the WAN side I / F 11 and sends it to the transmission destination (step S3108).

  When the TCP session end packet (TCP FIN / RST packet) is received at the LAN side I / F 12 (step S3109), the filtering processing unit 13 of the packet passing control circuit is adapted to the circuit filter entry, and the CPU It is determined that it is a transfer (step S3110). Then, the TCP session end packet is transferred to the CPU 16, and the CPU 16 determines that the transfer destination is the WAN side I / F, determines that the filter entry is passing, and determines that the packet is a SPI entry deletion packet. (Step S3111). Then, the one-way transfer of the SPI entry deletion packet (the packet from the LAN side to the WAN side) is recorded (the SPI entry number and the transfer direction are recorded), and a TCP session end packet is instructed to the WAN I / F 11 ( Step S3112). Then, the filtering processing unit 13 of the packet passage control circuit transfers the TCP session end packet to the WAN side I / F 11 according to the instruction of the CPU (step S3113), and the WAN side I / F 11 sends it to the destination.

  When the WAN session I / F 11 receives a TCP session end packet (TCP FIN / RST packet) from the destination (step S3114), the filtering processing unit 13 of the packet passage control circuit sends the packet to the circuit SPI entry. It is determined that the packet is compatible and transferred by the CPU (step S3115). Then, the TCP session end packet is transferred to the CPU 16. Then, the CPU 16 performs a determination that the transfer destination is the LAN side I / F 12, a determination that the filter entry indicates “pass”, and a determination that the transfer destination is an SPI entry deletion packet (step S3116), and an SPI entry deletion packet. It is determined that both packets of the WAN side → LAN side and LAN side → WAN side have been transferred (step S3117). The CPU 16 deletes the SPI entry for the circuit (step S3118), and instructs the filtering processing unit 13 of the packet passage control circuit to transfer the TCP session end packet to the LAN side I / F 12 (step S3119). Then, the filtering processing unit 13 of the packet passing control circuit transfers the TCP session end packet to the LAN side I / F 12 according to the instruction of the CPU 16 (step S3120), and the LAN side I / F 12 sends it to the transmission source. This completes the TCP packet transfer process in the packet passage control apparatus.

FIG. 32 is a second diagram showing a processing flow in the packet passage control apparatus.
This figure shows the processing flow for the second example when the received packet is TCP. This second example is a method of deleting an SPI entry by a timer.
First, when a TCP session start packet (TCP SYN packet) is received by the LAN-side I / F 12 (step S3201), the TCP session start packet is transferred to the packet passage control circuit. In the packet passage control circuit, it is determined that the filtering processing unit 13 matches the entry of the filter / SPI search table stored in the filtering storage unit 14, and the CPU transfer is determined (step S3202). Then, the TCP session start packet is transferred to the CPU 16. The CPU 16 determines that the transfer destination of the received packet is the WAN side I / F 11, determines that the packet is passed by the filter entry, and thereby determines that the packet is an SPI entry registration packet (step S 3203). Then, the CPU 16 registers the circuit SPI entry in the circuit filter / SPI search table of the filtering storage unit 14 (step S3204), instructs the WAN side I / F 11 to transfer, and sends a TCP to the packet passage control circuit. The session start packet is transferred (step S3205). In the packet passage control circuit, the filtering processing unit 13 transfers the packet to the WAN side I / F 11 according to the instruction of the CPU 16 (step S3206), and transmits it to the destination address of the packet.

  Next, a TCP session packet (a packet other than FIN / RST) is transmitted and received between the packet destination and the packet transmission source. In the packet passing control apparatus connected in the meantime, the filtering processing unit 13 of the packet passing control circuit transfers the packet received from the WAN side I / F 11 to the LAN side I / F 12 and sends it to the transmission source (step S3207). The filtering processor 13 forwards the TCP session packet (packet other than FIN / RST) received from the transmission source at the LAN side I / F 12 to the WAN side I / F 11 and sends it to the destination (step). S3208).

  When the LAN side I / F 12 receives a TCP session end packet (TCP FIN / RST packet) (step S3209), the filtering processing unit 13 of the packet passage control circuit is adapted to the circuit filter entry, and the CPU It is determined that it is a transfer (step S3210). Then, the TCP session end packet is transferred to the CPU 16, and the CPU 16 determines that the transfer destination is the WAN-side I / F, determines that the filter entry is passed, and determines that the packet is an SPI entry deletion packet ( Step S3211). The CPU 16 activates a transfer protection timer for the TCP SPI entry deletion packet (step S3212). Then, it instructs the packet passage control circuit to transfer to the WAN side I / F 11 (step S3213). Then, the filtering processing unit 13 of the packet passing control circuit transfers the TCP session end packet to the WAN side I / F 11 according to the instruction of the CPU (step S3214), and the WAN side I / F 11 sends it to the destination.

  When the WAN session I / F 11 receives a TCP session end packet (TCP FIN / RST packet) from the destination (step S3215), the filtering processing unit 13 of the packet passage control circuit, for the packet, enters the circuit SPI entry. Is transferred to the LAN side I / F 12 (step S3216). Then, the CPU 16 detects the expiration of the timer activated in step S3212 (step S3217), and deletes the SPI entry (step S3218).

FIG. 33 is a third diagram showing a processing flow in the packet passage control apparatus.
This figure shows the processing flow for an example in which the received packet is UDP.
First, when a UDP packet P is received by the I / F 12 on the LAN side (step S3301), the packet P is transferred to the packet passage control circuit. In the packet passage control circuit, it is determined that the filtering processing unit 13 matches the entry of the filter / SPI search table stored in the filtering storage unit 14, and the CPU transfer is determined (step S3302). Then, the packet P is transferred to the CPU 16. The CPU 16 determines that the transfer destination of the received packet P is the WAN-side I / F 11, determines that the packet is passing through the filter entry, and determines that the packet is an SPI entry registration packet (step S 3303). Then, the CPU 16 registers the circuit SPI entry in the circuit filter / SPI search table of the filtering storage unit 14 (step S3304), instructs the WAN side I / F 11 to transfer, and sends the packet to the packet passage control circuit. P is transferred (step S3305). At this time, the CPU 16 initializes the SI entry valid timer (step S3306). In the packet passage control circuit, the filtering processing unit 13 transfers the packet P to the WAN side I / F 11 in accordance with an instruction from the CPU 16 (step S3307), and sends it to the destination of the packet.

  Next, packets x to z are transmitted and received between the packet destination and the packet transmission source. In the packet passing control apparatus connected in the meantime, the packet processing control unit 13 of the packet passing control circuit transfers the packet x received from the WAN side I / F 11 to the LAN side I / F 12 and sends it to the transmission source (step). S3308), and the packet processing unit 13 forwards the packet y received from the transmission source at the LAN-side I / F 12 to the WAN-side I / F 11 and sends it to the destination (step S3309). Also, the WAN-side I / F 11 The packet processing unit 13 of the packet passage control circuit transfers the packet z received from the packet to the LAN side I / F 12 and sends it to the transmission source (step S3310). During these steps S3308 to S3310, the filtering processing unit 13 notifies the CPU 16 of the use of the SPI entry. Based on the SPI entry valid timer process, the CPU 16 reads the Used counter value and performs a process of initializing the timer because the SPI entry is in use (step S3311). Also, based on the SPI entry valid timer process, the Used counter value is read, and if the SPI entry is unused, the timer is updated (step S3312). When the expiration of the SPI entry valid timer is detected (step S3313), the SPI entry is deleted (step S3314).

FIG. 34 is a fourth diagram showing a processing flow in the packet passage control apparatus.
This figure shows a processing flow for an example in which the received packet is ICMP.
First, when an ICMP packet (echo request message, type = 8, code = 0) is received by the I / F 12 on the LAN side (step S3401), the echo request message of the packet is transferred to the packet passage control circuit. In the packet passage control circuit, it is determined that the filtering processing unit 13 matches the entry in the filter / SPI search table stored in the filtering storage unit 14, and it is determined that the data is transferred by the CPU (step S3402). Then, the echo request message is transferred to the CPU 16. The CPU 16 determines that the transfer destination of the echo request message is the WAN side I / F 11, determines that the echo request message has passed through the filter entry, and determines that this is an SPI entry registration packet (step S 3403). Then, the CPU 16 registers the circuit SPI entry in the circuit filter / SPI search table of the filtering storage unit 14 (step S3404), instructs transfer to the WAN side I / F 11, and echoes it to the packet passage control circuit. The request message is transferred (step S3405). In the packet passage control circuit, the filtering processing unit 13 transfers an echo request message to the WAN side I / F 11 according to an instruction from the CPU 16 (step S3406), and sends it to the destination of the packet.

  Next, when the backward ICMP packet (TCP FIN / RST packet) is received by the WAN-side I / F 11, an echo response message is transferred to the packet passing control circuit, and the filtering processing unit 13 uses the circuit for the circuit. It is determined that it conforms to the SPI entry, and it is determined that the packet is a CPU transfer (step S3407). Then, the echo response message is transferred to the CPU 16. The CPU 16 determines to transfer to the LAN side I / F 12, determines to pass through the filter entry, and determines that the packet is an SPI entry deletion packet (step S3408), and deletes the SPI entry (step S3409). Then, the packet passing control circuit is instructed to transfer to the WAN side I / F 11 and the echo response message is transferred (step S3410). Then, the filtering processing unit 13 of the packet passage control circuit transfers the echo response message to the LAN side I / F according to the instruction of the CPU 16 (step S3411) and sends it to the transmission source.

  Although the embodiment of the present invention has been described above, the process of the above-described CPU is stored in a computer-readable recording medium in the form of a program, and the computer reads and executes this program. Is done by. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

It is a block diagram which shows the structure of a packet passage control apparatus. It is a figure which shows the structure of a filtering memory | storage part. It is a figure which shows the structure of a filtering information registration condition table and a filtering memory | storage part. It is a figure which shows the outline | summary of the processing flow of a packet passage control apparatus. It is a table which shows the packet which a packet passage control apparatus receives, and the SPI entry dynamically generated based on reception of the packet. It is a 1st figure which shows the outline | summary of adjustment of the registered filtering information. It is a 2nd figure which shows the outline | summary of adjustment of the registered filtering information. It is a figure which shows the flow of the packet processing by CPU. It is a processing flow of SPI entry management. It is a figure which shows the flow of a SPI registration packet determination process. It is a 1st figure which shows the flow of the determination process of a SPI entry deletion packet. It is a 2nd figure which shows the flow of the determination process of a SPI entry deletion packet. FIG. 10 is a third diagram illustrating a flow of determination processing for an SPI entry deletion packet. It is a 1st figure which shows the flow of the SPI entry registration process of TCP. It is the 1st figure which shows the filter and SPI search table hold | maintained by CPU. FIG. 3 is a first diagram showing a filter / SPI search table held by a packet passage control circuit. It is a 2nd figure which shows the flow of the SPI entry registration process of TCP. FIG. 10 is a second diagram showing a filter / SPI search table held by the packet passage control circuit. It is a figure which shows the flow of a UDP entry registration process of UDP. It is a 2nd figure which shows the filter and SPI search table hold | maintained by CPU. FIG. 10 is a third diagram illustrating a filter / SPI search table held by the packet passage control circuit. It is a figure which shows the flow of the SPI entry registration process of ICMP. FIG. 10 is a third diagram illustrating a filter / SPI search table held by a CPU. FIG. 10 is a fourth diagram illustrating a filter / SPI search table held by the packet passage control circuit. It is a figure which shows the flow of the SPI entry registration process of a general purpose packet. FIG. 10 is a fourth diagram illustrating a filter / SPI search table held by a CPU. FIG. 10 is a fifth diagram illustrating a filter / SPI search table held by the packet passage control circuit. It is a figure which shows the entry number corresponding | compatible management table. It is a figure which shows the processing flow of an SPI entry effective timer. It is a figure which shows the processing flow of SPI entry registration for packet passage control circuits. It is a 1st figure which shows the processing flow in a packet passage control apparatus. It is a 2nd figure which shows the processing flow in a packet passage control apparatus. It is a 3rd figure which shows the processing flow in a packet passage control apparatus. It is a 4th figure which shows the processing flow in a packet passage control apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Packet passage control apparatus 11 ... I / F (WAN)
12 ... I / F (LAN)
13 ... Filtering processing unit 14 ... Filtering storage unit 15 ... CPU / IF
16 ... CPU
17 ... Table storage section

Claims (10)

A packet passage control device comprising a central processing unit and a packet passage control unit, for controlling whether or not a packet received from one communication network path is passed to the other communication network path,
Reading the first filtering from a filtering table that holds first filtering information indicating a control type of either permission or discard of the packet and a communication type indicating a filter rule conformity determination condition of the packet; When the first filtering indicates the passage permission, the first filtering registration unit of the central processing unit rewrites the information of central processing transfer and registers it in the filtering storage unit of the packet passage control unit;
When a packet is received, if the communication type and control type of the packet match the first filtering registered in the filtering storage unit, at least the communication type of the received packet is set to the central processing unit. A central processing unit transfer means of the packet passage control unit,
A second indicating permission to pass both the passage of the received packet from the one communication network path to the other communication network path and the passage from the other communication network path to the one communication network path; A second filtering information registration unit of the central processing unit that preferentially registers each filtering information in the filtering storage unit as information having a higher priority of a filter rule than the first filtering information;
For a series of packet processing related to the received packet, it is determined in order of priority whether or not the second filtering information registered in the filtering storage unit is matched. Passing processing means of the packet passing control unit, which performs passing processing without going through the processing unit;
A packet passage control device comprising: The central processing unit transfer means,
The final packet received in a series of packet processing related to the received packet is transferred to the central processing unit,
The central processing unit is
The packet passing control device according to claim 1, further comprising: a second filtering deleting unit that deletes the second filtering information from the filtering storage unit by receiving the final packet. Time measuring means for measuring an elapsed time from the reception time of the last packet that matches the second filtering information registered in the filtering storage unit;
A second filtering deleting means for deleting the second filtering information from the filtering storage unit when the elapsed time becomes a predetermined time;
The packet passage control device according to claim 1, further comprising: When the amount of information composed of the second filtering information and the first filtering information exceeds the amount of information that can be stored in the filtering storage unit due to an increase in registration of the second filtering information in the filtering storage unit In addition, as the filtering information with the lowest priority, third filtering registration means for registering, in the filtering storage unit, third filtering information indicating a control type of central processing transfer for all communication types of packets,
Filtering adjustment means for deleting in order from low priority information among the first filtering information stored in the filtering storage unit;
The packet passage control device according to claim 1, further comprising: The filtering adjustment means is
When the information amount of the second filtering information exceeds the information amount that can be stored in the filtering storage unit due to an increase in registration of the second filtering information in the filtering storage unit, the filtering storage unit stores the information. The packet passing control device according to claim 4, wherein the second filtering information is deleted in order from low priority information. A packet passage control method in a packet passage control apparatus, comprising a central processing unit and a packet passage control unit, for controlling whether or not a packet received from one communication network path is passed to the other communication network path,
Filtering in which the first filtering registration unit of the central processing unit holds first filtering information indicating a control type of any one of the packet permission, discard, and central processing transfer and the communication type of the packet Read the first filtering from the table, if the first filtering indicates the passage permission, rewrite the information in the central processing transfer, register in the filtering storage unit of the packet passage control unit,
When the central processing unit transfer means of the packet passage control unit receives a packet, when the communication type and control type of the packet match the first filtering registered in the filtering storage unit, Transfer at least the communication type of the received packet to the central processing unit,
The second filtering information registering means of the central processing unit passes the received packet from the one communication network path to the other communication network path, and from the other communication network path to the one communication network. Each of the second filtering information indicating both passage permission to the route, and preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information,
The passage processing means of the packet passage control unit determines, in order of priority, whether or not the series of packet processing related to the received packet matches the second filtering information registered in the filtering storage unit. If they match, the packet passing control method performs the passing process without going through the central processing unit. The central processing unit transfer means of the packet passage control unit,
The final packet received in a series of packet processing related to the received packet is transferred to the central processing unit,
The second filtering deletion means of the central processing unit is
The packet passing control method according to claim 6, wherein the second filtering information is deleted from the filtering storage unit by receiving the final packet. The time measuring means measures an elapsed time from the reception time of the last packet that matches the second filtering information registered in the filtering storage unit,
The packet according to claim 6, wherein the second filtering deletion unit of the central processing unit deletes the second filtering information from the filtering storage unit when the elapsed time reaches a predetermined time. Passing control method. The third filtering registration unit stores the amount of information including the second filtering information and the first filtering information in the filtering storage unit by increasing the registration of the second filtering information in the filtering storage unit. When the amount of information that can be exceeded, the third filtering information indicating the control type of the central processing transfer is registered in the filtering storage unit as the filtering information with the lowest priority for all communication type packets,
The packet according to any one of claims 6 to 8, wherein the filtering adjustment unit deletes the first filtering information stored in the filtering storage unit in order from information having a lower priority. Passing control method. The filtering adjustment means is
When the information amount of the second filtering information exceeds the information amount that can be stored in the filtering storage unit due to an increase in registration of the second filtering information in the filtering storage unit, the filtering storage unit stores the information. The packet passing control method according to claim 9, wherein the second filtering information is deleted in order from low priority information.

Images