JP4244356B2 - Traffic analysis and control system - Google Patents

Description

  In the wide area network, the present invention monitors traffic fluctuations on a network wide basis and transfers traffic to a dedicated packet processing apparatus only when analysis is necessary, and performs detailed analysis to monitor unauthorized access in the network. This is a technology for efficiently implementing attack traffic defense and improving security at a low cost.

  With the spread of the Internet, illegal eavesdropping of data and the like due to unauthorized access via a network, system attacks such as DDoS (Distributed Denial of Services) attacks, etc. are frequently occurring.

  Conventionally, in order to cope with these threats, an access control technique is used in which a firewall function is installed in a packet transfer device such as a router to control communication according to data contents flowing through a network and packet header contents. By installing this packet transfer device at the boundary of the network, it is possible to pass only the minimum necessary communication in accordance with the security policy set by the user.

  However, since the firewall function allows communication according to the security policy to pass through the network, it is difficult to completely prevent unauthorized access such as unauthorized intrusion or DDoS attack using this allowed communication service. It is.

  In order to solve this problem, a method of using an abnormal traffic detection device such as Anomaly Detector in combination with an abnormal traffic analysis / control device such as Anomaly Guard is adopted (for example, see Patent Document 1). In this method, when the possibility of abnormal traffic is detected by the Anomaly Detector, a warning is sent to the Anomaly Guard, and the target traffic is rerouted to the Anomaly Guard for analysis. After the detailed analysis, Anomaly Guard classifies the received traffic into illegal traffic and normal traffic, forwards normal traffic to the original destination, and deletes illegal traffic.

JP 2005-5927 A (Network system and unauthorized access control method and program)

  However, in this method, the abnormal traffic analysis / control device reroutes the traffic to be analyzed to itself, so that the abnormal traffic analysis / control device has the routing control function, and the device performs network control every time the traffic control is performed. It is necessary to change the entire routing information. For this reason, the abnormal traffic analysis / control apparatus is required to have a routing control function and to have high reliability against a device failure, and the cost of the device increases. Furthermore, in this method, when normal traffic is transferred to the original destination, tunneling to the user network (such as VLAN, Label Switch Path, IP in IP, etc.) Or a general technique for setting and transferring a VPN) and transferring a packet. For this reason, the abnormal traffic analysis / control apparatus manages tunnel information to all user networks, and the network sets and manages a tunnel between the abnormal traffic analysis / control apparatus and all user networks. The number of tunnels that can be set in the network is limited by the header area that is assigned during tunneling (maximum of 4096 for VLAN and Label Switch Path), so the number of tunnels set for other purposes is limited.

  Also, in order to apply this method without changing the routing information, it is necessary to attach an abnormal traffic analysis / control device to each router. In this case, an abnormal traffic analysis / control device is required corresponding to the number of routers, which increases the cost of the network.

  According to the present invention, in order to analyze and control specific traffic, a transfer route is dynamically set between a packet transfer device equivalent to a router and a packet processing device equivalent to an abnormal traffic analysis / control device to transfer the target traffic. In addition to installing a network control device, the packet processing device is equipped with a return transfer function to the packet transfer device, and the packet transfer device compares the input / output logical ports and should be referred to from multiple transfer tables. Equipped with a function to determine the table.

  As a result, it is possible to transmit traffic to be passed through the packet processing function and to be controlled to the packet processing apparatus while preventing a loop. At this time, it is not necessary for the packet processing device to have the routing control function to change the routing information of the entire network, and it is not necessary for the packet transfer device to have the packet processing device. In addition, when normal traffic is transferred to the original destination, there is no need to tunnel to the user network.

  This makes it possible to detect and analyze abnormal traffic and control in a wide area network at a low cost.

In order to solve the above-described problem, in the first invention, a traffic analysis / control system having a network control device, a packet processing device, and a packet transfer device, wherein the network control device includes an identifier of the packet transfer device, Means for receiving notification of control information consisting of packet flow information including a destination address and a source address, and forwarding to the packet processing device for a packet forwarding device corresponding to the identifier of the packet forwarding device Means for instructing route setting, means for instructing the packet processing device to set a transfer route to the packet transfer device, and assigning the packet transfer device to a transfer route to the packet processing device. An instruction to assign a logical port identifier to a packet addressed to the destination address of the packet flow information. Means for setting the transfer path to the packet transfer apparatus instructed by the network control apparatus, means for performing packet passage control processing, and receiving from the packet transfer apparatus. Means for assigning a logical port identifier assigned to a transfer path to the packet transfer apparatus and returning the packet to the packet transfer apparatus after performing packet passage control processing on the packet, The packet transfer apparatus registers a means for setting a transfer path to the packet processing apparatus instructed by the network control apparatus, packet header information, and an identifier of a logical port assigned to the transfer path to the packet processing apparatus. Other than the first forwarding table, packet header information, and the forwarding route to the packet processing device A second transfer table for registering a transfer route for outputting a packet, an identifier of a logical port to which the packet is input from the transfer route from the packet processing device, and a logic for outputting the packet to the transfer route to the packet processing device Input / output logical port comparison means for comparing a pair of port identifiers, and when the packet is input , the packet transfer device refers to the first transfer table and outputs the logic of the packet When the identifier of the logical port can be identified by searching for the identifier of the port, the identifier of the logical port assigned to the packet and the identifier of the logical port to which the packet is to be output are determined by the input / output logical port comparing means. It is determined whether or not a pair is formed. When it is determined that a pair is not formed, the logical port specified by the first forwarding table is determined. When the logical port identifier is assigned to the packet and output, and it is determined that the packet is paired, or when the logical port to which the packet is to be output cannot be specified by the first forwarding table. , Referring to the second transfer table, specifying a transfer path for outputting the packet, and outputting the packet to the transfer path specified by the second transfer table.

  In a second aspect based on the first aspect, the means for performing packet passage control processing of the packet processing device measures a cumulative value of the amount of transfer data for each destination address of the transfer packet at regular intervals. When the cumulative value of the transfer data amount of a certain destination address exceeds a predetermined threshold, the packet corresponding to the threshold excess amount is discarded in the next period with respect to the packet having the destination address. .

  According to a third aspect, in the first aspect, the means for performing the packet passage control process of the packet processing device calculates the total number of transfer packets and the total amount of transfer data for each header information of the received packet at a constant cycle. It is observed every time, and when the increase value of the total number of transfer packets and transfer data amount of certain header information exceeds a predetermined threshold value, the packet holding the header information is discarded from the next period And

  As described above, according to the present invention, in order to analyze and control specific traffic using the packet processing function, the transfer traffic is dynamically set between the packet transfer device and the packet processing device to transfer the target traffic. In addition to installing an instructing network control device, the packet processing device is equipped with a return transfer function to the packet transfer device, and the packet transfer device should compare the input / output logical ports and refer to the transfer table from a plurality of transfer tables Equipped with a function to determine.

  As a result, it is possible to transmit traffic to be passed through the packet processing function and to be controlled to the packet processing apparatus while preventing a loop. At this time, it is not necessary for the packet processing device to have the routing control function to change the routing information of the entire network, and it is not necessary for the packet transfer device to have the packet processing device.

  Therefore, the abnormal traffic detection / analysis and control in the wide area network can be realized at low cost.

Next, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows an example of a network model of a network to which the present invention is applied. The traffic analysis / control system according to the embodiment of the present invention includes packet transfer apparatuses 1 to 6, a packet processing apparatus 7, and a network control apparatus 8 for controlling them. The user terminals 9 to 16 are accommodated in the packet transfer apparatuses 1 to 4 via the access networks 17 to 20. In general, the packet transfer apparatuses 1 to 4 are called edge nodes or edge routers, and the packet transfer apparatuses 5 to 6 are called core nodes or core routers. The packet transfer apparatuses 1 to 4 are connected by packet transfer apparatuses 5 to 6. A network including the packet transfer apparatuses 1 to 6 and the packet processing apparatus is referred to as a core network 21, and a network including user terminals is referred to as a user network 22.

  The packet transfer apparatus 1 is provided with core # 1 as an address for identifying the apparatus, and the packet transfer apparatus 2 is provided with core # 2 as an address for identifying the apparatus. The device 3 is provided with a core # 3 as an address for identifying the device, and the packet transfer device 4 is provided with a core # 4 as an address for identifying the device. Is assigned a core # 5 as an address for identifying a device, the packet transfer device 6 is assigned a core # 6 as an address for identifying a device, and the packet processing device 7 The core # 7 is assigned as an address for identifying the device, and the route for reaching each is managed by the routing protocol.

  The core # 1 to core # 7 have IPv4 addresses if the core network is an IPv4 network, and OSPF (Open Shortest Path First: RFC2328) or the like is exemplified as a routing protocol at that time. If the core network is an IPv6 network, it becomes an IPv6 address. As a routing protocol at that time, OSPFv6 (Open Shortest Path First version 6: RFC2740) or the like can be cited. Further, when the core network is an MPLS (Multi-Protocol Label Switching) network (RFC3031), after specifying a route by a routing protocol, RSVP-TE (ReSerVation Protocol with Traffic Engineering: RFC3209) or CR-LDP (Constrain-based). A path called LSP (Label Switched Path) is set between the source and destination packet transfer apparatuses using a signaling protocol such as Label Distribution Protocol (RFC3212).

  Similarly, user terminal 9 is identified by address IP # 1, user terminal 10 is identified by address IP # 2, user terminal 11 is identified by address IP # 3, and user terminal 12 is identified by address IP # 2. 4, user terminal 13 is identified by address IP # 5, user terminal 14 is identified by address IP # 6, user terminal 15 is identified by address IP # 7, and user terminal 16 is addressed by address IP # 6. It is identified by IP # 8.

  FIG. 2 shows an example of a physical model of a network to which the present invention is applied. The network control device 8 is connected to each device in the network. In this embodiment, the links 108 to 114 ensure connectivity with each device. The packet transfer apparatus 1 and the packet transfer apparatus 5 are connected by a link 101, the packet transfer apparatus 2 and the packet transfer apparatus 5 are connected by a link 102, the packet transfer apparatus 3 and the packet transfer apparatus 6 are connected by a link 103, and packet transfer The device 4 and the packet transfer device 6 are connected by a link 104, the packet transfer device 5 and the packet transfer device 6 are connected by a link 105, the packet transfer device 5 and the packet processing device 7 are connected by a link 106, and the packet processing device 7 The packet transfer apparatuses not explicitly indicated as are connected by a link 107. As the link, an optical path such as an optical fiber or an optical wavelength, or a physical cable such as an Ethernet cable can be used.

  In this embodiment, logical ports are identified by labels, and input labels and output labels in the following description can be generally referred to as input logical port identifiers and output logical port identifiers, respectively.

  FIG. 3 shows a configuration example of the packet transfer apparatus of the present invention. The packet transfer apparatus includes a first transfer function 23, an input / output logical port comparison function 24, a second transfer function 25, and a server connection unit 26. 3 shows an example of the configuration of the packet transfer apparatus 5, and the links 101, 102, 105, and 106 are connected. However, the other packet transfer apparatuses are different only in the connected links, The configuration of is the same.

The first transfer function 23 has a first transfer table 27 and a logical port setting function 28.
The first transfer table 27 has a function of deriving an output label value and an output link from header information of the input packet. As shown in FIG. 7, the first transfer table 27 of the present embodiment has columns of input label, destination address (destination), output label, and output link (Output). The input label value indicates the input logical port, and the output label value indicates the output logical port. In this embodiment, a label value and a destination address are described as header information examples. Here, the default input label value indicates that no label is given. Conventionally, a network without a label is a connectionless network such as an IP network, and a network with a label is a connection-oriented network such as an MPLS network. In an IP network, an output destination is specified by a routing protocol, and in an MPLS network, an output destination is specified by a routing protocol and a signaling protocol. For this reason, the transfer table may be divided and managed based on the presence or absence of a label value. Furthermore, a transmission source address may be described as header information, and the operator may be set to output only a specific inter-user flow to another route.

  In this embodiment, the identifier (output label) of the output logical port and the output physical port (Output) are described in the first transfer table 27, but these may be described as separate tables. In this case, the entry whose input label is default is described in a table for deriving the output physical port from the destination address. In addition, entries for which input label values are specified are described in a table for deriving output label values from input label values and a table for deriving output physical ports from output label values.

  The logical port setting function 28 has a function of setting a transfer path between a destination having a specific address and a function of deleting a transfer path between the destination having a specific address. For example, when the core network is an MPLS network, the logical port setting function 28 uses a signaling protocol to set an LSP with a destination having a specific address.

  When receiving the packet, the first transfer function 23 refers to the first transfer table 27, specifies the output logical port and the output link from the header information described in the packet, and the input / output logical port comparison function described later. When the output logical port and the output link cannot be identified from the header information described in the packet with reference to the function for notifying to 24 and the first transfer table 27, the packet is sent to the second transfer function 25 described later. A function for forwarding and a logical port setting function when receiving an instruction from a network control device, which will be described later, to set a transfer path between specific addresses and send a packet having specific packet header information to a specific address 28, a transfer route is set between the specified addresses, the label corresponding to the route determined when the transfer route is set, and the corresponding route. A function of adding a new entry to the first transfer table 27 so that an output link of the route can be derived from the specific packet header information, a label corresponding to the set transfer route, and a transfer route set from a specified address It has a function of notifying an assigned label to an input / output logical port comparison function 24 described later.

  Further, the first transfer function 23 instructs the network control device described later to cancel a situation in which a transfer path is set between specific addresses and a packet having specific packet header information is transmitted to a specific address. The logical port setting function 28 deletes the transfer path between the specified addresses, deletes the entry in the first transfer table 27 relating to the label corresponding to the path, and the input / output logic described later. The port comparison function 24 has a function of notifying deletion of information relating to the label corresponding to the route.

The input / output logical port comparison function 24 has an input / output logical port management table 29.
The input / output logical port management table 29 has a function of describing a pair of an input logical port and an output logical port set between the opposing packet transfer apparatuses. In this embodiment, a pair of an input label value and an output label value is described. That is, the input / output logical port management table 29 of this embodiment has columns for input labels and output labels as shown in FIG. For example, when a bidirectional logical port is set in a VLAN or the like, the input logical port and the output logical port are the same. For example, in an MPLS network, since the LSP is basically one-way communication, the input LSP and the output LSP that are set between the opposing packet devices are basically different.

  The input / output logical port comparison function 24 uses the input / output logical port management table 29 when an output logical port is specified by the first transfer function 23, and uses a pair of output logical ports from the input logical port when the packet is received. The port is specified and compared with the output logical port notified from the first transfer function 23. When the port is different, the output information specified by the first transfer function 23 is adopted and the packet is transferred. After the output information specified by the function 23 is invalidated and the input logical port is invalidated, the packet is transferred to the second transfer function 25 described later. As described above, in this embodiment, the logical port is identified by the label value. When the input / output logical port management table 29 is used, the difference is when the output logical port specified from the input logical port when the packet is received is different from the output logical port specified by the first transfer function 23. The input logical port when the packet is received is not described in the input / output logical port management table 29.

  Further, when the input / output logical port comparison function 24 is notified of the label corresponding to the set transfer route and the label assigned to the transfer route set from the designated address by the first transfer function 23, both of them are notified. A function of registering a label value as a pair in the input / output logical port management table 29 and a network control device to be described later set a transfer path between specific addresses to direct a packet having specific packet header information to a specific address When the first transfer function 23 is notified of the deletion of the information related to the label corresponding to the route when an instruction to cancel the transmission status is given, the entry having the information is deleted. is doing.

The second transfer function 25 has a second transfer table 30.
The second forwarding table 30 has a function of deriving an output label value and an output link from the header information of the input packet. The configuration of this table is the same as that of the first transfer table 27. As shown in FIG. 7, the second transfer table 30 of this embodiment has an input label, a destination address (destination), an output label, and an output link (Output). Column.

  Entries are added and deleted from the second transfer table 30 by a routing protocol and a signaling protocol, while entries are added and deleted from the first transfer table 27 by a network control device described later. At this time, the second transfer table 30 is not a target of control from a network control device described later. In addition, unlike the present embodiment, there may be an embodiment in which entries in the first transfer table 27 are added and deleted by a routing protocol or a signaling protocol, but even in this case, priority is given to entry addition and entry deletion by the network control device. .

  When the second transfer function 25 receives the packet from the input / output logical port comparison function 24, the second transfer function 25 refers to the second transfer table 30 and identifies the output logical port and the output link from the header information described in the packet. It has a function to transmit packets.

  The server connection unit 26 receives an instruction from the network control device, and when the control based on the instruction from the network control device and the function to transfer the instruction from the network control device to each function is completed, the server connection unit 26 notifies the completion of the processing. Is transmitted to the network control device. Thus, the packet transfer apparatus sets a transfer path between the packet processing apparatuses based on an instruction from the network control apparatus, extracts a packet to be transmitted to the packet processing apparatus, and transmits only the packet to the transfer path. Further, the packet transfer apparatus does not extract the packet received from the packet processing apparatus. Thus, only a specific packet is transmitted to the packet processing device, and a loop of a packet transmitted to the packet processing device is prevented.

  FIG. 4 shows a configuration example of the packet processing apparatus of the present invention. The packet processing apparatus includes a packet processing function 31, a packet return function 32, and a server connection unit 33.

  The packet processing function 31 has a function of performing packet passage control processing. As the packet passing control process, the cumulative value of the transfer data amount for each destination address of the transfer packet is measured at regular intervals, and when the cumulative value of the transfer data amount of a certain destination address is equal to or greater than a predetermined threshold, Regarding the packet having the destination address, in the next cycle, the control corresponding to the threshold excess amount is discarded, the total number of transfer packets and the transfer data amount for each header information of the received packet are observed at regular intervals, When the increase value of the number of transfer packets of certain header information and the cumulative value of the transfer data amount exceeds a predetermined threshold value, a control for discarding the packet holding the header information from the next period is given. In these controls, a transfer packet count table that counts the number of transfer packets with respect to the destination address, a transfer data amount count table that accumulates the transfer data amount with respect to the destination address, and an entry in each table at regular intervals. A function that saves the count value and saves the count value, compares the upper stored value with the threshold value, discards packets that exceed the threshold value at the time of comparison, and determines whether or not to continue discarding at regular intervals. It is necessary to have a function to be implemented.

The packet return function 32 has a return route setting function 34 and a packet return table 35.
The return route setting function 34 has a function of setting a transfer route with a destination having a specific address and a function of deleting a transfer route set between a destination having a specific address. Yes. For example, when the core network is an MPLS network, the return path setting function 34 uses a signaling protocol to set an LSP with a destination having a specific address.

  The packet return table 35 has a function of deriving from the input logical port of the received packet an output logical port and an output physical port corresponding to the transfer path set between the transmission source packet transfer apparatuses of the packet. Then, as shown in FIG. 10, the packet return table 35 has columns of a reception label, a transmission label, and an output link (Output). From the label value of the received packet, the packet return table 35 transmits the packet between the transmission source packet transfer apparatuses. And a function for deriving the label and output link assigned to the transfer path set in (1). The function for specifying the output logical port and the output physical port may be divided into two tables. In this case, a table for specifying the output logical port from the input logical port and a table for specifying the output physical port from the output logical port are held.

  When a packet return function 32 receives an instruction to set a transfer path between specific addresses from a network control device, which will be described later, the return path setting function 34 sets a transfer path between specified addresses, When the transfer route is set from the specified address, the label corresponding to the route determined when the transfer route is set is derived from the label corresponding to the route determined when the transfer route is set. The packet return table 35 has a function of describing in the packet return table 35 such that the output destination of the route determined when the transfer route is set by itself is paired with the label assigned to the route. . Further, the packet return function 32 deletes the transfer path between the designated addresses by the return path setting function 34 when receiving an instruction to release the transfer path between specific addresses from the network control device described later. The function of deleting the entry of the packet return table 36 relating to the label corresponding to the route.

  When the server connection unit 33 receives an instruction from the network control device, passes the instruction from the network control device to each function, and completes the control based on the instruction from the network control device, the server connection unit 33 notifies the completion of the processing. Is transmitted to the network control device.

  Thereby, the packet processing device sets a transfer path between the packet transfer devices based on an instruction from the network control device, and returns a packet received from the packet transfer device to the packet transfer device.

  Further, as shown in FIG. 3, the packet forwarding apparatus prevents the packet from being looped. Thus, the packet processing apparatus has a routing control function, and can receive, analyze, and return the traffic to the packet transfer apparatus without changing the routing information of the entire network.

FIG. 5 shows a configuration example of the network control apparatus of the present invention. The network control device has a control flow management function 36 and an external device control unit 37.
The control flow management function 36 includes a packet transfer device address for transmitting the packet to the packet processing device, a function for managing the address of the packet processing device, and the above information for a packet having specific packet header information. When added, a function for notifying the external device control unit 37 of the start of control related to the information and when deleting the information, the external device control unit 37 is notified of the end of control related to the information, It has a function of deleting the information when a control completion notification is received from the external device control unit 37. In addition, when the same packet processing device and packet transfer device pair is specified for a plurality of types of packet header information, when the information is added, there is a route to the same packet processing device and packet transfer device pair. Whether or not it is set is identified from the information held by itself, and when the route has been set, the external device control unit 37 is notified that the route setting is unnecessary. Also, when the same packet processing device and packet forwarding device pair is specified for multiple types of packet header information, when deleting the information, the route between the same packet processing device and the packet forwarding device is different. Whether or not the packet header information is shared is determined from the information held by itself, and when the route is shared, the external device control unit 37 is notified that the route deletion is unnecessary.

The external device control unit 37 has a tunnel setting instruction function 38 and a route setting instruction function 39.
The tunnel setting instruction function 38 sets a transfer path to the address indicating the packet processing device for the packet transfer device and the packet processing device notified of the start of control by the control flow management function 36. A function for instructing the packet processing device to set a transfer path addressed to the address indicating the packet transfer device, and the packet transfer device and packet notified of the end of control by the control flow management function 36 Instructs the processing device to delete the transfer path addressed to the address indicating the packet processing device to the packet transfer device, and deletes the transfer route addressed to the address indicating the packet transfer device to the packet processing device It has a function to instruct to do so.

  The path setting instruction function 39 specifies the header information of the packet to be output to the transfer path between the packet transfer apparatus and the packet processing apparatus from the control flow management function 36, and the packet having the packet header information is It has a function of instructing to add an entry to be output to the transfer path to the first transfer table and a function of instructing the packet transfer apparatus to delete the entry of the first transfer table related to specific packet header information.

  The external device control unit 37 is notified of the address of the packet transfer device that transmits the packet to the packet processing device and the address of the packet processing device for the packet having specific packet header information from the control flow management function 36. At this time, the tunnel setting instruction function 38 instructs the apparatus to set a transfer path between the apparatuses, and the route setting instruction function 39 newly sets a packet having the packet header information to the packet transfer apparatus. The function to instruct to add the entry for output to the transfer path to the first transfer table and whether the completion notification of each control has been received from the relevant device. When the instruction to delete the information is received from the function to try the above setting and the control flow management function 36 The tunnel setting instruction function 38 instructs the apparatus to delete the transfer path between the apparatuses, and the path setting instruction function 39 deletes the first transfer table entry for outputting a packet to the transfer path between the apparatuses. A function for instructing the packet transfer apparatus, a function for managing whether a notification of completion of each control is received from the apparatus, a function for trying the above setting again when reception of the notification for a certain time cannot be confirmed, and a function for each control When the completion notification is received from the device, the control flow management function 36 is notified of the completion of control. When notified from the control flow management function 36 that a new transfer path setting is unnecessary, the operation by the tunnel setting instruction function 38 is omitted. Further, when notified from the control flow management function 36 that route deletion is unnecessary, the operation by the tunnel setting instruction function 38 is omitted.

  Thereby, a transfer path is dynamically set between the packet transfer device and the packet processing device, and a specific transfer packet can be transmitted to the packet processing device based on the packet header condition.

  As a result, abnormal traffic detection / analysis and control in the wide area network can be performed centrally by the packet processing device, and abnormal traffic protection can be realized at low cost.

  Next, an operation example of the present invention will be described using the network model of FIG. In the initial state, a packet is transferred between the user # 1 and the user # 5 via the packet transfer device 1, the link 101, the packet transfer device 5, the link 105, the packet transfer device 6, the link 103, and the packet transfer device 3. . It is assumed that control for detouring the flow to the packet processing device 7 is performed.

FIG. 7 shows an operation example of the packet transfer apparatus 5 before the detour control to the packet processing apparatus.
As shown in FIG. 7, the first transfer table 27 included in the first transfer function 23 has columns of input label, destination address (destination), output label, and output link (Output). The input / output logical port management table 29 included in the function 24 has input label and output label fields, and the second transfer table 30 included in the second transfer function 25 includes an input label, a destination address (destination), an output label, It has a column for output link (Output). At this point, nothing is registered in the first transfer table 27 and the input / output logical port management table 29, but the second transfer table 30 has an input label, a destination address (destination), and an output as shown in FIG. Assume that a label and an output link (Output) are registered.

  As shown in FIG. 7, when the packet transfer apparatus 5 receives a packet whose destination address (Dst) is user # 5 and whose source address (Src) is user # 1, in the first transfer function 23, Since the output destination cannot be specified by referring to one transfer table, the packet is transferred to the second transfer function 25. In the second transfer function 25, the second transfer table is referenced, the input label value is default, and the destination address is user. The output link 105 is specified from the search key # 5, and the packet is output to the link 105. The packet output to the link 105 is transferred to the user # 5 via the packet transfer device 6 and the packet transfer device 3 as shown in FIG.

FIG. 8 shows an operation example of the network control device at the start of detouring to the packet processing device.
The network control device 8 includes header information (packet flow information including a destination address and a source address) to be controlled, an identifier (for example, an address) of a packet transfer device that extracts the packet, and a packet processing device that transmits the packet. When an identifier (for example, an address) is input (when a notification is received), the information is stored in the control flow management function 36. That is, as shown in FIG. 8, the control flow management function 36 includes a destination address (Dst): user # 5, a packet transfer device address: core # 5 (packet transfer device 5 address), and a packet processing device address. : Core # 7 (address of packet processing device 7) is stored. The header information, the packet transfer device identifier, and the packet processing device identifier can be manually input when the operator detects suspicious traffic, for example. In addition, when an abnormal traffic detecting device such as an information transfer processing device or Anomaly Detector detects abnormal traffic, a notification can be transmitted and input.
Further, the following control is performed.
(A) The tunnel setting instruction function 38 is used to instruct the address core # 5 indicating the packet transfer apparatus to set the transfer path to the address core # 7 indicating the detour destination packet processing apparatus.
(B) The tunnel setting instruction function 38 is used to instruct the address core # 7 indicating the packet processing apparatus to set the transfer path to the address core # 5 indicating the detour packet transfer apparatus.
(C) Using the route setting instruction function 39, the address core # 5 (packet transfer device 5) indicating the packet transfer device is transferred to the address core # 7 (packet processing device 7) indicating the detour destination packet processing device. An instruction is given to assign the label assigned to the transfer path to the packet whose destination address is user # 5.

  At this time, when the control flow management function 36 manages a plurality of flows and there is another entry having the packet transfer device core # 5 and the packet processing device core # 7, the processing of (a) and (b) Is omitted.

FIG. 9 shows an operation example of the packet transfer device 5 at the start of detouring to the packet processing device.
In response to the instruction (a) from the network control device 8, the packet transfer device 5 uses the logical port setting function 28 to set a transfer path to the packet processing device core # 7 and assigns the label # 1. At this time, the transfer path corresponding to (b) is also set from the packet processing device core # 7. The packet transfer device 5 uses the first transfer function 23 to identify the label # 1 assigned to the former transfer route and the label # 2 assigned to the latter transfer route, label the input label as label # 2, and output The label is registered in the input / output logical port management table 29 as label # 1. Further, in response to the instruction (c) from the network control apparatus, the label # 1 and label # 1 assigned to the transfer path are assigned to the designated header condition “packet whose destination address is user # 5”. An entry for specifying the corresponding output link 106 is added to the first transfer table 27. Here, the input label value is an arbitrary value, and the entry is valid for all input label values including the default. As a result, as shown in FIG. 9, in the first transfer table 27, input label: all, destination address: user # 5, output label: label # 1, output link (Output): 106 are registered and input / output is performed. In the logical port management table 29, input label: label # 2 and output label: label # 1 are registered.

  At this time, when the same packet as in FIG. 7 is received, the first transfer function 23 refers to the first transfer table, and from the search key that the input label value is the default and the destination address is the user # 5, the output label # 1, the output link Since the input label value is default in the input / output logical port comparison function 24, the output destination specified by the first transfer function 23 is adopted, the label # 1 is given to the packet, and the link 106 is specified. Output.

  As described above, when header information to be controlled, an identifier (for example, an address) of a packet transfer device that extracts the packet, and an identifier (for example, an address) of a packet processing device that transmits the packet are input to the network control device. The packet can be transmitted to the packet processing device.

FIG. 10 shows an operation example of the packet processing device 7 at the start of detouring to the packet processing device.
In response to the instruction (b) from the network control device, the packet processing device 7 uses the return route setting function 34 to set a transfer route for the packet transfer device core # 5 and assigns label # 2. At this time, the transfer path corresponding to (a) is also set from the packet transfer apparatus core # 5. The packet processing device uses the packet return function 32 to identify label # 2 assigned to the former transfer path and label # 1 assigned to the latter transfer path, and return label # 2 from label # 1. An entry for specifying the output link 106 for label # 2 is set in the packet return table 35. As a result, as shown in FIG. 10, the packet return table 35 is registered with reception label: label # 1, transmission label: label # 2, and output link (Output): 106.

  At this time, when the packet with label # 1 transferred from the packet transfer apparatus 5 of FIG. 9 is received, the packet processing function 31 is relayed, and the packet that is not the control target is transferred to the packet return function 32. The packet return function 32 specifies the label # 2 and the output link 106 to be output from the label # 1 of the packet to the return path, deletes the label # 1, and re-encapsulates the label # 2 to the link 106. Send the packet.

  As described above, when header information to be controlled, an identifier (for example, an address) of a packet transfer device that extracts the packet, and an identifier (for example, an address) of a packet processing device that transmits the packet are input to the network control device. The packet is transmitted to the packet processing device, analyzed by the packet processing device, and then the packet related to normal traffic is returned to the packet transfer device from which the packet is extracted.

  This makes it possible to set a detour route to the packet processing device and to analyze and control abnormal traffic.

FIG. 11 shows an operation example of the packet transfer apparatus 5 after the detour control to the packet processing apparatus.
When the packet transfer apparatus 5 receives the packet with label # 2 transferred from the packet processing apparatus 7 of FIG. 10, in the first transfer function 23, the input label value is label # 2 and the destination address is user # 5. In the input / output logical port comparison function 24, the output label # 1 and the output link 106 are specified from the entry whose input label value is arbitrary and the destination address is user # 5. A pair of label # 1 is specified from input label # 2.

  At this time, since the output label value specified by the input / output logical port comparison function 24 and the output label value specified by the first transfer function 23 are the same, after the input label value label # 2 is invalidated, the second transfer function The second transfer function 25 searches the second transfer table using a search key whose input label value is default and destination address is user # 5 in the second transfer function 25, specifies the output link 105, Output to the link 105.

  As described above, in the packet transfer apparatus, the second transfer that holds the normal transfer information, not the first transfer function applied when transmitting the packet to the packet processing apparatus, with respect to the packet received from the packet processing apparatus. Apply function. This prevents the packet from looping between the packet transfer device and the packet processing device.

  FIG. 12 shows a transfer path after detour control to the packet processing device. Between user # 1 and user # 5, packet transfer device 1, link 101, packet transfer device 5, link 106, packet processing device 7, link 106, packet transfer device 5, link 105, packet transfer device 6, link 103, Packets are transferred via the packet transfer device 3.

  Thus, the present invention can bypass a specific packet to the packet processing device 7 while preventing a loop between the packet transfer device 5 and the packet processing device 7.

  The packet transfer device, the packet processing device, and the network control device described above have means for realizing the functions, and the means can be configured using a computer and a program. Further, hardware may be used in place of part or all of the program.

  As described above in detail with reference to the embodiments, the network control device, the packet processing device, and the packet transfer device that constitute the traffic analysis / control system of the present embodiment have the following characteristics.

  A network control device for receiving notification of control information including an identifier of a packet transfer device, packet flow information including a destination address and a source address, and a packet transfer device corresponding to the identifier of the packet transfer device Means for instructing transfer path setting to the packet processing device, means for instructing the packet processing device to set transfer route to the packet transfer device, and Means for instructing to assign an identifier of the logical port assigned to the transfer path to the packet processing device to the packet addressed to the destination address of the packet flow information.

  The packet processing device includes: means for setting a transfer path to the packet transfer device designated by the network control device; means for performing packet pass control processing; and packet pass control for the packet received from the packet transfer device. Means for assigning a logical port identifier assigned to a transfer path to the packet transfer apparatus to the packet and returning the packet to the packet transfer apparatus after processing.

  The packet transfer apparatus registers a means for setting a transfer path to the packet processing apparatus instructed by the network control apparatus, packet header information, and an identifier of a logical port assigned to the transfer path to the packet processing apparatus. Packets are sent from the first forwarding table, the packet header information, the second forwarding table for registering the forwarding route for outputting packets other than the forwarding route to the packet processing device, and the forwarding route from the packet processing device. Input / output logical port comparison means for comparing the input logical port identifier and the logical port identifier pair that outputs the packet to the transfer path to the packet processing device. When a packet is input, the identifier of the logical port to which the packet is to be output is searched with reference to the first forwarding table, and when the identifier of the logical port can be specified, the input / output logic When it is determined by the port comparison means whether or not the logical port identifier assigned to the packet and the logical port identifier to which the packet is to be output do not form a pair, When the logical port specified by the first forwarding table is assigned with the logical port identifier to the packet, and is output, and the packet is judged by the first forwarding table If the logical port to which the packet is to be output cannot be identified, the second forwarding table is identified by referring to the second forwarding table to identify the forwarding route to which the packet is to be outputted. Outputting the packet to a more particular transfer path.

  As a result, it is possible to transmit the traffic to be subjected to the packet passing control process to the packet processing apparatus while preventing a loop, and at that time, the packet processing apparatus does not need to have the routing control function and change the routing information of the entire network. In addition, there is no need for the packet transfer device to have a packet processing device. Therefore, the abnormal traffic detection / analysis and control in the wide area network can be realized at low cost.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

2 shows an example of a network model of a network to which the present invention is applied. 2 shows an example of a physical model of a network to which the present invention is applied. 1 shows a configuration example of a packet transfer apparatus according to the present invention. 1 shows a configuration example of a packet processing apparatus according to the present invention. 2 shows a configuration example of a network control device of the present invention. The transfer path example before the detour control to the packet processing device is shown. The operation example of the packet transfer apparatus 5 before the detour control to a packet processing apparatus is shown. An example of the operation of the network control device when starting detour control to the packet processing device is shown. The operation example of the packet transfer apparatus 5 at the time of the start of the detour control to a packet processing apparatus is shown. An operation example of the packet processing device 7 at the time of starting detour control to the packet processing device is shown. The operation example of the packet transfer apparatus 5 after the detour control to a packet processing apparatus is shown. The transfer path example after the detour control to the packet processing device is shown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1-6 ... Packet transfer apparatus, 7 ... Packet processing apparatus, 8 ... Network control apparatus, 9-16 ... User terminal, 17-20 ... Access network, 21 ... Core network, 22 ... User network, 23 ... First transfer function 24 ... Input / output logical port comparison function, 25 ... Second transfer function, 26 ... Server connection unit, 27 ... First transfer table, 28 ... Logical port setting function, 29 ... Input / output logical port management table, 30 ... Second Transfer table 31 ... Packet processing function 32 ... Packet return function 33 ... Server connection unit 34 ... Return path setting function 35 ... Packet return table 36 ... Control flow management function 37 ... External device control unit 38 ... Tunnel setting instruction function, 39 ... route setting instruction function, 101 to 114 ... link

Claims (3)

A traffic analysis / control system having a network control device, a packet processing device, and a packet transfer device,
The network controller is
Means for receiving notification of control information comprising an identifier of a packet transfer device, and packet flow information including a destination address and a source address;
Means for instructing a packet transfer device corresponding to the identifier of the packet transfer device to set a transfer route to the packet processing device;
Means for instructing the packet processing device to set a transfer route to the packet transfer device;
Means for instructing the packet transfer apparatus to assign an identifier of a logical port assigned to a transfer path to the packet processing apparatus to a packet addressed to a destination address of the packet flow information;
With
The packet processing device
Means for setting a transfer path to the packet transfer apparatus instructed from the network control apparatus;
Means for performing packet passing control processing;
Means for assigning a logical port identifier assigned to a transfer path to the packet transfer apparatus and returning the packet to the packet transfer apparatus after performing packet passage control processing on the packet received from the packet transfer apparatus When,
With
The packet transfer device includes:
Means for setting a transfer path to the packet processing device instructed by the network control device;
A first transfer table for registering packet header information, and an identifier of a logical port assigned to a transfer path to the packet processing device;
Packet transfer header information, a second transfer table for registering a transfer route for outputting a packet other than the transfer route to the packet processing device, and
An input / output logical port comparing means for comparing a pair of logical port identifiers to which packets are input from a transfer path from the packet processing device and a logical port identifier for outputting packets to the transfer route to the packet processing device;
With
The packet transfer device includes:
When a packet is input, the identifier of the logical port to which the packet is to be output is searched with reference to the first forwarding table, and when the logical port identifier can be specified, the input / output logical port comparison is performed. Means for determining whether the identifier of the logical port assigned to the packet and the identifier of the logical port to which the packet is to be output do not form a pair;
If it is determined that the pair is not formed, the logical port identified by the first forwarding table is assigned the logical port identifier to the packet and output,
When it is determined that a pair is formed, and when the logical port to which a packet is to be output cannot be specified by the first transfer table, the packet should be output with reference to the second transfer table. A traffic analysis / control system characterized by specifying a transfer route and outputting the packet to a transfer route specified by the second transfer table. The traffic analysis / control system according to claim 1,
The means for performing the packet passing control process of the packet processing device measures the cumulative value of the transfer data amount for each destination address of the transfer packet at regular intervals, and the cumulative value of the transfer data amount of a certain destination address is predetermined. A traffic analysis / control system characterized by discarding a packet corresponding to a threshold excess amount in the next period for a packet having the destination address when the threshold value is exceeded. The traffic analysis / control system according to claim 1,
The means for carrying out the packet passage control processing of the packet processing device observes the total number of transfer packets and transfer data amount for each header information of the received packet at regular intervals, and transfers the number of transfer packets and transfer data of certain header information. A traffic analysis / control system characterized by discarding a packet having the header information from the next period when an increase value of a cumulative value of a quantity exceeds a predetermined threshold value.

Images