JP4899973B2 - Communication security system and communication security device - Google Patents

Description

  The present invention relates to an IP (Internet Protocol) network, and more particularly to a communication security system and a communication security apparatus that execute security processing in an IP network.

  In an IP network (hereinafter simply referred to as a network) connected so that information communication can be performed between a plurality of computers, it has a very high level of convenience, while a malicious user is infected with a computer virus or illegal access. Is always exposed to the danger of such attacks. In order to counter such an unfair attack, for example, it is necessary to enhance the security function by installing software for detecting computer viruses or unauthorized access in a terminal device or server device connected on the network. In order to counter new computer viruses and new unauthorized access methods, it is necessary to always install the latest software.

Furthermore, in order to enhance security, it is necessary to introduce some security function on the network, for example, a function of discarding unauthorized packets. Such a security function introduced on the network is implemented in a router, a switch, a bridge type device sandwiched between communication paths, and the like (for example, see Patent Document 1). Such security functions introduced on the network need to be constantly added with the latest functions to counter new attack methods.
JP 2004-104709 A

  However, when a security function is implemented in a router, switch, or bridge-type device as in the method disclosed in Patent Document 1, a network design change or a network wiring change is performed when a new security function is implemented. There is a problem that work such as replacement of an existing device connected to the network is required, which complicates a very troublesome work and increases costs.

  Therefore, the present invention has been proposed in view of the above-described circumstances, and can be performed on the network without performing work such as design change to the network, change of the network wiring, and replacement of existing equipment connected to the network. It is an object of the present invention to provide a communication security system and a communication security device that can easily add a security function and reduce costs.

  A communication security system according to the present invention includes a router that interconnects an internal network and an external network, forwards a packet based on a predetermined routing rule, and a communication security device that is branched and connected to the internal network. The communication security device is a terminal communication unit that performs packet communication with a terminal device connected to the internal network, a router communication unit that performs packet communication with the router, the terminal communication unit, and the router communication. The above-mentioned problem is solved by having security processing means for executing security processing for judging the validity of the packet acquired by each packet communication by the means.

  In the communication security system of the present invention, when the communication security device performs a packet communication from the external network to the internal network according to a predetermined routing rule set in the router, the packet is transferred to the communication security device. Routing rule changing means for changing the routing rule, and the router forwards a packet to be transmitted to the internal network to the communication security device in response to the routing rule being changed by the routing rule changing means. . Then, the above-mentioned problem is solved by setting the routing rule of the terminal device so that the packet is transferred to the communication security device in the packet communication from the internal network to the external network.

  In the communication security system of the present invention, the communication security apparatus includes a storage unit storing an address table that describes an IP address of a router existing on the internal network, and an address table stored in the storage unit. The stop instruction means for instructing all routers described in the address table to stop the function of returning the ARP response packet as a response to the ARP request packet, and the ARP request packet for the router. ARP processing means for generating an ARP response packet for the ARP request packet in response to the reception and returning the ARP response packet to the transmission source of the ARP request packet. The router solves the above-mentioned problem by stopping the function of returning an ARP response packet in response to an instruction from the stop instruction unit.

  Further, the communication security system according to the present invention includes the table generation means for searching for a router existing on the internal network and generating an address table to be stored in the storage means. To solve.

  In the communication security system of the present invention, the communication security device sets a routing rule of the terminal device so that a packet is transferred to the communication security device in packet communication in the internal network. All terminal devices connected to the internal network are set to stop the function of returning an ARP response packet that is a response to the ARP request packet. Then, the ARP processing means of the communication security device generates an ARP response packet for the ARP request packet in response to receiving the ARP request packet for the terminal device in the packet communication in the internal network, and generates an ARP request The above-mentioned problem is solved by returning the packet to the transmission source.

  The communication security device of the present invention includes a router that interconnects an internal network and an external network, forwards a packet based on a predetermined routing rule, and a communication security device that is branched and connected to the internal network. The communication security apparatus of the communication security system, wherein terminal communication means for performing packet communication with a terminal device connected to the internal network, router communication means for performing packet communication with the router, the terminal communication means, the router Having the security processing means for executing the security processing for judging the validity of the packet acquired by each packet communication by the communication means solves the above-mentioned problem.

  According to the present invention, it is possible to easily add a security function on a network without performing a work such as a network design change, a network wiring change, or replacement of an existing device connected to the network, Costs can be reduced.

  Further, according to the present invention, it is possible to reliably perform security processing on the packet by the security processing means.

  In addition, according to the present invention, it is possible to prevent a security function from passing through and to guide a packet to pass through a communication security device.

  Further, according to the present invention, it is possible to greatly reduce the labor required for the user when generating the address table to be stored in the storage means.

  Further, according to the present invention, security processing can be reliably performed even in the internal network.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. First, a communication security system shown as an embodiment of the present invention will be described with reference to FIG.

As shown in FIG. 1, in the communication security system, a LAN (Local Area Network) 40 that is an internal network and an IP (Internet Protocol) network 50 that is an external network are connected to each other via a router 20. A plurality of terminal devices 5 _n (n is a natural number) and the security gateway device 10 are branched and connected to the LAN 40. The server device 30 is connected to the IP network 50.

In the communication security system having such a configuration, the terminal device 5 _n connected to the LAN 40 that is the internal network and the server device 30 connected to the IP network 50 that is the external network can perform packet communication with each other. .

At this time, a packet transmitted from the terminal device 5 _n to the outside of the LAN 40 always passes through the security gateway device 10, and a packet transmitted from the server device 30 into the LAN 40 always passes through the security gateway device 10. _Next , the routing rule for the terminal device 5 _n and the router 20 is changed. The change of the routing rule for the terminal device 5 _n is manually executed by the user, and the change of the routing rule for the router 20 is executed by the security gateway device 10.

Due to the change of the routing rule, the packet PT1 transmitted from the terminal device 5 _n is once transferred to the security gateway device 10 connected to the LAN 40 as shown in FIG. The server device 30 is reached via The packet PT2 transmitted from the server apparatus 30 via the router 20 via the IP network 50, arrives from once been transferred to the security gateway device 10 connected to LAN40 to the terminal device 5 _n.

  Next, the configuration of the security gateway device 10 will be described with reference to FIG. The security gateway device 10 includes a communication interface 11, a communication control unit 12, a security function unit 13, a routing processing unit 14, a router information list storage unit 15, an ARP (Address Resolution Protocol) processing unit 16, and an automatic setting. A function unit 17, a security function management unit 18, a setting information storage unit 19a, and a log recording unit 19b are provided. Such a security gateway device 10 is connected to the LAN 40 with a single LAN cable.

  The communication interface 11 relays packet transfer between the LAN 40 and the communication control unit 12.

  The communication control unit 12 checks the type of packet (ARP packet, IP packet) received from the communication interface 11. The communication control unit 12 delivers the ARP packet to the ARP processing unit 16, and delivers the IP packet to the security function unit 13. In addition, the communication control unit 12 passes the packet received from the routing processing unit 14 and the ARP processing unit 16 to the communication interface 11.

  The security function unit 13 performs predetermined security processing such as filtering and encryption on the packet received from the communication control unit 12 to determine the validity of the packet. The security process performed by the security function unit 13 may be a single security process or a plurality of security processes, and is performed according to the security function implemented in the security gateway device 10. Processing is decided. The security function unit 13 delivers the security-processed packet to the routing processing unit 14.

  The security function by the security function unit 13 can be implemented as software or can be implemented as external hardware. In other words, since the security function of the security gateway device 10 can be implemented simply by changing the function of the security function unit 13, the security gateway device 10 connected to the LAN 40 can be mounted and deleted very easily without removing the security gateway device 10. You can make changes.

  When the security function unit 13 receives a setting change command from the security function management unit 18, the security function unit 13 changes the setting information stored in the setting information storage unit 19a. The log information recorded in the log recording unit 19b is reported to the security function management unit 18.

  The setting information stored in the setting information storage unit 19 a and the log information recorded in the log recording unit 19 b depend on the security function installed in the security gateway device 10. For example, when the firewall function is implemented as the security function, the setting information storage unit 19a and the log recording unit 19b store and record the filtering setting and the log information of the filtered packet, respectively, and implement the traceback function. If it is, the IP address setting of the manager device and the packet passage log are stored and recorded, respectively.

  The routing processing unit 14 checks the destination IP address of the packet received from the security function unit 13, the automatic setting function unit 17, and the security function management unit 18.

  For example, if the destination IP address of the packet is that of the security gateway device 10 itself and the destination port number is used by the automatic setting function unit 17, the routing processing unit 14 automatically sets the function unit. The packet is transferred to 17. If the destination IP address of the packet is that of the security gateway apparatus 10 itself and the destination port number is used by the security function management unit 18, the packet is delivered to the security function management unit 18. If the destination IP address of the packet is not that of the security gateway device 10 itself, the destination IP address of the packet is determined according to the stored routing table and transferred to the communication control unit 12.

  The router information list storage unit 15 stores a router information list that is an address table indicating the location of a router existing on the LAN 40. FIG. 3 shows an example of the router information list. As shown in FIG. 3, the router information list includes an IP address, model information, and login ID and password as login information when a router setting is remotely changed. And holding. These router information lists are registered in advance by the user.

  In an IPv6 (Internet Protocol Version 6) environment, a router existing on the LAN 40 can be searched, and a router information list can be automatically generated and stored in the router information list storage unit 15. Thereby, the labor required for the initial setting by the user can be significantly reduced.

  When receiving the ARP request packet from the communication control unit 12, the ARP processing unit 16 checks the target IP address of the ARP request packet. When the target IP address is that of the router 20 registered in the router information list stored in the router information list storage unit 15 or that of the security gateway device 10 itself, the ARP processing unit 16 An ARP reply packet in which the MAC (Media Access Control address) address of the security gateway device 10 is written is generated and transferred to the communication control unit 12.

  The automatic setting function unit 17 starts an operation at a timing instructed by the user of the security gateway device 10 and automatically performs various settings for the router 20. When the operation is started, the automatic setting function unit 17 refers to the router information list stored in the router information list storage unit 15, generates a communication packet for accessing each router 20, and the routing processing unit 14. Pass to. Further, the automatic setting function unit 17 receives the response packet from the router 20 from the routing processing unit 14. Various setting processes for the router 20 by the automatic setting function unit 17 will be described in detail later.

  The security function management unit 18 executes processing according to the contents of the packet received from the routing processing unit 14. When the packet includes a setting change request, the security function management unit 18 issues a setting change command to the security function unit 13.

  Further, when a log reference request is included in the packet, the security function management unit 18 issues a log reference command to the security function unit 13 and receives a log report from the security function unit 13. Upon receiving the log report, the security function management unit 18 generates an appropriate response packet and passes it to the routing processing unit 14.

  Next, the automatic setting processing operation for the router 20 by the automatic setting function unit 17 of the security gateway device 10 will be described using the flowchart shown in FIG. In the automatic setting process by the automatic setting function unit 17, all routers 20 registered in the router information list stored in the router information list storage unit 15 are accessed, and the setting is automatically changed. Is.

  First, in step S1, the automatic setting function unit 17 substitutes 1 for a variable i (i = 1).

  In step S <b> 2, the automatic setting function unit 17 refers to the router information list and accesses the i-th router 20.

  In step S <b> 3, the automatic setting function unit 17 changes the routing rule of the i-th router 20.

Normally, when the router 20 receives a packet addressed to the IP address of the terminal device 5 _n in the LAN 40, a routing rule is set so that the packet is directly transferred to the destination IP address. In step S3, to change this setting, the router 20 when receiving a packet addressed to the IP address of the terminal device 5 _n in LAN 40, to change the routing rules to forward to the security gateway device 10.

As a result, since the packet transmitted from the server device 30 to the terminal device 5 _{n in} the LAN 40 can be surely passed through the security gateway device 10, a predetermined security process by the security function unit 13 is applied to the packet. Can be applied reliably.

On the other hand, as described above, the routing rules of the terminal device 5 _n is changed manually by the user, always security gateway device 10 a packet transmitted to the server apparatus 30 of LAN40 out from the terminal device 5 _n Similarly, the security function unit 13 can reliably perform predetermined security processing on the packet because the packet can be routed.

  As described above, the security gateway device 10 performs security processing on packets passed through the changed routing rule, and is different from a so-called proxy.

  In step S4, the automatic setting function unit 17 turns off the ARP response function of the router 20. Specifically, depending on the type of the router 20, there are three types: one that can turn off only the ARP response function, one that can turn off the entire ARP function, and one that cannot turn off the ARP function.

  Therefore, the router 20 that can turn off only the ARP response function is turned off as it is. In the case of the router 20 in which only the ARP response function cannot be turned off but the entire ARP function can be turned off, the entire ARP function is turned off, and at the same time, the IP address and MAC address of the security gateway device 10 are statically stored in the ARP table of the router 20. To set. If the router 20 cannot turn off the ARP function, nothing is executed in this step S4.

Processing in step S4, by an operation of setting errors and malicious user routing rules set in the terminal device 5 _n, directly routers a packet transmitted from the terminal device 5 _n without passing through the security gateway device 10 This is a process for coping with a situation such as reaching 20. Thus, turning off the ARP response function of the router 20, for ARP request packet from the terminal device 5 _n is be transmitted, never to return an ARP reply packet writing the MAC address of the router 20, the terminal device 5 communication link with the _n directly router 20 can avoid that will be established, it is possible to prevent the slipping of the security features.

  In step S5, the automatic setting function unit 17 sets a MAC address filter. Specifically, the automatic setting function unit 17 turns on (ON) the MAC address filter function that the router 20 has, and sets so as not to accept communication other than the MAC address that the security gateway device 10 has.

The process of step S5 is a process for more firmly preventing a security function from passing through. For example, when the MAC address of the router 20 has been acquired by a malicious user by some method, the MAC address filter is set in this way, and the direct operation is performed from the terminal device 5 _n to the router 20. Access can be denied.

  In step S6, the automatic setting function unit 17 determines whether or not the automatic setting processing from step S1 to step S5 has been executed for all routers 20. When the automatic setting function unit 17 refers to the router information list and executes the setting process for all the routers 20, the automatic setting function unit 17 ends the process. On the other hand, if there is a router 20 that has not yet been set, Then, the process proceeds to step S7.

  In step S7, the automatic setting function unit 17 increments the variable i by 1, and repeats the processing from step S2.

In this way, the automatic setting function unit 17 of the security gateway device 10 sets the routing rules of all the routers 20 existing on the LAN 40 and registered in the router information list to the IP address of the terminal device 5 _n in the LAN 40. The packet is always changed so as to pass through the security gateway device 10. Thereby, since the packet addressed to the terminal device 5 _n in the LAN 40 transmitted from the server device 30 or the like existing on the IP network 50 always passes through the security gateway device 10, the security function unit 13 sends the packet to the security gateway device 10. Security processing is performed by the implemented security function.

The automatic setting function unit 17 of the security gateway devices 10, clear the ARP response function, by turning on the setting of the MAC address filter, there misconfigured or malicious routing rules set in the terminal device 5 _n users Since it is possible to avoid packet communication from the terminal device 5 _n directly to the router 20 by the operation according to, it is possible to prevent the security gateway device 10 from slipping through the security processing.

  Next, the processing operation when the security gateway apparatus 10 receives a packet from the LAN 40 will be described using the flowchart shown in FIG.

  In step S <b> 11, the security gateway device 10 receives a packet from the LAN 40 via the communication interface 11.

  In step S12, in response to receiving the packet, the communication control unit 12 determines whether the received packet is an ARP request packet. If the received packet is an ARP request packet, the communication control unit 12 proceeds to step S13. If not, the communication control unit 12 proceeds to step S16.

  In step S <b> 13, the ARP processing unit 16 determines whether or not the Target IP address of the ARP request packet is that of the security gateway device 10. If the Target IP address of the ARP request packet is that of the security gateway apparatus 10, the ARP processing unit 16 proceeds to step S15, and if not, proceeds to step S14.

  In step S <b> 14, the ARP processing unit 16 determines whether or not the Target IP address of the ARP request packet is included in the router information list stored in the router information list storage unit 15. If the Target IP address of the ARP request packet is included in the router information list, the ARP processing unit 16 proceeds to step S15. If not included, the ARP processing unit 16 ends the process.

  In step S15, the ARP processing unit 16 generates an ARP reply packet in which the MAC address of the security gateway device 10 itself is written and sends it back to the transmission source of the ARP request packet.

Processing in step S15, due misconfigured routing rules set in the terminal device 5 _n, the packet transmitted from the terminal device 5 _n will reach directly the router 20 without going through the security gateway device 10 In this case, it is a process for guiding the packet transmitted from the terminal device 5 _n to pass through the security gateway device 10.

In step S4 in the flowchart of FIG. 4 described above, on turning off the ARP response function of the router 20, security gateway device 10, an ARP request IP address of the router 20 broadcast from the terminal device 5 _n is written in response to the received, it returns an ARP reply packet writing the MAC address of itself to the transmission source terminal device 5 _n. As a result, even if the terminal device 5 _n transmits the packet to the router 20, the packet can be always guided through the security gateway device 10.

As a result, the security gateway device 10 can detect the MAC address and IP address of the terminal device 5 _n having a setting error, and can notify the system administrator by means such as mail.

  In step S16, the security function unit 13 performs predetermined security processing.

  In step S17, the security function unit 13 determines whether or not the packet is discarded in the security process in step S16. If the packet is discarded, the security function unit 13 terminates the process. If the packet is not discarded, the security function unit 13 advances the process to step S18.

  In step S <b> 18, the routing processing unit 14 determines whether the destination IP address of the packet is that of the security gateway device 10. If the destination IP address of the packet is that of the security gateway device 10, the routing processing unit 14 proceeds to step S19, otherwise proceeds to step S20.

  In step S19, the routing processing unit 14 selects an appropriate application based on the port number included in the packet, and performs processing by the application. For example, the application includes the automatic setting function unit 17 and the security function management unit 18 described above, and details of processing depend on the application.

  In step S20, the routing processing unit 14 executes a routing process and determines an appropriate transfer destination.

  In the security gateway device 10, since the address of the external network and the IP address of the router 20 are linked as a routing rule, a packet addressed to the external network subjected to a predetermined security process via the security device 10 To the target router 20. That is, the security gateway device 10 executes a processing operation different from a so-called proxy.

  In step S <b> 21, the routing processing unit 14 transfers the packet to the determined transfer destination via the communication control unit 12.

  In this way, the security gateway device 10 executes appropriate processing depending on whether the packet received via the LAN 40 is an ARP request packet or a packet addressed to an IP address outside the LAN 40.

In the communication security system described above, when the terminal device 5 _n on the LAN 40 that is the internal network and the server device 30 on the IP network 50 that is the external network perform packet communication via the router 20, the branch is made on the LAN 40. The security processing is surely performed by always passing through the security gateway device 10 connected in such a manner.

This can also be applied to the LAN 40 that is an internal network, and security processing can be surely performed by always passing through the security gateway device 10 in packet communication between the terminal devices 5 _n in the LAN 40.

Specifically, the routing rule in the packet communication between the terminal devices 5 _n in the LAN 40 which is the internal network is set so that the packet is surely transferred to the security gateway device 10, and all the terminals connected to the LAN 40 are set. The apparatus 5 _n is set to stop the function of returning an ARP reply packet that is a response corresponding to the ARP request packet. Note that the security gateway device 10 holds a list related to the terminal device 5 _n existing on the LAN 40, similarly to the router information list that is a list of the routers 20 existing on the LAN 40.

Thus, when the ARP response function of the terminal device 5 _n is turned off, even when an ARP request packet is transmitted from another terminal device 5 _n , an ARP reply packet in which the MAC address of the terminal device 5 _n is written back is returned. since no, even if they are operated by setting mistake or malicious users of routing rules, it is possible to avoid that between terminals 5 _n direct communication links are established, the slipping of the security features Can be prevented.

Further, the ARP processing unit 16 of the security gateway device 10 generates an ARP reply packet for the ARP request packet in response to receiving the ARP request packet for the terminal device 5 _n in the packet communication within the LAN 40, and generates an ARP request packet. reply to the terminal apparatus 5 _n hits at the source of.

As a result, even if there is a setting error in the routing rule, even if the terminal device 5 _n transmits a packet to another terminal device 5 _n , the packet always passes through the security gateway device 10. Can be induced.

[Security function; Traceback function]
One security function implemented in the security gateway device 10 is a traceback function. Several methods are known as the method of the traceback function. Here, as an example, a traceback system in which a traceback function called a digest method is installed in the security gateway device 10 will be described.

  First, the configuration of a traceback system, which is a communication security system incorporating a traceback function, will be described with reference to FIG.

  As shown in FIG. 6, in the traceback system that is a communication security system in which the traceback function is introduced, LANs 40A, 40B, and 40C are connected to the IP network 50 via routers 20A, 20B, and 20C, respectively.

On the LAN 40A, a plurality of terminal devices 5 _n (n is a natural number) used by an end user and a security gateway device 10A equipped with a traceback function are connected. Similarly, on LAN40B, and a plurality of terminal devices 5 _n used by an end user, and the security gateway device 10B that implements the traceback function is connected.

  On the LAN 40C, a file server device 30C used by an end user and a traceback manager device 31 which is the center of the operation of the traceback system are connected. An IDS (Intrusion Detection System) 32 is connected to the mirror port of the router 20C. The IDS 32 can monitor a packet transmitted from the outside of the LAN 40C to the file server device 30C, and can immediately detect the attack packet when the attack packet passes.

  The security gateway devices 10A and 10B have a traceback function and execute the following two processes.

First, the security gateway devices 10A and 10B execute a process of recording a passing packet as a first process. Security gateway devices 10A, 10B is performed LAN40A, terminals _{5 n} and routers 20A on 40B, the recording of all the packets transmitted from each of 20B. This process is executed by the security function unit 13 described with reference to FIG. 2 at the timing of step S16 in the flowchart shown in FIG.

  The passing record is recorded in the log recording unit 19b shown in FIG. The log to be recorded in the log recording unit 19b may be calculated by calculating a hash value from a packet using a hash function and recording the hash value to reduce the recording amount.

  Subsequently, as a second process, the security gateway apparatuses 10A and 10B execute a process of responding to the packet passage confirmation message. This process is executed by the security function management unit 18 and the security function unit 13 described with reference to FIG.

  With reference to the flowchart shown in FIG. 7, the response processing operation to the packet passage confirmation message, which is the second processing of the traceback system, will be described.

  First, when the security gateway devices 10A and 10B receive a packet passage confirmation message transmitted from the traceback manager device 31 (step S31), the security function unit 13 refers to the log recording unit 19b and stores the passage confirmation message. It is confirmed whether or not the packet specified in (1) is recorded (steps S32 and S33).

  Next, if the packet designated in the passage confirmation message is recorded in the log recording unit 19b, the security function unit 13 means that the packet has passed, so write the IP address or MAC address of the transmission source. A passing response message indicating that there is a passing record is generated (step S34) and transmitted to the traceback manager device 31 (step S36). Conversely, the security function unit 13 generates a passing response message indicating that there is no passing record unless the packet specified in the passing confirmation message is recorded in the log recording unit 19b (step S35), and traceback The data is transmitted to the manager device 31 (step S36).

  Next, the configuration of the traceback manager device 31 will be described with reference to FIG. As shown in FIG. 8, the traceback manager device 31 includes a communication interface 33 connected to the LAN 40C, a communication control unit 34, a traceback processing unit 35, and a security gateway device information storage unit 36.

  Next, the processing operation of the traceback manager apparatus 31 will be described using the flowchart shown in FIG.

  First, when the traceback manager device 31 receives a traceback request message from the IDS 32 (step S41), the traceback manager device 31 sends a passage confirmation message to all the security gateway devices 10A and 10B registered in the security gateway device information storage unit 36. Transmit (step S42).

  At this time, if an attack packet is written in the traceback request message, the traceback manager device 31 also writes the attack packet in the passage confirmation message and transmits it.

The traceback manager device 31 receives a passage response message from all the security gateway devices 10A and 10B after transmitting the passage confirmation message (step S43). Thereafter, the IP address and the MAC address written in the passage response message in which passage records are recorded are taken out of the received passage response messages (step S44). Thereby, the terminal device 5 _n that has transmitted the attack packet is specified.

Thereafter, the traceback manager device 31 executes a countermeasure process against the attack (step S45). As countermeasures against attacks, for example, logs are recorded as attack records, notifications are sent to the network administrator by means of e-mail, etc., and communication with the terminal device 5 _n that has sent the attack packets in cooperation with a firewall is blocked. It is possible to do.

  Next, processing operations from when an attack packet is transmitted until the operation is completed in the traceback system will be described using the timing chart shown in FIG.

First, the terminal device 5 _n that has been given the function of transmitting an attack packet due to virus infection or the like transmits the attack packet P1 to the file server device 30C.

  Since the security gateway device 10A records all received packets in the log recording unit 19b, even when the attack packet P1 is received, the security gateway device 10A records it as a log in the log recording unit 19b and transfers it to the router 20A. The routers 20A and 20C sequentially transfer the attack packet P1 to reach the destination file server device 30C.

  When the router 20C receives the attack packet P1, the router 20C transfers the attack packet P1 to the file server device 30C, while transmitting a copy packet P2 of the attack packet P1 to the IDS 32 connected to the mirror port.

  The IDS 32 that has received the copy packet P2 of the attack packet P1 detects that it is an attack, and immediately transmits a traceback request message P3 to the traceback manager device 31 via the router 20C. The traceback request message P3 is transmitted with the copy packet P2 written therein.

  Upon receipt of the traceback request message P3, the traceback manager device 31 transmits a passage confirmation message P4 to the security gateway device 10A via the router 20C and the router 20A. The passage confirmation message P4 is transmitted with the copy packet P2 written therein. Although not shown in FIG. 10, in actuality, the passage confirmation message P4 is also transmitted to all the other security gateway devices 10B.

  The security gateway device 10A refers to the log recording unit 19b to check whether the same packet as the copy packet P2 written in the passage confirmation message P4 has passed. When the attack packet P1 is recorded in the log recording unit 19b, since the copy packet P2 and the attack packet P1 are exactly the same packet, it is determined that there is a passage record.

Upon confirming the passage record, the security gateway device 10A transmits a passage response message P5 indicating that there is a passage record to the traceback manager device 31 via the router 20A and the router 20C. The passage in the response message P5, the IP address and MAC address of the terminal device 5 _n which has transmitted the attack packets P1 based on the log is transmitted written and.

Upon receiving the passage response message P5, the traceback manager device 31 takes out the IP address and MAC address written in the message, records the log in the log recording unit 19b, notifies the administrator, and sends it to the firewall. such as sending the communication shutdown request of the terminal device 5 _n, it executes an attack handling processing.

  In this way, the security gateway devices 10A and 10B equipped with the traceback function can execute attack countermeasure processing, that is, security processing on the attack packet in cooperation with the traceback manager device 31 and the IDS 32.

  As described above, the communication security system connects the security gateway device 10 with the security function so as to branch to the LAN 40, thereby changing the design of the network, changing the wiring of the network, and the existing device connected to the network. A security function on the network can be easily added without performing the replacement work, and the cost can be reduced.

  The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.

It is a figure for demonstrating the structure of the communication security system shown as embodiment of this invention. It is a figure for demonstrating the structure of the security gateway apparatus with which the said communication security system is provided. It is the figure which showed an example of the router information list which the said security gateway apparatus hold | maintains. It is a flowchart for demonstrating the setting process operation | movement with respect to the router by the said security gateway apparatus. It is a flowchart for demonstrating the processing operation of the security gateway apparatus at the time of receiving a packet. It is the figure shown about the structure of the traceback system which implement | achieves traceback. It is a flowchart for demonstrating the response processing operation | movement to the packet passage confirmation message of a traceback system. It is the figure which showed the structure of the traceback manager apparatus with which the said traceback system is provided. It is a flowchart for demonstrating the processing operation of the traceback manager apparatus with which the said traceback system is provided. 5 is a timing chart for explaining a processing operation from when an attack packet is transmitted until the operation is completed in the traceback system.

Explanation of symbols

5 _n terminal device 10 security gateway device 13 security function unit 14 routing processing unit 15 router information list storage unit 16 ARP (Address Resolution Protocol) processing unit 17 automatic setting function unit 18 security function management unit 20 router 30 server device 31 traceback manager Device 40 LAN (Local Area Network)
50 IP (Internet Protocol) network

Claims (4)

A communication security system comprising a router that interconnects an internal network and an external network, forwards a packet based on a predetermined routing rule, and a communication security device that is branched and connected to the internal network,
The communication security device includes :
Terminal communication means for performing packet communication with a terminal device connected to the internal network;
Router communication means for performing packet communication with the router;
Security processing means for executing security processing for judging validity of a packet acquired by each packet communication by the terminal communication means and the router communication means;
A routing rule changing means for changing the predetermined routing rule set in the router so that the packet is transferred to the communication security device in packet communication from the external network to the internal network ;
Storage means for storing an address table describing IP addresses of routers existing on the internal network;
Stop referring to the address table stored in the storage means and instructing all routers described in the address table to stop the function of returning an ARP response packet as a response to the ARP request packet Indicating means;
ARP processing means for generating an ARP response packet for the ARP request packet in response to receiving the ARP request packet for the router and returning the ARP request packet to the transmission source of the ARP request packet;
The router,
In response to the routing rule being changed by the routing rule changing means, the packet to be transmitted to the internal network is transferred to the communication security device,
The routing rule of the terminal device is set so that the packet is transferred to the communication security device during packet communication from the internal network to the external network .
A communication security system that stops a function of returning an ARP response packet in response to an instruction from the stop instruction means . The communication security system according to claim 1, wherein the communication security apparatus includes a table generation unit that searches for a router existing on the internal network and generates an address table to be stored in the storage unit. The routing rule of the terminal device is set so that the packet is transferred to the communication security device during packet communication in the internal network,
For all terminal devices connected to the internal network, set to stop the function of returning an ARP response packet that is a response to the ARP request packet,
The ARP processing means of the communication security device generates an ARP response packet for the ARP request packet in response to receiving the ARP request packet for the terminal device in packet communication within the internal network, and 3. The communication security system according to claim 2, wherein a reply is made to the transmission source. The communication security device of a communication security system comprising: a router that interconnects an internal network and an external network and forwards packets based on a predetermined routing rule; and a communication security device that is branched and connected to the internal network. And
Terminal communication means for performing packet communication with a terminal device connected to the internal network;
Router communication means for performing packet communication with the router;
Security processing means for executing security processing for judging validity of a packet acquired by each packet communication by the terminal communication means and the router communication means;
A routing rule changing means for changing the predetermined routing rule set in the router so that the packet is transferred to the communication security device in packet communication from the external network to the internal network ;
Storage means for storing an address table describing IP addresses of routers existing on the internal network;
Stop referring to the address table stored in the storage means and instructing all routers described in the address table to stop the function of returning an ARP response packet as a response to the ARP request packet Indicating means;
ARP processing means for generating an ARP response packet for the ARP request packet in response to receiving the ARP request packet for the router and returning the ARP request packet to a transmission source of the ARP request packet. .

Images