JP5088830B2 - Packet passing control method - Google Patents

Description

The present invention relates to a packet passage control method in a packet passage control apparatus using SPI (Stateful Packet Inspection) technology which is a function of a firewall, a router, and the like.

SPI exists as a technique for reading the data of a packet passing through a firewall, determining the contents, and dynamically opening / closing a port. This technique is usually processed by a central processing unit such as a CPU using software. Further, as a method for reducing the SPI processing in the central processing unit, the following Patent Document 1 is disclosed.
Japanese Patent No. 4137948

  Patent Document 1 provides a packet passage control apparatus and method that can reduce SPI processing in a central processing unit. However, in the means for dynamically opening the port by reading the data of the packet and judging its contents, the status monitoring for communication start determination in the transmission control protocol (TCP) is insufficient, and the robustness is low There's a problem.

  The present invention has been made in view of the above-described prior art, and an object thereof is to provide a robust packet passing control method in a packet passing control device.

  In order to achieve the above object, the present invention includes a packet passage control unit and a central processing unit, and controls whether to allow a packet received from one communication network path to pass through the other communication network path. A packet passage control method in a passage controller,

  Registering the first filtering information indicating whether the packet is permitted to pass, discarding, or central processing transfer in the filtering storage unit of the packet passing control unit for all packets of communication types indicating the filter rule conformity determination condition of the packet,

  Second filtering information indicating the central processing transfer for a communication start response packet from the other communication network path to the one communication network path when the received communication start request packet matches the first filtering information Is registered in the filtering storage unit,

  When the communication start response packet matches the second filtering information, the second filtering information registered in the filtering storage unit is deleted, and the one communication network path to the other communication network path is deleted. Registering in the filtering storage unit third filtering information indicating both passage and passage permission from the other communication network path to the one communication network path,

  The passage processing means of the packet passage control unit determines whether or not it matches the third filtering information registered in the filtering storage unit for a series of packet processing related to the received packet. If there is, the passage processing is performed without going through the central processing unit.

  The present invention also provides a packet passing control apparatus that includes a packet passing control unit and a central processing unit, and controls whether or not a packet received from one communication network path is allowed to pass through to the other communication network path. A control method,

  As the filtering information with the lowest priority, the first filtering information, which is a control type indicating any one of the packet passing permission, the discarding, and the central processing transfer for all the communication types indicating the packet filter rule conformity determination condition. Register in the filtering storage unit of the packet passage control unit,

  When the central processing unit transfer means of the packet passage control unit receives the communication start request packet, the communication type and control type of the packet match the first filtering registered in the filtering storage unit In this case, at least the communication type of the received packet is transferred to the central processing unit,

  The second filtering information registering means of the central processing unit has a second control type indicating a transfer to the central processing unit for the communication start response packet from the other communication network path to the one communication network path. Filtering information is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information,

  The central processing unit transfer means determines whether or not the second filtering information registered in the filtering storage unit matches with the order of priority, and controls the second filtering information if they match. According to the type, transfer at least the communication type of the received packet to the central processing unit,

  Whether the central processing unit transfer means matches the first filtering information registered in the filtering storage unit for a communication start completion packet from the one communication network path to the other communication network path. Determine in order of priority, and if they match, according to the control type of the first filtering information, transfer at least the communication type of the received packet to the central processing unit,

  The third filtering information registration means of the central processing unit deletes the second filtering information registered in the filtering storage unit, passes from the one communication network path to the other communication network path, and Third filtering information indicating permission to pass both from the other communication network path to the one communication network path is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information. And

  The passage processing means of the packet passage control unit determines, in order of priority, whether or not the series of packet processing related to the received packet matches the third filtering information registered in the filtering storage unit. In the case of coincidence, there is another feature in that the passing process is performed without going through the central processing unit.

  According to the present invention, a packet passage control unit having a passage processing unit, a filtering storage unit, and the like is configured as a single chip, for example, and the processing of the CPU is reduced by leaving the packet filtering processing to the passage processing unit. Even in this case, it is possible to realize communication with higher robustness than conventional packet filtering performed by the central processing unit.

  In addition, regarding registration of the first, second, and third filtering information in the filtering storage unit of the packet passage control unit, it is determined whether or not the communication start request packet matches the first filtering information. When the second filtering information is registered, it is determined whether or not the communication start response packet matches the second filtering information. If they match, the communication from one communication network path to the other communication network path is determined. The third filtering information indicating both the passage permission and the passage permission from the other communication network path to the one communication network path is registered in a filtering storage unit, and a series of packets related to the received packet For the process, it is determined whether or not it matches the third filtering information. Because if you are has to perform the passing process without going through the central processing unit, it is possible to provide a robust high packet transmission control method than traditional packet filtering central processing unit performs.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a packet passage control apparatus in which an embodiment of the packet passage control method of the present invention is implemented.

  As shown in the figure, the packet passage control device 1 is composed of a packet passage control unit 2 and a central processing unit 3 incorporated in, for example, a firewall or a router.

  The packet passing control device 1 includes a WAN-side I / F (interface) 11, a LAN-side I / F (interface) 12, a filtering processing unit (central processing unit transfer unit, passing processing unit) 13, a filtering storage unit 14 and a central processing interface (CPU / IF) 15. Here, the filtering processing unit 13 performs at least packet passing, discarding, and CPU transfer processing. The filtering storage unit 14 is a storage unit in which filtering information is recorded. Further, the central processing interface 15 performs processing for receiving information transmitted to a CPU (central processing unit) 16. These I / F (WAN) 11, I / F (LAN) 12, filtering processing unit 13, filtering storage unit 14, and central processing interface 15 are packets composed of semiconductor elements in order to speed up transfer processing. As the passage control unit, for example, a circuit is configured as a single chip.

  The filtering information includes packet communication type <communication service (services such as TCP, UDP, HTTP, FTP), flag type (SYN, FIN, etc.), destination IP address, destination port number, source IP address, source Information indicating a filter rule conformity determination condition> such as a port number, and information on control types of passage permission, discard, and CPU transfer. The filtering processing unit 13 performs filtering processing based on the filtering information.

  Next, the central processing unit 3 includes a CPU 16 and a table storage unit 17. The CPU 16 functionally includes a first filtering registration unit, a second filtering information registration unit, a second filtering deletion unit, a third filtering registration unit, a third filtering deletion unit, and the like. An SPI process such as receiving a packet that deviates from the filtering process to be performed (that is, transferred by the CPU) from the packet passage control unit and detecting a transfer destination for the received frame is performed based on software operating in advance. The table storage unit 17 has a filtering table and stores filtering information registered by a user such as a network administrator. Then, when performing the SPI processing, the CPU 16 performs a filtering process on only the packet information received from the filtering processing unit 13 via the central processing interface 15 based on the filtering information recorded in the table storage unit 17. To do.

  Next, the configuration of the filtering storage unit 14 will be described. FIG. 2 shows the configuration of the filtering storage unit 14.

  As shown in FIG. 2, the filtering storage unit 14 stores three types of filtering information including a CPU transfer candidate entry, an SPI entry, and a filter entry. The CPU transfer candidate entry is filtering information about a specific packet that is determined in advance to be transferred to the CPU 16. For example, the CPU transfer candidate entry is filtering information about a packet that is processed by the own device without being transferred to another device, such as an ARP packet. is there. The SPI entry is filtering information dynamically generated by the CPU 16. For example, when an HTTP connection is permitted from the A device on the internal network to the B device on the external network, the SPI entry is received. In addition, filtering information indicating the passage of an HTTP connection in the communication direction from the B device to the A device is dynamically generated so that a reply packet from the B device to the A device can pass. The filter entry is recorded in the table storage unit 17 in advance by user registration work, and is automatically written by the CPU 16 when the packet passage control device 1 is activated. Further, a communication start request packet (SYN) of one session is detected by this filter entry. In the figure, priorities are given in the order of a CPU transfer candidate entry, an SPI entry, and a filter entry. The priority is a priority order for determining whether or not the received packet matches the SPI process.

  FIG. 3 is a diagram showing a configuration of the filtering storage unit 14 and a filtering information registration status table formed therein. The filtering information registration status table is a table for storing filtering information registered in the filtering storage unit 14 by the CPU 16.

  Next, the 1st registration process to the filtering memory | storage part 14 of filtering information is demonstrated.

  When the packet passage control device 1 is activated or when there is an instruction to initialize the filtering information registration status table held by the CPU 16, the CPU 16 first reads the filtering information (first filtering information) from the table storage unit 17. . This filtering information is the filtering information of the CPU transfer candidate entry and the filter entry shown in FIG. At the time of startup or initialization, the CPU 16 registers the filtering information (CPU transfer candidate entry and filter entry) read from the table storage unit 17 in the filtering storage unit 14. In this registration, information whose filter entry control type is “pass” is rewritten as “CPU transfer” and registered.

  The CPU 16 also performs registration processing for filtering information that is an SPI entry. As described above, this SPI entry starts communication with the session start communication request packet (SYN), communication start response packet (SYN & ACK) when the packet passage control device 1 starts filtering processing and operates. The filtering information is dynamically generated by the CPU 16 based on the reception of the completion packet (ACK). When the CPU 16 generates the filtering information, the SPI entry is registered between the CPU transfer candidate entry and the filter entry. That is, the CPU transfer candidate entry is registered with the highest priority in the filtering information, the SPI entry is registered with the next highest priority, and the filter entry is registered as the filtering information with the lowest priority. For the filtering information registered in the filtering storage unit 14, the CPU 16 writes and stores a flag indicating whether or not the filtering information is registered in the filtering information registration status table. The order of priority is also written and stored in the filtering information registration status table.

  Now, in the packet passing control method described in Patent Document 1, for example, as shown in FIG.

  The CPU 16 reads the control information of the CPU transfer candidate entry and the filter entry from the table storage unit 17 when receiving an initialization instruction or at the time of activation, and registers them in the filtering storage unit 14 via the CPU / IF 15. When the registration of the first filtering information is completed, packet filtering processing accompanied by SPI processing is started.

  As shown in the figure, when the I / F 12 on the LAN side accepts the communication start request packet (packet A), the packet passage control unit (2) sets the filtering information recorded in the filtering storage unit 14 to a higher priority. Reference is made in order to determine whether there is filtering information that matches packet A. Here, if it is determined that there is matching filtering information, the control information is CPU transfer (if the control type of the filter entry is passing, it is rewritten at the time of registration and is all CPU transfer). Therefore, the packet A is transferred to the CPU 16. When receiving the packet A, the CPU 16 starts processing for generating an SPI entry related to the packet A. At this time, the CPU 16 generates SPI entries (11) and (12). Here, the SPI entry (11) is filtering information for a packet passing from the I / F 11 to the I / F 12 among other packets in the session in which the packet A is the first session (SYN). The SPI entry (12) is filtering information for a packet (FIN, RST = 0) passing from the I / F 12 to the I / F 11 among the packets of the session in which the packet A is the first (SYN) session. is there. The CPU 16 registers the generated SPI entries (11) and (12) in the filtering storage unit 14.

  Next, when the packet A is the first (SYN) session, another packet of the session is received by the I / F (WAN) 11 or the I / F (LAN) 12. The filtering processing unit 13 performs a filtering process on the series of packets, and when the communication type of these packets matches the SPI entry (11) or the SPI entry (12), the SPI entry (11) (12) Since the control type is “pass”, the packet is not transferred to the CPU 16, and the packet received by the I / F (WAN) 11 is directly output from the I / F (LAN) 12. Packets received by the I / F (LAN) 12 are directly output from the I / F (WAN) 11.

  As described above, in the method described in Patent Document 1, when the communication start request packet A matches the first filtering information registered in advance, the SPI entries (11) and (12) are generated and registered, and the packet A When the first session (SYN) is set, other packets of the session are directly transmitted between the I / F (WAN) 11 and the I / F (LAN) 12. For this reason, as described above, the method described in Patent Document 1 has a problem that the state monitoring for the communication start determination in the transmission control protocol (TCP) is insufficient and the robustness is low.

  The present invention solves or reduces this problem, and an embodiment of the present invention will be described below. 4 and 5 are diagrams showing an outline of the processing flow of the packet passing control device 1, and FIG. 5 is a continuation of FIG. FIG. 6 is a table showing packets received by the packet passage control apparatus 1 and SPI entries dynamically generated based on the reception of the packets. The operation (processing flow) of the packet passage control device 1 will be described below with reference to FIGS.

  First, the CPU 16 reads the filtering information of the CPU transfer candidate entry and the filter entry from the packet passage control device table storage unit 17 when receiving an initialization instruction or at the time of activation, and stores the CPU / IF 15 in the filtering storage unit 14. Register via. At this time, the CPU transfer candidate entry is registered with a higher priority, and the filter entry is registered with a lower priority for applying the filter rule than the CPU transfer candidate entry. Then, the CPU 16 records the priority order in the filtering information registration status table.

  When the registration of the first filtering information is completed, packet filtering processing involving SPI processing is started. Now, assuming that the packet A is received by the LAN side I / F 12 (step S1), the packet A has a reception logic I / F of I / F (LAN) 12 and a transmission logic I / F as shown in FIG. Is the I / F (WAN) 11, the source IP address (S-IP) is IP-x, the destination IP address (D-IP) is IP-y, the source port number (S-Port) is Port-x, The destination port number (D-Port) is Port-y and the TCP flag is SYN.

  When the filtering processing unit 13 accepts the packet A, the filtering processing unit 13 sequentially refers to the filtering information recorded in the filtering storage unit 14 in descending order of priority, and the filtering type and the communication type of the received packet A (communication service) , Flag type, destination IP address, destination port number, transmission source IP address, transmission source port number, etc.) to determine whether there is filtering information matching packet A. Here, the filter entry recorded in the filtering storage unit 14 matches all communication types, and the control type is CPU transfer (if the control type of the filter entry is pass, it is rewritten at the time of registration and all CPU transfer Therefore, the packet A is transferred to the CPU 16 (step S2).

  When receiving the packet A, the CPU 16 starts a process of generating an SPI entry related to the packet A. At this time, the CPU 16 generates an SPI entry (1) as shown in FIG. In this SPI entry (1), the reception logic I / F is I / F (WAN) 11, the transmission logic I / F is I / F (LAN) 12, the transmission source IP address (S-IP) is IP-y, A packet having a destination IP address (D-IP) of IP-x, a source port number (S-Port) of Port-y, and a destination port number (D-Port) of Port-x is passed, and the TCP flag is This is filtering information (second filtering information) that passes packets that are SYN & ACK.

  When the CPU 16 changes the monitoring state and generates the above SPI entry (1), the SPI entry (1) is registered in the filtering storage unit 14 (step S3). At this time, the CPU 16 registers at a position (address: address) having a higher priority than the filter entry and lower priority than the CPU transfer candidate entry. The CPU 16 stores the priority information of the registered SPI entry (1) in the filtering information registration status table.

  When registering the SPI entry (1), the CPU 16 performs a filtering process on the packet A based on the filtering information stored in the filtering information registration status table. In the filtering information stored in the filtering information registration status table, filter entries (control type = pass) that match all the communication types are recorded, so the CPU 16 sends the packet A to the I / O via the CPU / IF 15. The data is transferred to F (WAN) 11 and transmitted to the WAN communication network (step S4).

  Thereafter, when the filtering processing unit 13 receives the communication start response packet (packet B) (step S5), the filtering processing unit 13 sequentially refers to the filtering information recorded in the filtering storage unit 14 in descending order of priority, and receives the communication of the received packet B. Compared with the type (communication service, flag type, destination IP address, destination port number, source IP address, source port number, etc.), it is determined whether there is filtering information that matches packet B. Here, since the packet B matches the SPI entry (1) and the control type is CPU transfer, the packet B is transferred to the CPU 16 (step S6).

  When the CPU 16 receives the packet B, the CPU 16 changes the state of processing for generating an SPI entry related to the packet B, and performs filtering processing on the packet B based on the filtering information stored in the filtering information registration status table. In the filtering information stored in the filtering information registration status table, since the filter entry (control type = pass) that matches the communication type of the packet B is recorded, the CPU 16 sends the packet A to the I via the CPU / IF 15. The data is transferred to / F (LAN) 12 and transmitted to the communication network on the LAN side (step S7).

  Next, when the filtering processing unit 13 receives the communication start completion packet (packet C) (step S8), the filtering processing unit 13 sequentially refers to the filtering information recorded in the filtering storage unit 14 in descending order of priority, and receives the received packet C. Compared with the communication type (communication service, flag type, destination IP address, destination port number, source IP address, source port number, etc.), it is determined whether there is filtering information that matches packet C. Here, since the filter entries recorded in the filtering storage unit 14 match all the communication types and the control type is CPU transfer, the packet C is transferred to the CPU 16 (step S9).

  When receiving the packet C, the CPU 16 further shifts the state of processing for generating an SPI entry related to the packet C. That is, the monitoring state is terminated. At this time, the CPU 16 deletes the SPI entry (1) and also deletes the SPI entry (1) registered in the filtering storage unit 14. Further, the priority information of the SPI entry (1) stored in the filtering information registration status table is also deleted (step S10). That is, the second filtering information is deleted.

  Thereafter, the CPU 16 generates an SPI entry (2), an SPI entry (3), and an SPI entry (4) as shown in FIG. 6, that is, third filtering information. In the SPI entry (2), the reception logic I / F is I / F (WAN) 11, the transmission logic I / F is I / F (LAN) 12, the source IP address (S-IP) is IP-y, and the destination The IP address (D-IP) is IP-x, the source port number (S-Port) is Port-y, the destination port number (D-Port) is Port-x, the protocol is TCP, and the TCP flag is SYN. / ACK / PSH / URG, or a packet with FIN and RST = 0. That is, it is filtering information for a packet (FIN, RST = 0) that passes from the I / F (WAN) 11 to the I / F (LAN) 12 among the packets of the session in which the packet A is the first session.

  The SPI entry (3) has a reception logic I / F of I / F (LAN) 12, a transmission logic I / F of I / F (WAN) 11, a transmission source IP address (S-IP) of IP-x, The destination IP address (D-IP) is IP-y, the source port number (S-Port) is Port-x, the destination port number (D-Port) is Port-y, the protocol is TCP, and the TCP flag is SYN / ACK / PSH / URG or FIN, RST = 0 packet. That is, it is filtering information for a packet (FIN, RST = 0) that passes from the I / F (LAN) 12 to the I / F (WAN) 11 among the packets of the session in which the packet A is the first session.

  Further, the SPI entry (4) has a reception logic I / F of I / F (WAN) 11, a transmission logic I / F of I / F (LAN) 12, a transmission source IP address (S-IP) of IP-y, The destination IP address (D-IP) is IP-x, the source port number (S-Port) is Port-y, the destination port number (D-Port) is Port-x, the protocol is TCP, and the TCP flag is The packet is FIN = 1 or RST = 1. That is, it is filtering information for transferring the packet of FIN = 1 or RST = 1 received by the I / F (WAN) 11 among the packets of the session in which the packet A is the first session.

  Then, the CPU 16 registers the generated SPI entries (2), (3), and (4) in the filtering storage unit 14 (step S11). At this time, the CPU 16 registers at a position (address: address) having a higher priority than the filter entry and a lower priority than the CPU transfer candidate entry. The CPU 16 stores the priority information of the registered SPI entries (2), (3), and (4) in the filtering information registration status table.

  When the SPI entries (2), (3), and (4) are registered, filtering processing is performed on the packet C based on the filtering information stored in the filtering information registration status table. In the filtering information stored in the filtering information registration status table, filter entries (control type = pass) that match all the communication types are recorded, so the CPU 16 sends the packet C to the I / I via the CPU / IF 15. The data is transferred to F (WAN) 11 and transmitted to the WAN communication network (step S12).

  Next, when the packet A is the first (SYN) session, another packet of the session is received by the I / F (WAN) 11 or the I / F (LAN) 12. The filtering processing unit 13 performs a filtering process on the series of packets. This filtering process is performed in comparison with the filtering information registered in the filtering storage unit 14 as described above. Here, when the packet A is the first (SYN) session, the other packets of the session match the SPI entry (2) or the SPI entry (3). The SPI entry (2) (3) has the control type “pass”. Therefore, when the packet processing unit 13 receives another packet of the session when the packet A is the first (SYN) session, the filtering processing unit 13 does not transfer the packet A to the CPU 16 but receives it by the I / F (WAN) 11. Packets are directly output from the I / F (LAN) 12, and packets received by the I / F (LAN) 12 are directly output from the I / F (WAN) 11. That is, assuming that packet A is a packet received for the first time of a session, the packet passing control unit performs SPI processing (bidirectional hardware transfer processing) for packets in the same session thereafter (step S13).

  Next, as shown in FIG. 5, when the packet A is the first (SYN) session, the last (FIN) packet D of the session is received by the I / F (LAN) 12 ( Step S14). In this case, the filtering processing unit 13 compares with the filtering information registered in the filtering storage unit 14. Here, since the SPI entry (2) does not filter the packet with FIN = 1, the filtering processing unit 13 sequentially checks the filter entries according to the priority. Since there is an entry with the same communication type in the filter entry (the same entry as the filter entry that processed packet A) and its control type is CPU transfer, packet D is transferred to CPU 16 via CPU / IF 15. (Step S15). The CPU 16 changes the state of the SPI, and since the control type for the packet D is “pass” in the filtering information registration status table, the CPU 16 outputs it to the I / F (WAN) 11 (step S16).

  Further, when the packet A output to the I / F (WAN) 11 is the first (SYN) session, the packet E responding to the last (FIN) packet of the session is represented by the I / F (WAN) 11. It is assumed that it has been received (step S17). In this case, the filtering processing unit 13 compares with the filtering information registered in the filtering storage unit 14. Here, since the SPI entry (3) is not subject to filtering for a packet with FIN = 1, the packet E matches the SPI entry (4) and its control type is CPU transfer. E is transferred to the CPU 16 via the CPU / IF 15 (step S18). The CPU 16 changes the state of the SPI, and since the control type for the packet E is “passed” in the filtering information registration status table, it outputs it to the I / F (LAN) 12 (step S19).

  Further, the CPU 16 outputs the packet D received by the I / F (LAN) 12 and having the TCP flag FIN to the I / F (WAN) 11 and then outputs the packet E having the TCP flag FIN to the I / F (WAN). 11, since the SPI entries (2), (3), and (4) of the session related to the packet have been sent to the I / F (LAN) 12 of the packet E, the filtering storage unit 14 is performed (step S20).

  With the above processing, the packet passing control unit 2 including the filtering processing unit 13, the filtering storage unit 14, and the like is configured as a single chip, for example, and the SPI processing is entrusted to the filtering processing unit 13. In addition, it is possible to realize a highly robust communication equivalent to the SPI process in which the state is monitored by the CPU.

  FIG. 7 is a functional block diagram of the main part of the present invention. In the figure, reference numeral 10 denotes a central processing unit transfer means comprising the filtering processing unit 13 and the CPU / IF 15, and the same reference numerals as those in FIG. 1 denote the same or equivalent parts as in FIG.

  The present invention includes a packet passage control unit 2 and a central processing unit 3, and a packet passage in a packet passage control device that controls whether or not a packet received from one communication network path is allowed to pass to the other communication network path. It is a control method, and the following method is implemented.

  (1) First, for all packets of communication types indicating the packet filter rule conformity determination conditions read from the table storage unit 17, the control type indicating any of packet passage permission, discard, and central processing transfer First filtering information 14a indicating a certain central processing transfer is registered in the filtering storage unit 14 of the packet passage control unit as filtering information having the lowest priority.

  (2) When the central processing unit transfer means 10 of the packet passage control unit receives a communication start request packet (packet A) from one communication network path to the other communication network path, the communication type and control of the packet are controlled. It is determined whether or not the type matches the first filtering information 14a registered in the filtering storage unit 14, and if it matches, at least the communication type 10a of the received packet is set to the central processing unit 3 Forward to.

  (3) When there is the above transfer, the second filtering information generation / registration means 3a of the central processing unit 3 sends a communication start response packet (packet B) from the other communication network path to the one communication network path. The second filtering information 14b in which the control type indicates the central processing transfer is generated, and is preferentially registered in the filtering storage unit 14 as information having a higher priority than the first filtering information.

  (4) Next, the central processing unit transfer means 10 registers the received communication start response packet (packet B) from the other communication network path to the one communication network path in the filtering storage unit 14. Whether or not the second filtering information matches the second filtering information 14b in order of priority, and if they match, according to the control type of the second filtering information, at least the communication type 10b of the received packet is Transfer to the central processing unit 3.

  (5) Next, the central processing unit transfer means 10 registers the received communication start completion packet (packet C) from the one communication network path to the other communication network path in the filtering storage unit 14. It is determined whether or not the first filtering information 14a matches with the first filtering information in order of priority, and if they match, according to the control type of the first filtering information, at least the communication type 10c of the received packet is Transfer to the central processing unit 3.

  (6) When there is transfer of the communication types 10b and 10c of (4) and (5), the third filtering information generating / registering means 3b of the central processing unit 3 is registered in the filtering storage unit 14. Delete the second filtering information 14b, and allow both passage from the one communication network path to the other communication network path and from the other communication network path to the one communication network path. Is preferentially registered in the filtering storage unit 14 as information having a higher priority than the first filtering information.

  (7) A passage processing means (not shown) of the packet passage control unit 2 matches the third filtering information 14c registered in the filtering storage unit 14 for a series of packet processing related to the received packet. Whether or not to do so is determined in the order of priority, and if they match, the passage processing is performed without going through the central processing unit 3.

  Note that the first, second, and third filtering information 14a, 14b, and 14c in FIG. 7 correspond to the filter entry, the SPI entry (1), and the SPI entries (2), (3), and (4) in FIG. 4, respectively. .

  As mentioned above, although this invention was demonstrated by embodiment, this invention is not limited to above-described embodiment, The change in the range which does not deviate from the thought and range of this invention is possible, This change is included in this invention. It is clear that For example, the determination of “matching filter entry” for packet C after step S8 in FIG. 4 may be omitted.

It is a block diagram which shows the structure of a packet passage control apparatus. It is explanatory drawing of a structure of a filtering memory | storage part. It is explanatory drawing of the structure of a filtering information registration condition table and a filtering memory | storage part. It is a processing flow of the packet passage control apparatus at the time of TCP session start. It is a processing flow of the packet passage control device when the TCP session is stopped. It is a figure which shows the SPI entry dynamically generated based on the packet which a packet passage control apparatus receives, and reception of the packet. It is a functional block diagram of the principal part of this invention. It is a processing flow of the conventional packet passage control apparatus.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Packet passage control apparatus, 2 ... Packet passage control part, 3 ... Central processing part, 11 ... I / F (WAN), 12 ... I / F (LAN), 13 ... Filtering processing unit, 14 ... Filtering storage unit, 15 ... CPU / IF, 16 ... CPU, 17 ... Table storage unit, 10 ... Central processing unit transfer means.

Claims (4)

A packet passage control method in a packet passage control device comprising a packet passage control unit and a central processing unit, and controlling whether or not to pass a packet received from one communication network path to the other communication network path,
Registering the first filtering information indicating whether the packet is permitted to pass, discarding, or central processing transfer in the filtering storage unit of the packet passing control unit for all packets of communication types indicating the filter rule conformity determination condition of the packet,
When the received communication start request packet matches the first filtering, second filtering information indicating the central processing transfer is transmitted for a communication start response packet from the other communication network path to the one communication network path. Register in the filtering storage unit,
When the communication start response packet matches the second filtering information, the second filtering information registered in the filtering storage unit is deleted, and the one communication network path to the other communication network path is deleted. Registering in the filtering storage unit third filtering information indicating both passage and passage permission from the other communication network path to the one communication network path,
The passage processing means of the packet passage control unit determines whether or not it matches the third filtering information registered in the filtering storage unit for a series of packet processing related to the received packet. A packet passage control method, wherein the passage processing is performed without going through the central processing unit. In the packet passage control method according to claim 1,
The packet passing control method, wherein the second and third filtering information is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information. In the packet passage control method according to claim 1 or 2,
A packet passing control method, wherein the first, second and third filtering information is registered in an SPI entry of the filtering storage unit. A packet passage control method in a packet passage control device comprising a packet passage control unit and a central processing unit, and controlling whether or not to pass a packet received from one communication network path to the other communication network path,
As the filtering information with the lowest priority, the first filtering information, which is a control type indicating any one of the packet passing permission, the discarding, and the central processing transfer for all the communication types indicating the packet filter rule conformity determination condition. Register in the filtering storage unit of the packet passage control unit,
When the central processing unit transfer means of the packet passage control unit receives the communication start request packet, the communication type and control type of the packet match the first filtering registered in the filtering storage unit In this case, at least the communication type of the received packet is transferred to the central processing unit,
The second filtering information registering means of the central processing unit has a second control type indicating a transfer to the central processing unit for the communication start response packet from the other communication network path to the one communication network path. Filtering information is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information,
The central processing unit transfer means determines whether or not the second filtering information registered in the filtering storage unit matches with the order of priority, and controls the second filtering information if they match. According to the type, transfer at least the communication type of the received packet to the central processing unit,
Whether the central processing unit transfer means matches the first filtering information registered in the filtering storage unit for a communication start completion packet from the one communication network path to the other communication network path. Determine in order of priority, and if they match, according to the control type of the first filtering information, transfer at least the communication type of the received packet to the central processing unit,
The third filtering information registration means of the central processing unit deletes the second filtering information registered in the filtering storage unit, passes from the one communication network path to the other communication network path, and Third filtering information indicating permission to pass both from the other communication network path to the one communication network path is preferentially registered in the filtering storage unit as information having a higher priority than the first filtering information. And
The passage processing means of the packet passage control unit determines, in order of priority, whether or not the series of packet processing related to the received packet matches the third filtering information registered in the filtering storage unit. A packet passing control method, wherein if the two match, a passing process is performed without going through the central processing unit.

Images