JP5176983B2 - Filter device, filter program and method - Google Patents

Description

  The present invention relates to a filtering technique in a network.

  In network construction, for example, when filtering is set between intranets, the network administrator grasps the devices in the network to be constructed and defines filtering rules.

  A filtering technique in a network is known (for example, see Patent Document 1).

JP 2007-053703 A

  However, as the scale of the network to be constructed increases, there is a problem that the labor involved in grasping devices, setting filtering rules, and checking increases.

  The present invention has been made to solve the above-described problems, and it is an object of the present invention to provide a filter device, a filter program, and a method capable of facilitating setting related to filtering.

  In order to solve the above-described problem, a filter device is a device for filtering packets flowing on a communication line, and determines whether to collect information for filtering or to perform filtering. When determining that the setting mode for setting the monitor mode, the packet acquisition unit for acquiring the packet flowing on the communication line, and the mode for collecting information for filtering the filtering mode, the packet acquisition unit When the network address included in the acquired packet is associated with the communication protocol at the network address and recorded as address record information in the first recording unit, and the monitor mode is determined to be a filtering mode, the first In the address record information recorded in the recording section And Zui, and a monitoring unit for performing packet filtering.

  The filter program is a program for a device that filters packets flowing on a communication line, and has a monitor mode for determining whether to collect information for filtering or to perform filtering. The packet acquired by the packet acquisition step when it is determined that the setting step of setting, the packet acquisition step of acquiring a packet flowing on the communication line, and the monitor mode is a mode for collecting information for filtering Is associated with a communication protocol at the network address and recorded as address record information in the first memory of the device, and when the monitor mode is determined to be a filtering mode, Record Based on the address recorded information, to execute a monitoring step of performing a packet filtering on the computer.

  The filtering method is a method in an apparatus for filtering packets flowing on a communication line, and has a monitor mode for determining whether to collect information for filtering or to perform filtering. The packet acquired by the packet acquisition step when it is determined that the setting step of setting, the packet acquisition step of acquiring a packet flowing on the communication line, and the monitor mode is a mode for collecting information for filtering Is associated with a communication protocol at the network address and recorded as address record information in the first memory of the device, and when the monitor mode is determined to be a filtering mode, Recorded Based on the dress recording information, and a surveillance performing the packet filtering.

  According to the present invention, there is an effect that the setting relating to filtering can be facilitated.

1 is a diagram illustrating an overall configuration of a first embodiment. 1 is a block diagram illustrating a configuration of a filter device according to Embodiment 1. FIG. It is a figure which shows address management DB which concerns on Embodiment 1. FIG. 4 is a diagram showing a matrix DB according to Embodiment 1. FIG. 2 is a block diagram illustrating a hardware configuration of the filter device according to Embodiment 1. FIG. FIG. 3 is a diagram illustrating an overall operation of the filter device according to the first embodiment. 4 is a flowchart showing an operation of a registration process according to the first embodiment. 4 is a flowchart illustrating an operation of monitoring processing according to the first embodiment. The warning display which concerns on Embodiment 1 is shown. It is a figure which shows the produced | generated filtering table based on Embodiment 1. FIG. It is a figure which shows the set filtering table which concerns on Embodiment 1. FIG. It is a figure which shows the warning by the filtering table which concerns on Embodiment 1. FIG. 6 is a flowchart illustrating an operation of monitoring processing according to the second embodiment. It is a figure which shows the produced | generated filtering table based on Embodiment 2. FIG. It is a figure which shows an example of the computer system to which this invention is applied.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
First, the overall configuration of the present embodiment will be described. FIG. 1 is a diagram showing an overall configuration of the first embodiment.

  As shown in FIG. 1, the present embodiment includes a network A and a network B by network devices, a filter device 1 connected between these networks (on a communication line), and a setting device connected to the filter device 1 The terminal 2 is configured. The filter device 1 performs filtering between the network A and the network B, and the setting terminal 2 performs setting of the filter device 1.

  Next, the configuration of the filter device according to the present embodiment will be described. FIG. 2 is a block diagram illustrating a configuration of the filter device according to the first embodiment. FIG. 3 is a diagram showing the address management DB according to the first embodiment. FIG. 4 is a diagram illustrating the matrix DB according to the first embodiment. FIG. 5 is a block diagram illustrating a hardware configuration of the filter device according to the first embodiment.

  As shown in FIG. 2, the filter device 1 according to the present embodiment includes a registration unit 10 (transmission unit), a monitoring unit 11 (setting unit, packet acquisition unit, monitoring unit, first notification unit, second notification unit). , Address management DB (Data Base) 12 (second recording unit, second memory), matrix DB 13 (address recording information, first recording unit, first memory), and filtering DB 14. The registration unit 10 registers an IP address in the address management DB 12. In the address management DB 12, as shown in FIG. 3, an address number indicating an ID and a response address indicating an IP address are associated with each other. Further, the monitoring unit 11 writes information related to communication using addresses existing in the address management DB 12 in the matrix DB 13 and performs filtering based on the filtering DB 14. As shown in FIG. 4, the matrix DB 13 is associated with a filter number indicating an ID, a transmission source IP address, a transmission destination IP address, and a protocol. The filtering DB 14 is generated based on the matrix DB 13 by the monitoring unit 11. The filtering DB 14 will be described in detail later.

  Each function by the registration unit 10 and the monitoring unit 11 is substantially executed by the CPU 15. Further, the address management DB 12, the matrix DB 13, and the filtering DB 14 are stored in the memory 16.

  Next, the operation of the filter device according to the present embodiment will be described. FIG. 6 is a diagram illustrating an overall operation of the filter device according to the first embodiment.

  In the filter device 1, first, a registration process described later is executed by the registration unit 10 (S101), and then a monitoring process described later is executed by the monitoring unit 11 (S102).

  Next, the operation of the registration process will be described. FIG. 7 is a flowchart showing the operation of the registration process according to the first embodiment.

  First, the registration unit 10 determines whether or not Ping (response request information) has been issued to all private addresses in the connected network (S201).

  When the Ping has not been issued to all private addresses (S201, NO), the registration unit 10 sequentially issues the Ping to the private addresses (S202, transmission step), and determines whether there is a response to the issued Ping. Judgment is made (S203).

  When there is a response to the issued Ping (S203, YES), the registration unit 10 writes the address where the response is made in association with the address number in the address management DB 12 (S204, monitoring step).

  On the other hand, when there is no response to the issued Ping (S203, NO), the registration unit 10 determines again whether or not the Ping has been issued to all private addresses in the connected network (S201).

  In Step S201, when Ping is issued to all private addresses (S201, YES), the registration unit 10 ends the registration process.

  As described above, according to the registration process, the private address responding to the issued Ping is written in the address management DB 12. By this processing, the filter device 1 can obtain the IP addresses of the devices in the connected network A and network B.

  Next, the monitoring process will be described. FIG. 8 is a flowchart showing the operation of the monitoring process according to the first embodiment. FIG. 9 shows a warning display according to the first embodiment. FIG. 10 is a diagram showing a generated filtering table according to the first embodiment. FIG. 11 is a diagram showing the set filtering table according to the first embodiment. Also, FIG. 12 is marked and displayed when there is a contradiction rule according to the first embodiment (Drop setting has communication history, Pass setting has not been communicated at all). It is a figure to do. Note that the monitor mode in FIG. 8 is a function for determining whether a mode for collecting information for filtering (ON) or a mode for filtering (OFF) is used. In the present embodiment, the monitor mode is a mode in which a network administrator collects information for filtering via a setting terminal for a predetermined period. In FIG. 8, the monitor mode is set to ON or OFF in advance, and when it is set to ON, the period is set (setting step).

  First, the monitoring unit 11 determines whether or not the monitor mode is ON (S301).

  When the monitor mode is ON (S301, YES), the monitoring unit 11 acquires a packet that passes through the filter device 1, and extracts a transmission source address, a transmission destination address, and a protocol from the acquired packet (S302, Packet acquisition step), it is determined whether or not the extracted address exists in the address management DB (S303).

  When the extracted address exists in the address management DB (S303, YES), the monitoring unit 11 writes the extracted transmission source address, transmission destination address, and protocol in the matrix DB 13 (S304, monitoring step). Next, the monitoring unit 11 determines whether or not the monitor mode setting period has passed (S305).

  When the monitor mode setting period has passed (S305, YES), the monitoring unit 11 turns off the monitor mode (S306), and determines again whether the monitor mode is on (S301).

  On the other hand, when the monitor mode setting period has not passed (S305, NO), the monitoring unit 11 determines again whether the monitor mode is ON (S301).

  If the extracted address does not exist in the address management DB in step S303 (S303, NO), the monitoring unit 11 notifies the setting terminal 2 of the address that does not exist in the address management DB, as shown in FIG. Thus, a warning is displayed on the setting terminal 2 (S307, monitoring step), and it is determined again whether the monitor mode is ON (S301). The warning display shown in FIG. 9 is displayed as a pop-up on the management screen in the setting terminal 2, for example. The warning display may be displayed by the filter device 1.

  In step S301, when the monitor mode is not ON (S301, NO), the monitoring unit 11 reads the matrix DB 13 (S308) and generates the filtering DB 14 based on the matrix DB 13 (S309). When the filtering DB 14 is generated, the monitoring unit 11 performs filtering based on the filtering DB 14 (S310, monitoring step), and determines again whether the monitor mode is ON (S301).

  Here, the filtering DB 14 will be described. The filtering DB 14 is displayed on the setting terminal 2 as a filtering table as shown in FIG. In this filtering table, IN indicates a source address, OUT indicates a destination address, and communication is set for a combination of IN and OUT. Since the filtering DB 14 is based on the matrix DB 13 as shown in FIG. 4, there is unset communication in FIG. 10, but all settings can be set by the setting terminal 2. As shown in FIG. 11, the network administrator can make settings for unset communication, and when the setting is different from that of the matrix DB 13, a different part is displayed as shown in FIG. 12 (monitoring). Step). This function is realized by the monitoring unit 11 comparing the filtering DB 14 and the matrix DB 13 and notifying the setting terminal 2 of the difference. In such a function for displaying different parts, a rule may be provided in advance, and a part that does not match the rule may be used as the different part.

  As described above, by setting communication performed while the monitor mode is ON to the matrix DB 13 and performing filtering using the filtering DB 14 based on the matrix DB 13, it is possible to easily set the filtering rule. In addition, an address corresponding to Ping by the filter device 1 is written in the address management DB 12, and in the monitor mode, a warning is issued when there is a communication by a packet including an address that does not exist in the address management DB 12, thereby entering a predetermined network. Devices that do not exist can be excluded from the matrix DB 13. In the present embodiment, addresses are registered in advance in the address management DB 12, but filtering is performed by writing communications made while the monitor mode is ON to the matrix DB 13 without using the address management DB 12. Is also possible.

Embodiment 2. FIG.
In the monitor mode in the first embodiment described above, the monitoring unit 11 extracts the transmission destination address, the transmission source address, and the protocol from the packet that passes through the filter device 1. On the other hand, in the monitor mode according to the second embodiment, communication using packets between the network A and the network B is cut off.

  First, the configuration of the filter device 1 in the present embodiment will be described. Note that the configuration of the filter device 1 according to the present embodiment is the same as that of the first embodiment except for the monitoring unit 11, and thus the description thereof is omitted here.

  The monitoring unit 11 (setting unit, packet acquisition unit, monitoring unit, first notification unit, second notification unit, blocking unit) according to the present embodiment performs an operation of blocking all packets during the monitor mode. This is different from the first embodiment.

  Next, the operation of the filter device in the present embodiment will be described. Note that the overall operation of the filter device 1 and the operation of the registration process in the present embodiment are the same as the overall operation and the operation of the registration process shown in FIGS. Description is omitted.

  FIG. 13 is a flowchart showing the operation of the monitoring process according to the second embodiment. In the flowchart, steps denoted by the same reference numerals as those in FIG. 8 described in the first embodiment indicate steps that are the same as or correspond to the steps illustrated in FIG. 8, and redundant descriptions are omitted.

  First, when the monitor mode is ON (S301, YES), the monitoring unit 11 blocks a packet passing through the filter device 1 (S401, blocking step). Next, the monitoring unit 11 acquires the blocked packet, extracts a transmission source address, a transmission destination address, and a protocol from the acquired packet (S402, packet acquisition step). Does the extracted address exist in the address management DB 12? It is determined whether or not (S303).

  When the extracted address exists in the address management DB 12 (S303, YES), the monitoring unit 11 writes the extracted transmission source address, transmission destination address, and protocol in the matrix DB 13 as packets can be passed (S403, monitoring step) ).

  Note that the monitoring unit 11 in the present embodiment blocks all packets during the monitor mode, and allows the packet to pass only the source address, destination address, and protocol of packets that are communicated during the monitor mode. Is written in the matrix DB 13 as follows. Therefore, the IN-OUT between which there is no packet communication during the monitor mode in the filtering table created by the monitoring unit 11 in step S309 is Drop setting, and the IN-OUT between which there is packet communication during the monitor mode. Is a Pass setting.

  FIG. 14 is a diagram illustrating a generated filtering table according to the second embodiment. As shown in FIG. 14, when compared with the filtering table of FIG. 10 described in the first embodiment, the section between IN and OUT that has not been set in FIG. 10 becomes Drop in FIG.

  In this embodiment, when it is determined that the acquired address is not in the address management DB 12 in the determination of whether the acquired address is in the address management DB 12 in step S303, the warning is not displayed and the acquisition is not performed. You may make it block the packet from the address which made it. Further, in the present embodiment, the drop setting is set for the IN-OUT where there is no packet communication during the monitoring mode in the filtering table, but it goes without saying that it may be unset as in the first embodiment.

  As described above, by blocking all packets during the monitor mode, packets from devices that do not exist in the predetermined network can be blocked, and safety during the monitor mode can be improved. In addition, it is possible to simplify the drop table entry of the filtering table by setting only the source address, destination address, and protocol of the packet whose communication is interrupted during the monitor mode to allow the packet to pass. Thus, workability can be improved.

  The present invention can be implemented in various other forms without departing from the gist or main features thereof. Therefore, the above-described embodiment is merely an example in all respects and should not be interpreted in a limited manner. The scope of the present invention is shown by the scope of claims, and is not restricted by the text of the specification. Moreover, all modifications, various improvements, substitutions and modifications belonging to the equivalent scope of the claims are all within the scope of the present invention.

  Furthermore, a program for executing the above steps in the filter device 1 can be provided as a filter program. The above-described program can be executed by the filter device 1 by being stored in a recording medium readable by the CPU 15. Further, as shown in FIG. 15, the storage medium 21 may be read by the setting terminal 2 connected to the filter device 1, and the filter program may be transmitted to the filter device 1. Here, the recording medium readable by the setting terminal 2 may be an internal storage device such as a ROM or a RAM, a CD-ROM, a flexible disk, a DVD disk, a magneto-optical disk, an IC card, or the like. A portable storage medium is also included. Further, the filter program may be transmitted to the filter device 1 or the setting terminal 2 connected to the filter device 1 via a communication line.

As mentioned above, according to this Embodiment, the technical idea shown with the following additional remarks is disclosed.
(Appendix 1) A filter device for filtering packets flowing on a communication line,
A setting unit for setting a monitor mode for determining whether to collect information for filtering or to perform filtering;
A packet acquisition unit for acquiring a packet flowing on the communication line;
When it is determined that the monitor mode is a mode for collecting information for filtering, address recording information is obtained by associating a network address included in the packet acquired by the packet acquisition unit with a communication protocol at the network address. And a monitoring unit that executes packet filtering based on the address recording information recorded in the first recording unit when the monitoring mode is determined to be a filtering mode.
(Appendix 2) The filter device according to Appendix 1,
A transmission unit for transmitting response request information, which is information for requesting a response, to a device connected on the communication line;
When the monitoring unit determines that the monitor mode is a mode for collecting information for filtering, the second recording is performed on the network address of the device that has responded to the response request information transmitted by the transmission unit. And when the network address included in the packet acquired by the packet acquisition unit is a network address not recorded in the second recording unit, the first notification unit is notified of a warning. Filter device.
(Supplementary note 3) The filter device according to supplementary note 1, wherein
When the monitoring unit determines that the monitoring mode is a filtering mode, the monitoring unit records the network address included in the packet acquired by the packet acquisition unit, the communication protocol at the network address, and the first recording unit. When it is determined that the communication protocol at the network address acquired by the packet acquisition unit is different from the address recording information recorded in the first recording unit based on the address recording information, the difference is displayed in the second notification unit. The filter device characterized by the above.
(Appendix 4) The filter device according to Appendix 2,
The response request information is a Ping command,
The filter device, wherein the transmission unit transmits the Ping command to devices in the plurality of networks using private addresses of the plurality of networks.
(Additional remark 5) It is a filter apparatus of Additional remark 1, Comprising:
When the monitoring unit determines that the monitoring mode is a mode for collecting information for filtering, the monitoring unit further includes a blocking unit that blocks packets flowing on the communication line,
The filter device, wherein the packet acquisition unit acquires a packet blocked by the blocking unit.
(Supplementary note 6) A filter program of a device for filtering packets flowing on a communication line,
A setting step for setting a monitor mode for determining whether to collect information for filtering or to perform filtering;
A packet acquisition step of acquiring a packet flowing on the communication line;
If it is determined that the monitor mode is a mode for collecting information for filtering, address recording information is obtained by associating a network address included in the packet acquired by the packet acquisition step with a communication protocol at the network address. When the monitor mode is determined to be a filtering mode, the computer executes a monitoring step for performing packet filtering based on the address record information recorded in the first memory. Filter program to let you.
(Supplementary note 7) The filter program according to supplementary note 6, wherein
For a device connected on the communication line, further causing the computer to execute a transmission step of transmitting response request information that is information for requesting a response,
When the monitoring step determines that the monitor mode is a mode for collecting information for filtering, the network address of the device that has responded to the response request information transmitted by the transmission step is A filter which is recorded in a second memory and causes the device to be notified of a warning when a network address included in the packet acquired in the packet acquisition step is a network address not recorded in the second memory. program.
(Supplementary note 8) The filter program according to supplementary note 6, wherein
When the monitoring step determines that the monitoring mode is a filtering mode, the network address included in the packet acquired by the packet acquisition step, the communication protocol at the network address, and the address recorded in the first memory If it is determined that the communication protocol at the network address acquired by the packet acquisition step is different from the address record information recorded in the first memory based on the record information, the apparatus is notified of the difference. A filter program characterized by that.
(Supplementary note 9) The filter program according to supplementary note 7,
The response request information is a Ping command,
The transmission program includes transmitting the Ping command to devices in the plurality of networks using private addresses of the plurality of networks.
(Supplementary note 10) The filter program according to supplementary note 6, wherein
When the monitoring step determines that the monitoring mode is a mode for collecting information for filtering, the computer further executes a blocking step for blocking packets flowing on the communication line,
The filter program characterized in that the packet acquisition step acquires the packet blocked by the blocking step.
(Supplementary note 11) A filtering method in an apparatus for filtering packets flowing on a communication line,
A setting step for setting a monitor mode for determining whether to collect information for filtering or to perform filtering;
A packet acquisition step of acquiring a packet flowing on the communication line;
If it is determined that the monitor mode is a mode for collecting information for filtering, address recording information is obtained by associating a network address included in the packet acquired by the packet acquisition step with a communication protocol at the network address. And a monitoring step of performing packet filtering based on the address record information recorded in the first memory when it is determined that the monitor mode is a filtering mode. .
(Supplementary note 12) The filtering method according to supplementary note 11, wherein
A transmission step of transmitting response request information, which is information for requesting a response, to a device connected on the communication line;
When the monitoring step determines that the monitor mode is a mode for collecting information for filtering, the network address of the device that has responded to the response request information transmitted by the transmission step is A filter which is recorded in a second memory and causes the device to be notified of a warning when a network address included in the packet acquired in the packet acquisition step is a network address not recorded in the second memory. Method.
(Supplementary note 13) The filtering method according to supplementary note 11, wherein
When the monitoring step determines that the monitoring mode is a filtering mode, the network address included in the packet acquired by the packet acquisition step, the communication protocol at the network address, and the address recorded in the first memory If it is determined that the communication protocol at the network address acquired by the packet acquisition step is different from the address record information recorded in the first memory based on the record information, the apparatus is notified of the difference. A filtering method characterized by the above.
(Supplementary note 14) The filtering method according to supplementary note 12,
The response request information is a Ping command,
The transmission method includes transmitting the Ping command to devices in the plurality of networks using private addresses of the plurality of networks.
(Supplementary note 15) The filtering method according to supplementary note 11, wherein
When the monitoring step determines that the monitoring mode is a mode for collecting information for filtering, the method further includes a blocking step for blocking packets flowing on the communication line,
The filtering method, wherein the packet acquisition step acquires the packet blocked by the blocking step.

  1 filter device, 2 setting terminal, 10 registration unit, 11 monitoring unit, 12 address management DB, 13 matrix DB, 14 filtering DB.

Claims (5)

A filter device for filtering packets flowing on a communication line,
A database storing one or more network addresses;
Of the packets flowing on the communication line, depending on whether or not the network address of the transmission source or the transmission destination matches the network address stored in the database storing the one or more network addresses, Means for controlling whether or not the source network address, the destination network address, and the protocol are associated and recorded in the database;
Means for filtering packets flowing on the communication line based on whether or not they match the contents stored in the database that stores the packet source network address, the destination network address, and the protocol in association with each other ; ,
A filter device comprising: The filter device further includes
Response request information is transmitted to each private address in the network to which the filter device is connected, and the network address of the device that has responded to the transmitted response request information is stored in the database that stores the one or more network addresses. Means to store
Filter apparatus according to claim 1, characterized in that it comprises a. A process of outputting warning information is executed when the network address of the source or destination of the extracted packet does not match the network address stored in the database storing the one or more network addresses. The filter device according to claim 1 or 2. A filter program for filtering packets flowing on a communication line,
Of the packets flowing on the communication line, transmission of the packet depends on whether the network address of the transmission source or the transmission destination matches the network address stored in the database storing one or more network addresses. Controlling whether the original network address, the destination network address, and the protocol are recorded in the database in association with each other ;
On the basis of whether it matches the database stored contents to be stored in association with the source network address of the packet and the destination network address and protocol, and performing filtering of a packet flowing on the communication line ,
A filter program that causes a computer to execute. A filtering method in an apparatus for filtering packets flowing on a communication line,
Of the packets flowing on the communication line, transmission of the packet depends on whether the network address of the transmission source or the transmission destination matches the network address stored in the database storing one or more network addresses. Controlling whether the original network address, the destination network address, and the protocol are recorded in the database in association with each other;
Filtering packets flowing on the communication line based on whether or not they match the contents stored in the database that stores the packet source network address, the destination network address, and the protocol in association with each other; and ,
A filtering method comprising:

Images