JP5219903B2 - URL filtering apparatus and URL filtering method - Google Patents

Description

  The present invention relates to a URL filtering apparatus and a URL filtering method for filtering URL (Uniform Resource Locator).

  As one of conventional URL filtering methods, there is a method in which an HTTP (HyperText Transfer Protocol) proxy server performs filtering based on a request URL when relaying an HTTP connection (for example, Patent Document 1 below and Non-Patent Document 1 below). And the following non-patent document 2). In this method, the HTTP client is set to use an HTTP proxy, and performs HTTP access through an HTTP proxy server to which a URL filtering function is added. In addition, when the HTTP message is relayed, the HTTP proxy extracts a request URL that the HTTP client requests access from, and executes URL filtering. Hereinafter, URL filtering using an HTTP proxy server is referred to as an HTTP proxy method.

  Further, even when the HTTP client is not set to use the HTTP proxy, there is a method of filtering by installing an HTTP proxy server on the relay path between the HTTP client and the HTTP server (for example, see Non-Patent Document 3 below). ). In this method, an HTTP proxy server on a relay route of a packet from an HTTP client to an HTTP server rewrites a TCP (Transmission Control Protocol) / IP (Internet Protocol) address and port number of the received NAPT (Network Address Port The HTTP proxy is received by a (Translation) operation and is forced to go through the HTTP proxy. Then, the HTTP proxy server performs URL filtering. Hereinafter, such a method is referred to as a transparent proxy method.

  The above-described transparent proxy method is a method for terminating TCP once by going through an HTTP proxy server after all. On the other hand, the TCP packet including the request URL is not subject to filtering by directly referring to the HTTP request in the TCP packet without going through the HTTP proxy server and without terminating the TCP packet between the HTTP client and the HTTP server. In some cases, a method is also proposed in which the data is passed as it is and an access denial response is returned when filtering is performed (see, for example, Patent Document 2 below).

Japanese Patent Laid-Open No. 11-242639 JP 2006-293708 A “Squid: optimizing Web Delivery”, http://www.squid-cache.org/ “SquidGuard”, http://www.squidguard.org/ “Transparent proxy with squid”, http: //www.linux (registered trademark) .or.jp / JF / JFdocs / TransparentProxy.html

  However, in the conventional HTTP proxy method, the HTTP proxy server performs URL filtering when the HTTP client is set to use the HTTP proxy. Therefore, there is a problem that URL filtering cannot be performed when the HTTP client is not set to use the HTTP proxy.

  In the conventional transparent proxy method, the HTTP proxy server once terminates the TCP session, extracts only the HTTP message part from one (HTTP client or HTTP server), and the other (HTTP server or HTTP client). Relay to. Therefore, the HTTP layer (L7) has an advantage that URL determination can be easily performed without considering the processing of the TCP layer (L4). On the other hand, there is a problem that TCP session termination processing is complicated and requires processing by general software. Also, the processing that occurs to terminate two TCP sessions once and the processing that occurs to relay a TCP message obtained from one TCP session to the other TCP session are required. There is a problem that it is complicated and needs to be implemented in software.

  In recent years, access line speed has been improved due to opticalization of access lines. However, if URL filtering is performed by the conventional transparent proxy method, URL filtering processing must be executed by software as described above. However, there is a problem that it becomes difficult to obtain a high throughput according to the access line speed.

  On the other hand, the above-described conventional HTTP client-HTTP server does not terminate the TCP packet, but directly refers to the internal HTTP message part and performs URL filtering, so the TCP session is not terminated. There is a possibility of high-speed transfer without processing. However, there is a problem that it is necessary to consider the TCP layer (L4) in the URL filtering process.

  For example, when a TCP packet including a request URL subject to URL filtering operation is detected by this method, if the packet is held for a long time for the URL filtering determination process, the TCP layer of the HTTP client causes an ACK response related to the packet. Cannot be received from the HTTP server. For this reason, in the TCP layer processing, it is determined that the packet has been discarded, and the packet is retransmitted, and the own transmission rate is lowered by the congestion avoiding operation, and the TCP level throughput may be lowered. There is.

  When URL filtering operation is realized by a device such as a home gateway installed on an access line, if the URL filter data used for URL filtering determination is provided in the device, the amount of memory that the device should have and CPU processing Ability will increase. Since devices such as home gateways often have limited hardware resources, the processing performed by such devices is limited to extracting the requested URL, and URL filtering determination processing is outsourced to an external server. It is considered more efficient to implement However, when entrusting URL filtering determination to an external server, a delay for a packet to and from the external server, a delay associated with URL determination processing at the external server, and the external server accept processing from multiple clients. In some cases, a delay or the like associated with waiting for such processing may occur, and a response may not be obtained for a long time. As a result, when entrusting URL filtering determination to an external server, there is a problem that TCP level throughput may be reduced.

  The present invention has been made in view of the above, and an object of the present invention is to provide a URL filtering apparatus and a URL filtering method capable of obtaining a high throughput while executing a URL filtering process.

  In order to solve the above-described problems and achieve the object, the present invention provides a packet transfer means for relaying a packet transmitted and received between a client and a server that perform communication using the HTTP protocol, and a packet transmitted from the client. Based on the URL access request message, URL passage determination means for determining whether or not access to the requested URL is permitted, TCP layer processing means for performing processing of a predetermined TCP layer, and predetermined TCP A TCP termination processing unit that performs termination processing; and an HTTP syntax analysis unit that performs HTTP syntax analysis of a received packet. The packet transfer unit terminates the TCP termination processing after instructed to start the TCP termination processing. The packet received during the TCP termination processing until the end is passed to the TCP termination processing means, and the TCP termination processing is performed. The packet received during a period other than the above is passed to the TCP layer processing means, and the TCP layer processing means extracts the TCP data part of the packet received from the packet transfer means, holds the packet, and performs the HTTP parsing When the means determines that the packet held in the TCP layer processing means is not a URL access request message based on the TCP data part, the means notifies the TCP layer processing means of the transmission permission of the packet, On the other hand, when the URL access request message is determined, the URL passage determination unit requests the URL passage determination unit to determine the URL passage of the URL access request message. The URL passage determination unit performs the URL passage determination based on the request. If the URL passage determination result is inaccessible, TCP termination processing is performed. When the URL passage determination result is accessible, the TCP layer processing unit notifies the transmission permission of the packet held, and the TCP termination processing unit instructs the start of the TCP termination processing. Then, a TCP termination process for terminating the session is performed, a packet generated by the TCP termination process is output to the packet transfer unit, and the TCP layer processing unit transmits the packet notified of the transmission permission to the packet transfer unit. The packet transfer means transmits the packet output from the TCP layer processing means and the packet output from the TCP termination processing means to the destination of each packet.

  According to the present invention, normally, TCP termination processing is not performed, but HTTP data is extracted from the received packet, and if it is determined that the access request to the URL is included in the HTTP data, the URL pass / access denied In this case, the TCP termination process is performed when the result of the access refusal is determined, so that it is possible to obtain a high throughput.

  Embodiments of a URL filtering device and a URL filtering method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a functional configuration example of a first embodiment of a URL filtering apparatus according to the present invention. As shown in FIG. 1, the URL filtering device 2 of the present embodiment includes a packet transfer processing unit 11 having a general packet routing function, a TCP layer packet processing unit 12 that performs TCP layer processing, and an HTTP parsing process. A unit 13, a request URL passage determination processing unit 14, an HTTP response creation processing unit 15, and a TCP termination processing unit 16. The URL filtering device 2 includes a PC (Personal Computer) terminal 1 that is an HTTP client, a web server 3 that functions as an HTTP server, and an ACS (Access Control Server) server 4 that functions as a URL access control server. And connected to.

  The uplink communication packet normal path 21 indicates a packet path during normal communication in the uplink direction between the PC terminal 1 and the URL filtering apparatus 2, and the downlink communication packet normal path 22 indicates the URL filtering apparatus 2 -PC terminal 1. The packet path during normal communication in the downstream direction is shown. An upstream communication packet termination path 23 indicates a packet path when upstream termination processing is performed between the PC terminal 1 and the URL filtering apparatus 2, and a downstream communication packet termination path 24 indicates the URL filtering apparatus 2 -PC terminal. A packet path in the case of performing a termination process in the downlink direction between 1 is shown.

  Next, the operation of the present embodiment will be described. First, a passing operation for allowing a packet to pass will be described. FIG. 2 is a sequence diagram illustrating an example of a packet passing operation in the URL filtering method according to the present embodiment. In FIG. 2, for the sake of simplicity, the PC terminal 1 is described as a terminal, the URL filtering device 2 as HGW, the WEB server 3 as WEB, and the ACS server 4 as ACS.

  When the PC terminal 1 requests HTTP access to the WEB server 3, first, as a 3-way-handshake process, the PC terminal 1 transmits a SYN packet indicating a connection request to the WEB server 3 via the URL filtering device 2. (Step S11, Step S12). The WEB server 3 sends a packet, which is a combination of an ACK packet indicating connection permission and a SYN packet for connection request, to the terminal 1 via the URL filtering device 2 (steps S13 and S14). The PC terminal 1 sends an ACK packet to the WEB server 3 via the URL filtering device 2 (step S15, step S16), and a connection between the PC terminal 1 and the WEB server 3 is established.

  At this time, the packet transfer processing unit 11 of the URL filtering device 2 confirms that the destination port number of the SYN packet received from the PC terminal 1 in step S11 is the HTTP service port number specified in advance, and the higher level protocol is The start of a TCP session that is HTTP is detected. Here, the packet transfer processing unit 11 has a function of an IP stack of a general IP router, that is, an IP packet transfer processing function and an HTTP / TCP packet extraction function. The packet transfer processing unit 11 determines a TCP packet belonging to the HTTP session based on the protocol type, IP address, and port number of a packet to be received thereafter, and notifies the TCP layer packet processing unit 12 of the determined TCP packet. To do.

  When the TCP layer packet processing unit 12 receives the packets transmitted in step S11 and step S15 from the packet transfer processing unit 11 and detects that the packet is a packet for 3way-handshake, the TCP layer packet processing unit 12 continues (through processing). The packet to be transferred is output to the packet transfer processing unit 11, and the packet transfer processing unit 11 transfers the packet to the WEB server 3 (steps S12 and S16). When the packet transmitted in step S13 is received from the packet transfer processing unit 11 and detected that the packet is a packet for 3way-handshake, it is output as it is to the packet transfer processing unit 11 as a packet to be transferred. The packet transfer processing unit 11 transfers the packet to the PC terminal 1 (step S14).

  In this way, the normal packet passes through the uplink communication packet normal path 21 and the downlink communication packet normal path 22 that pass from the packet transfer processing unit 11 to the TCP layer packet processing unit 12.

  After the 3-way-handshake process in steps S11 to S16, the PC terminal 1 transmits an HTTP / TCP packet including an HTTP method requesting access and a URL (step S17). The URL filtering device 2 performs the URL extraction process shown below (step S18).

  As the URL extraction process, first, the packet transfer processing unit 11 of the URL filtering device 2 notifies the TCP packet layer processing unit 12 of the received HTTP / TCP packet. The TCP layer packet processing unit 12 extracts the TCP data part from the data part of the HTTP / TCP packet as HTTP data, and notifies the HTTP syntax analysis processing unit 13 of the extracted HTTP data. At this time, the TCP layer packet processing unit 12 holds the HTTP / TCP packet.

  The HTTP syntax analysis processing unit 13 performs syntax analysis (parsing) processing on the notified HTTP data in accordance with the HTTP syntax format, and determines whether the HTTP access request is received. Note that the HTTP syntax analysis processing unit 13 may be a process in which all HTTP data included in each HTTP / TCP packet is connected in order, and the TCP data byte sequence is completely reproduced to perform syntax analysis. In this case, the TCP layer packet processing unit 12 performs order control processing of the received HTTP / TCP packet. That is, the transmission sequence number of the received HTTP / TCP packet is checked to check if there is a missing packet. If there is a missing packet, the waiting is performed until the missing packet is retransmitted.

  Further, the processing of the HTTP parsing processing unit 13 is simplified a little more, assuming that the message boundary of the HTTP access request and the boundary of the TCP data in the TCP packet are aligned, and the HTTP per TCP packet unit is HTTP. It is good also as processing which carries out syntax analysis. However, in this case, a problem may occur if the complete HTTP syntax is not included in each HTTP / TCP packet.

  Next, when the HTTP syntax analysis processing unit 13 determines that the HTTP / TCP packet received by the syntax analysis processing does not include an HTTP access request, or determines the HTTP access permission based on the received HTTP / TCP packet. When it is determined that the transmission is not appropriate, the TCP layer packet processing unit 12 is notified of permission to transmit the HTTP / TCP packet. When the TCP layer packet processing unit 12 receives a notification of transmission permission of the retained HTTP / TCP packet, the TCP layer packet processing unit 12 outputs the packet to the packet transfer processing unit 11 as a packet to be transmitted. Then, the packet transfer processing unit 11 transfers the packet to the WEB server 3. For example, as an example of determining that it is not appropriate to determine HTTP access permission, there is a case where a complete HTTP syntax is not included in each TCP packet. In this case, the packet transfer processing unit 11 may hold the TCP packet including the last TCP data constituting the complete HTTP syntax.

  On the other hand, when the HTTP syntax analysis processing unit 13 determines that the HTTP / TCP packet received by the syntax analysis processing includes an HTTP access request, the HTTP syntax analysis processing unit 13 extracts a URL part from the HTTP data requesting access, and requests URL passage determination processing unit 14 notifies the extracted URL. FIG. 2 shows an example in which it is determined that an HTTP access request is included. The request URL passage determination processing unit 14 determines the notified URL based on the URL permission information held by the own device, and when the request URL passage determination unit 14 determines that the passage is permitted, the TCP layer packet processing unit 12 sends a packet transmission permission. Notice. Alternatively, when the external ACS server 4 performs URL passage determination, the ACS server 4 is inquired. Specifically, for example, a packet for requesting the determination of the extracted URL information is transmitted (step S19), and the determination is made based on the URL permission information held by the ACS server 4. Then, the ACS server 4 returns a URL permission response when it is permitted as a determination result (step S20). When the URL access permission response is received from the ACS server 4 within a predetermined time, the request URL passage determination processing unit 14 notifies the TCP layer packet processing unit 12 of packet transmission permission. When the ACS server 4 is not used, steps S19 and S20 are not performed, and the determination is performed in the URL filtering device 2 as described above.

  Then, the TCP layer packet processing unit 12 transfers, to the WEB server 3, a packet that is permitted to be transmitted among the retained HTTP / TCP packets (step S21). After that, as a subsequent packet, an HTTP / TCP packet for transmitting data to the PC terminal 1 is transmitted from the WEB server 3 via the URL filtering device 2 (steps S22 and S23), and from the PC terminal 1 via the URL filtering device 2 Thus, an ACK packet is transmitted to the WEB server 3 (steps S24 and S25). Thereafter, similarly, in steps S26 to S33, data transmission from the WEB server 3 to the PC terminal 1 and transmission of an ACK packet from the PC terminal 1 to the WEB server 3 are repeated, and the PC terminal 1 continues the HTTP access. To do.

  Next, a blocking operation that does not permit the passage of packets will be described. FIG. 3 is a sequence diagram illustrating an example of a packet blocking operation in the URL filtering method according to the present embodiment. First, similarly to the case of the passing operation described in FIG. 2, steps S11 to S18 are performed. In the case of the passage operation in FIG. 2, the request URL passage determination processing unit 14 has determined that the passage is permitted by the URL extraction processing in step S18, but here it is determined that the passage permission is not permitted (access denied). To do.

  When the external ACS server 4 performs the URL passage determination, Steps S19 and S20 are performed as described above, and an access denial response is transmitted in Step S20.

  The request URL passage determination processing unit 14 notifies the HTTP response creation processing unit 15 of the access rejection determination result when it determines that the access is denied or when it receives an access rejection response from the ACS server 4 within a predetermined time. And instructing the start of TCP termination processing. The HTTP response creation processing unit 15 creates a response message (403 forbidden or the like) corresponding to the notified access denial, notifies the TCP termination processing unit 16 of the start of the TCP termination processing, and passes the response message.

  The TCP termination processing unit 16 collects information necessary for TCP termination processing from the TCP layer packet processing unit 12, changes the communication path with the PC terminal 1 to the upstream communication packet termination path 23, and communicates with the WEB server 3. Is changed to the downlink communication packet termination path 24. Then, the TCP termination processing unit 16 starts client-side TCP termination processing (step S41). First, the TCP termination processing unit 16 transmits an HTTP / TCP packet including a response message (403 forbidden) indicating an access denial response generated by the HTTP response creation processing unit 15 to the PC terminal 1 (step S42). Then, as the client-side TCP termination processing, the TCP termination processing unit 16 transmits a FIN / ACK packet to the PC terminal 1 (step S43), and the PC terminal 1 returns the FIN / ACK packet (step S44). The TCP termination processing unit 16 transmits an ACK packet to the PC terminal 1 (step S45).

  After performing the client-side termination process, the TCP termination processing unit 16 starts the server-side TCP termination process (step S46). Then, as server-side TCP termination processing, the FIN / ACK packet is transmitted to the WEB server 3 (step S47), the WEB server 3 returns the FIN / ACK packet (step S48), and the TCP termination processing unit 16 An ACK packet is transmitted to the WEB server 3 (step S49). With the above processing, the TCP session between the PC terminal 1 and the WEB server is blocked.

  Next, HTTP redirect response processing will be described. FIG. 4 is a sequence diagram illustrating an example of a procedure of HTTP redirect response processing according to the present embodiment. The processes in steps S11 to S19 are the same as in the case of the passing operation in FIG. However, although the case where the ACS server 4 is used is shown here, the same applies to the case where the URL extraction process in step S18 does not end within a predetermined time when the ACS server 4 is not used.

  If the PC terminal 1 does not respond to the packet even after a predetermined time has elapsed after transmitting the HTTP method and URL containing the HTTP method requesting access in step S17, the PC terminal 1 resends the packet due to timeout. Is retransmitted (step S52), and the packet transmitted in step S17 is retransmitted (step S52). When the TCP layer packet processing unit 12 detects that the packet received via the packet transfer processing unit 11 is a retransmission packet, the TCP layer packet processing unit 12 determines that the URL determination processing is delayed, and sends it to the HTTP response creation processing unit 15. Redirect processing request for requesting redirection processing is notified, and the HTTP response creation processing unit 15 generates an HTTP response message requesting access to the same URL again by redirection (step S53).

  At this time, for example, when the PC terminal 1 interprets the normal HTML syntax, the HTTP response creation processing unit 15 generates a response message including an HTTP 302 response that requests access to the same URL again. At this time, the URL to be accessed again is described in the Location: field defined by the 302 response. In addition, when the PC terminal 1 can interpret a script or program embedded in the HTML syntax and operates according to the script or program, the PC terminal 1 accesses the same URL again after a certain time as the script or program. It is good also as a response message containing the content which described. Note that the determination of what kind of HTTP response the PC terminal 1 can interpret can be made from the option field of the HTTP request message.

  Next, the HTTP response creation processing unit 15 notifies the TCP termination processing unit 16 of the start of the TCP termination processing together with the generated response message. The TCP termination processing unit 16 transmits the response message to the PC terminal 1 (step S54), and implements the TCP termination processing for disconnecting the TCP session as in steps S43 to S45 (steps S55 to S57). Then, as the TCP termination process on the WEB server 3 side, the TCP termination process for cutting the TCP session is performed in the same manner as in Steps S47 to S49 (Steps S58 to S60).

  As described above, after the TCP session is disconnected, the PC terminal 1 performs a process for re-accessing the same URL as the URL requested in step S17 as a redirect process based on the response message transmitted in step S54. Execute (Step S62). And step S11-step S17 are implemented again.

  On the other hand, when the URL filtering device 2 receives a response to the determination request transmitted in step S19 from the ACS server 4 while the PC terminal 1 is executing the redirect process (step S61), the determination result is, for example, The TCP layer packet processing unit 12 holds it. When the URL itself is determined without making an inquiry to the ACS server 4, the request URL passage determination processing unit 14 terminates the process, notifies the TCP layer packet processing unit 12 of the processing result, and receives the TCP The layer packet processing unit 12 may hold the result.

  When the TCP layer packet processing unit 12 receives the packet of step S17 by the redirect process, the TCP layer packet processing unit 12 already holds the determination result of the URL requested by the packet, and performs the subsequent processing based on the result. The subsequent processing is the same as the processing after the determination of the passing operation in FIG. 3 and the processing after the determination of the blocking operation in FIG. 4, but in the case of the blocking determination, for example, when the result is a blocking determination. Then, an HTTP / TCP packet (for example, 403 forbidden) including an access rejection response may be transmitted (step S64).

  Next, the TCP termination processing of this embodiment will be described in detail. 5A to 5C are diagrams illustrating an example of the transmission sequence number, the ACK sequence number, and the TCP message length of the TCP packet transmitted and received in the sequence diagram of FIG. 5A and FIG. 5B, a 3way-handshake process and an HTTP request message (including retransmission), FIG. 5B a client side TCP termination process, and FIG. 5C a server side TCP termination process. Show.

  FIGS. 5A to 5C show, in order from the left column, the step number of FIG. 4, the direction that is the transmission direction of the packet, the transmission sequence number, the ACK sequence number, and the TCP message length. In the direction column, the PC terminal 1 that is a client is denoted as C, the WEB server 3 is denoted as S, and the URL filtering device 2 is denoted as U. Further, ISNc is an initial sequence number (hereinafter referred to as ISN) of the PC terminal 1, and ISNs is an initial sequence number of the WEB server 3.

  In the TCP, the SYN bit and the FIN bit increase the transmission sequence number by +1, and are shown as (1) in the TCP message length column for convenience here.

  After the TCP 3-way-handshake process in steps S11 to S17, the PC terminal 1 transmits an HTTP request message including the request URL, and retransmits it in step S52. The TCP layer packet processing unit 12 monitors a transmission sequence number and an ACK sequence number of a received message (packet).

  When the URL filtering device 2 starts TCP termination processing (step S55), the TCP termination processing unit 16 uses the latest transmission sequence number used between the TCP layer packet processing unit 12 and the PC terminal 1-WEB server 3. And ACK sequence number. Next, the TCP termination processing unit 16 generates a transmission sequence number and an ACK sequence number when transmitting the response message transmitted in step S54 based on the information at the bottom of FIG. Specifically, the transmission sequence number is the same as the lowest value in FIG. 5A (the value of the message transmitted in step S17), and the ACK sequence number is reset to the lowest value in FIG. It is generated by adding the lower TCP message length (HTTPr). Thus, in communication between the URL filtering device 2 and the PC terminal 1, an ACK sequence number as shown in FIG. 5-2 is generated in consideration of the TCP message length.

  Further, in the communication between the URL filtering device 2 and the WEB server 3, as shown in FIG. 5-3, the lowest value in FIG. 5-1, the transmission sequence number, and the ACK sequence number are the same.

  As described above, the TCP termination processing unit 16 transmits the transmission sequence number and the ACK sequence number between the URL filtering device 2 and the PC terminal 1, the transmission sequence number and the ACK sequence number between the URL filtering device 2 and the WEB server 3, Are managed individually.

  In the present embodiment, the example in which the above redirect response process is performed for the first URL access request after the TCP session is established by the 3way-handshake process is shown. A redirect response may also be returned for a subsequent HTTP URL request notified from the PC terminal 1 by the HTTP keep-alive function described in HTTP 1.1.

  As described above, in the present embodiment, the URL filtering device 2 normally extracts the HTTP data without performing the TCP termination processing, and the HTTP parsing processing unit 13 performs the TCP termination processing. When it is determined that the access request to the URL is included in the HTTP data, the request URL passage determination processing unit 14 determines the passage of the URL / rejects the access (or makes an inquiry about the URL determination from the ACS server 4). If the result is an access refusal determination result, TCP termination processing is performed. Therefore, at the time of normal processing, it is not necessary to perform TCP session termination that is necessary for the conventional HTTP proxy operation or transparent proxy operation. Accordingly, it is possible to avoid a decrease in throughput due to execution of TCP termination processing by software processing and to provide TCP level throughput corresponding to the access line speed.

  In addition, when a determination result for the request URL is not obtained within a certain time, a redirect process for replacing with a new TCP session is executed. For this reason, even when transmission of a TCP packet including a request URL is suspended for a long time, it is possible to avoid erroneous detection of TCP session disconnection and a decrease in TCP level throughput. Further, since transmission of a TCP packet can be held for a long time, it is possible to prolong the time until a determination result is responded to a request URL.

  In addition, since it is possible to lengthen the time until the determination result is responded as described above, when the URL filtering device 2 performs the URL determination internally, when the processing capability of the arithmetic processing unit of the device is low or compared Even when the amount of URL information to be compared is large, URL determination can be performed.

  In addition, since it is possible to lengthen the time until the determination result is returned as described above, when the URL determination is requested to the external ACS server 4, the ACS server 4 that is requested to determine determines the URL determination result immediately. No need to respond. Therefore, when the ACS server 4 accepts URL determination requests from a plurality of URL filtering devices, one ACS 4 can accommodate more URL filtering devices. Further, as a result, there is an effect that the provider of the ACS server 4 can reduce the number of ACS servers to be prepared, and can reduce the equipment cost and operation cost of the ACS server.

Embodiment 2. FIG.
FIG. 6 is a diagram illustrating a functional configuration example of the second embodiment of the URL filtering device according to the present invention. As shown in FIG. 6, the URL filtering device 2a of the present embodiment adds a fixed transfer processing unit 17 that executes a fixed transfer process with hardware such as a network processor to the URL filtering device 2 of the first embodiment. Except for this, it is the same as the URL filtering device 2 of the first embodiment. Components having the same functions as those of the first embodiment are denoted by the same reference numerals as those of the first embodiment, and description thereof is omitted.

  In the present embodiment, processing that reduces software processing required for packet transfer is performed as compared with the first embodiment. The normal communication packet path 22a in FIG. 6 indicates the normal packet path in the downlink direction of the present embodiment.

  Next, the operation of the present embodiment will be described. In the present embodiment, the packet transfer processing unit 11 notifies the TCP layer packet processing unit 12 of only the upstream packet. The fixed transfer processing unit 17 performs a transfer process on the downstream packet by a fixed transfer process. For this reason, in the present embodiment, the packet transfer processing unit 11 sets only the uplink packets as the sequence number monitoring targets.

  That is, for example, the fixed transfer processing unit 17 transfers the packet received in step S13 of the first embodiment to the PC terminal 1 by a fixed process. For upstream packets, the same processing as in the first embodiment is performed.

  In this configuration, taking FIG. 4 as an example, the TCP layer packet processing unit 12 determines only the transmission sequence number and the ACK sequence number from the packets transmitted in steps S11, S15, and S52 before starting the TCP termination process. I can't get it. However, considering the packet transmitted in step S54, which is the first transmission packet between the PC terminal 1 and the URL filtering device 2 at the time of TCP termination processing, the transmission sequence number and ACK sequence number required at the time of transmission of this packet are There is no problem because it is obtained from the packet transmitted in step S17 or step S52. The same applies to the packet transmitted in step S58, which is a transmission packet between the first URL filtering device 2 and the WEB server 3 at the time of TCP termination processing.

  Note that the processing after the start of the TCP termination processing is processing for the upstream packet via the downstream communication packet termination route 24 as in the first embodiment. The operations of the present embodiment other than those described above are the same as those of the first embodiment.

  As described above, in the present embodiment, normal (without TCP termination processing) upstream packets are processed in the same manner as in the first embodiment, and normal downstream packets are processed by the fixed transfer processing unit 17. However, it was implemented by fixed processing by hardware. Therefore, it is possible to improve the downstream throughput as compared with the first embodiment.

Embodiment 3 FIG.
FIG. 7 is a diagram illustrating a functional configuration example of the third embodiment of the URL filtering device according to the present invention. As shown in FIG. 7, the URL filtering device 2b of the present embodiment is the same as that of the second embodiment except that the TCP termination processing unit 16 of the URL filtering device 2a of the second embodiment is changed to the TCP simple termination processing unit 16a. This is the same as the URL filtering device 2a. Components having the same functions as those of the second embodiment are denoted by the same reference numerals as those of the second embodiment, and description thereof is omitted.

  FIG. 8 is a sequence diagram illustrating an example of a TCP termination processing procedure according to the present embodiment. First, similarly to the operation of the first embodiment described with reference to FIG. 4, the processes of steps S11 to S19, steps S52 and S53 are performed. After that, the TCP simple termination processing unit 16a transmits a packet including the response message transmitted by the same processing as in step S54 and FIN / ACK as the TCP termination processing, and this packet does not arrive at the PC terminal 1. (Step S71).

  If there is no response to the packet even after a predetermined time has elapsed since the packet was transmitted in step S52, the PC terminal 1 starts a retransmission process due to a timeout and retransmits the packet transmitted in step S17 (step S73). ).

  When receiving the packet transmitted in step S73, the TCP simple termination processing unit 16a retransmits the same packet as the packet transmitted in step S71 (step S74). In the future, the PC terminal 1 receives the packet transmitted in step S74, transmits a FIN / ACK packet (step S75), and the TCP simple termination processing unit 16a receives the packet transmitted in step S75. The ACK packet is transmitted (step S76).

  In the case of the TCP termination processing unit 16 according to the first embodiment, for example, when a response to the packet transmitted in step S71 does not arrive within a predetermined time, it determines a timeout and retransmits the packet. On the other hand, the TCP simple termination processing unit 16a according to the present embodiment does not monitor the timeout of its own transmission packet in this way, and transmits a TCP packet as a response when receiving a packet from the communication partner. It is simplified as you do.

  Then, it is assumed that the TCP simple termination processing unit 16a transmits a FIN / ACK packet as TCP termination processing on the server side, and this packet has not arrived at the WEB server 3 within a predetermined time (step S77). If the URL filtering processing device 2b does not transmit a packet even after a predetermined time has elapsed, the WEB server 3 determines that retransmission is necessary (step S78), and retransmits the ACK packet (step S79).

  When receiving the ACK packet from the WEB server 3, the TCP simple termination processing unit 16a determines that the packet transmitted in Step S77 has not arrived, and retransmits the FIN / ACK packet transmitted in Step S77 (Step S77). S80). Then, the WEB server 3 transmits a FIN / ACK packet to the URL filtering device 2b (step S81), and the TCP simple termination processing unit 16a of the URL filtering device 2b transmits an ACK packet to the WEB server 3 (step S82). .

  The operations of the present embodiment other than those described above are the same as those of the second embodiment. In this embodiment, the TCP termination processing unit 16 of the URL filtering device 2a of the second embodiment is replaced with the TCP simple termination processing unit 16a. However, the TCP termination of the URL filtering device 2 of the first embodiment is used. The processing unit 16 may be replaced with the TCP simple termination processing unit 16a, and the process of the TCP simple termination processing unit 16a may be performed.

  As described above, in this embodiment, when the TCP simple termination processing unit 16a receives a TCP packet from a communication partner (PC terminal 1 or WEB server 3), the TCP packet serving as a response is transmitted. . For this reason, a TCP session can be terminated without performing complicated TCP processing operations such as retransmission timer processing and congestion avoidance that are required in normal TCP termination processing. Therefore, compared with the first and second embodiments, the processing of the TCP simple termination processing unit 16a can be reduced.

  As described above, the URL filtering device and the URL filtering method according to the present invention are useful for communication systems that perform URL filtering, and are particularly suitable for communication systems that achieve high throughput.

It is a figure which shows the function structural example of Embodiment 1 of the URL filtering apparatus concerning this invention. 6 is a sequence diagram illustrating an example of a packet passing operation according to the first embodiment. FIG. 6 is a sequence diagram illustrating an example of a packet blocking operation according to the first embodiment. FIG. 6 is a sequence diagram illustrating an example of a procedure of HTTP redirect response processing according to the first embodiment. FIG. It is a figure which shows an example of the transmission sequence number of a TCP packet, an ACK sequence number, and a TCP message length. It is a figure which shows an example of the transmission sequence number of a TCP packet, an ACK sequence number, and a TCP message length. It is a figure which shows an example of the transmission sequence number of a TCP packet, an ACK sequence number, and a TCP message length. 6 is a diagram illustrating a functional configuration example of a URL filtering device according to a second embodiment. FIG. FIG. 10 is a diagram illustrating a functional configuration example of a URL filtering apparatus according to a third embodiment. FIG. 10 is a sequence diagram illustrating an example of a TCP termination processing procedure according to the third embodiment.

DESCRIPTION OF SYMBOLS 1 PC terminal 2, 2a, 2b URL filtering apparatus 3 WEB server 4 ACS server 11 Packet transfer process part 12 TCP layer packet process part 13 HTTP parsing process part 14 Request URL passage determination process part 15 HTTP response preparation process part 16 TCP termination | terminus Processing Unit 16a TCP Simple Termination Processing Unit 17 Fixed Transfer Processing Unit 21 Uplink Communication Packet Normal Path 22, 22a Downlink Communication Packet Normal Path 23 Uplink Communication Packet Termination Path 24 Downlink Communication Packet Termination Path

Claims (14)

Packet transfer means for relaying packets transmitted and received between a client and a server that perform communication using the HTTP protocol;
URL passage determination means for performing URL passage determination, which is determination of whether or not access to the requested URL is possible based on a URL access request message transmitted from the client;
TCP layer processing means for processing a predetermined TCP layer;
TCP termination processing means for performing predetermined TCP termination processing;
HTTP parsing means for performing HTTP parsing of the received packet;
With
The packet transfer means passes the packet received during the TCP termination process from the start of the TCP termination process until the end of the TCP termination process to the TCP termination process means, and in a period other than during the TCP termination process. Pass the received packet to the TCP layer processing means,
The TCP layer processing means extracts the TCP data part of the packet received from the packet transfer means and holds the packet,
If the HTTP syntax analysis unit determines that the packet held in the TCP layer processing unit is not a URL access request message based on the TCP data part, the TCP layer processing unit allows the packet transmission permission. On the other hand, if it is determined that it is a URL access request message, the URL access determination means is requested to determine the URL access request message for URL passing,
The URL passage determination means performs URL passage determination based on the request, and when the URL passage determination result is inaccessible, instructs the start of TCP termination processing, and the URL passage determination result is accessible. In the case, the transmission permission of the packet held in the TCP layer processing means is notified,
The TCP termination processing means performs TCP termination processing for terminating a session when an instruction to start TCP termination processing is given, and outputs a packet generated by the TCP termination processing to the packet transfer means,
The TCP layer processing means outputs a packet notified of transmission permission to the packet transfer means,
The URL filtering apparatus, wherein the packet transfer unit transmits the packet output from the TCP layer processing unit and the packet output from the TCP termination processing unit to a transmission destination of each packet. Packet transfer means for relaying packets transmitted and received between a client and a server that perform communication using the HTTP protocol;
Based on the URL access request message transmitted from the client, a URL determination request including the requested URL is transmitted to an external device that performs URL passage determination, which is determination of whether or not the URL can be accessed, and In response, URL passage determination means for acquiring a determination result from the external device;
TCP layer processing means for processing a predetermined TCP layer;
TCP termination processing means for performing predetermined TCP termination processing;
HTTP parsing means for performing HTTP parsing of the received packet;
With
The packet transfer means passes the packet received during the TCP termination process from the start of the TCP termination process until the end of the TCP termination process to the TCP termination process means, and in a period other than during the TCP termination process. Pass the received packet to the TCP layer processing means,
The TCP layer processing means extracts the TCP data part of the packet received from the packet transfer means and holds the packet,
If the HTTP syntax analysis unit determines that the packet held in the TCP layer processing unit is not a URL access request message based on the TCP data part, the TCP layer processing unit allows the packet transmission permission. On the other hand, if it is determined that it is a URL access request message, the URL access determination means is requested to determine the URL access request message for URL passing,
The URL passage determination means transmits a URL determination request including the URL included in the URL access request message to the external device based on the request, acquires a URL passage determination result as a response to the request, When the passage determination result is inaccessible, the TCP termination processing is instructed. When the URL passage determination result is accessible, the transmission permission of the packet held in the TCP layer processing means is notified. ,
The TCP termination processing means performs TCP termination processing for terminating a session when an instruction to start TCP termination processing is given, and outputs a packet generated by the TCP termination processing to the packet transfer means,
The TCP layer processing means outputs a packet notified of transmission permission to the packet transfer means,
The URL filtering apparatus, wherein the packet transfer unit transmits the packet output from the TCP layer processing unit and the packet output from the TCP termination processing unit to a transmission destination of each packet. Packet transfer means for relaying packets transmitted and received between a client and a server that perform communication using the HTTP protocol;
URL passage determination means for performing URL passage determination, which is determination of whether or not access to the requested URL is possible based on a URL access request message transmitted from the client;
TCP layer processing means for processing a predetermined TCP layer;
TCP termination processing means for performing predetermined TCP termination processing;
HTTP parsing means for performing HTTP parsing of the received packet;
Simple transfer means for performing a predetermined transfer process;
With
The packet transfer means passes the packet received during the TCP termination process from the start of the TCP termination process until the end of the TCP termination process to the TCP termination process means, and in a period other than during the TCP termination process. Pass the packet received from the client to the TCP layer processing means,
The TCP layer processing means extracts the TCP data part of the packet received from the packet transfer means and holds the packet,
If the HTTP syntax analysis unit determines that the packet held in the TCP layer processing unit is not a URL access request message based on the TCP data part, the TCP layer processing unit allows the packet transmission permission. On the other hand, if it is determined that it is a URL access request message, the URL access determination means is requested to determine the URL access request message for URL passing,
The URL passage determination means performs URL passage determination based on the request, and when the URL passage determination result is inaccessible, instructs the start of TCP termination processing, and the URL passage determination result is accessible. In the case, the transmission permission of the packet held in the TCP layer processing means is notified,
The TCP termination processing means performs TCP termination processing for terminating a session when an instruction to start TCP termination processing is given, and outputs a packet generated by the TCP termination processing to the packet transfer means,
The TCP layer processing means outputs a packet notified of transmission permission to the packet transfer means,
The packet transfer means transmits the packet output from the TCP layer processing means and the packet output from the TCP termination processing means to the destination of each packet,
The URL filtering device, wherein the simple transfer means transfers a packet received from the server to a client during a period other than during TCP termination processing. Packet transfer means for relaying packets transmitted and received between a client and a server that perform communication using the HTTP protocol;
Based on the URL access request message transmitted from the client, a URL determination request including the URL requested by the message is transmitted to an external device that performs URL passage determination, which is determination of whether or not access to the URL is possible. In response, URL passage determination means for acquiring a determination result from the external device;
TCP layer processing means for processing a predetermined TCP layer;
TCP termination processing means for performing predetermined TCP termination processing;
HTTP parsing means for performing HTTP parsing of the received packet;
Simple transfer means for performing a predetermined transfer process;
With
The packet transfer means passes the packet received during the TCP termination process from the start of the TCP termination process until the end of the TCP termination process to the TCP termination process means, and in a period other than during the TCP termination process. Pass the packet received from the client to the TCP layer processing means,
The TCP layer processing means extracts the TCP data part of the packet received from the packet transfer means and holds the packet,
If the HTTP syntax analysis unit determines that the packet held in the TCP layer processing unit is not a URL access request message based on the TCP data part, the TCP layer processing unit allows the packet transmission permission. On the other hand, if it is determined that it is a URL access request message, the URL access determination means is requested to determine the URL access request message for URL passing,
The URL passage determination means transmits a URL determination request including the URL included in the URL access request message to the external device based on the request, acquires a URL passage determination result as a response to the request, When the passage determination result is inaccessible, the TCP termination processing is instructed. When the URL passage determination result is accessible, the transmission permission of the packet held in the TCP layer processing means is notified. ,
The TCP termination processing means performs TCP termination processing for terminating a session when an instruction to start TCP termination processing is given, and outputs a packet generated by the TCP termination processing to the packet transfer means,
The TCP layer processing means outputs a packet notified of transmission permission to the packet transfer means,
The packet transfer means transmits the packet output from the TCP layer processing means and the packet output from the TCP termination processing means to the destination of each packet,
The URL filtering device, wherein the simple transfer means transfers a packet received from the server to a client during a period other than during TCP termination processing.   The URL filtering apparatus according to claim 1, wherein the TCP termination process is divided into two sessions, a session for the client and a session for the server. HTTP response means for generating an HTTP response;
Further comprising
If the TCP layer processing means determines that the URL access request message packet transmitted from the client is a retransmission packet, the TCP layer processing means instructs the client to start a TCP termination process to end the session, and Instructing the generation of a redirect response, which is a response for requesting access to the same URL again,
The URL filtering device according to claim 1, wherein the HTTP response unit generates a redirect response based on the instruction, and transmits the generated redirect response to the client.   The TCP layer processing means holds the URL passage determination result. When the URL passage determination result of the URL corresponding to the retransmission packet is held, the held URL passage determination result is retransmitted. The URL filtering apparatus according to claim 6, wherein the URL filtering determination result is a URL passage determination result for the packet.   8. The URL according to claim 6, wherein the redirect response is an “HTTP 302” response, and a URL requested to be accessed by the URL access request message is included in a Location field of the “HTTP 302” response. 9. Filtering device.   In the HTTP data part of the redirect response, an operation for requesting access again to the URL requested to be accessed by the URL access request message after a lapse of a predetermined time is described by a script or program interpretable by the client. The URL filtering device according to claim 6 or 7.   10. The redirect response is also returned to a subsequent URL access request message notified from the client by an HTTP keep-alive function described in HTTP 1.1. The URL filtering apparatus as described in any one.   The said TCP termination process is a process which transmits the packet used as the response when a predetermined packet is received from the said client or the said server, It is any one of Claims 1-10 characterized by the above-mentioned. URL filtering device.   12. The URL filtering according to claim 11, wherein the TCP termination processing means sets the ACK sequence number of the response packet of the received packet as a value obtained by adding the TCP data length to the ACK sequence number of the received packet. apparatus. Packet transfer means for relaying packets transmitted and received between a client and a server that perform communication using the HTTP protocol, and whether or not the requested URL can be accessed based on a URL access request message transmitted from the client A URL filtering method in a URL filtering device comprising:
The packet transfer means sets the packet received during the TCP termination process from the start of the TCP termination process to the end of the TCP termination process as a TCP termination process target, and received during a period other than during the TCP termination process A packet discrimination step for processing a packet as a TCP layer; and
A TCP layer processing step for extracting a TCP data portion of a packet subject to TCP layer processing and holding the packet;
If it is determined that the packet held in the TCP layer processing step is not a URL access request message based on the TCP data part, the transmission permission of the packet is notified, while it is determined that the packet is a URL access request message. If so, an HTTP syntax analysis step for requesting the URL passage determination means to make a URL passage determination of the URL access request message;
The URL passage determination means performs URL passage determination based on the request, and when the URL passage determination result is inaccessible, instructs the start of TCP termination processing, and the URL passage determination result is accessible. A URL passage determination step for notifying the transmission permission of the packet held in the TCP layer processing step;
A TCP termination process step of performing a TCP termination process for terminating a session when an instruction to start a TCP termination process is given, and outputting a packet generated by the TCP termination process to the packet transfer means;
A transmission permission packet output step of outputting a packet notified of transmission permission to the packet transfer means;
The packet transfer means transmits a packet output by execution of the TCP layer processing step and a packet output by execution of the TCP termination processing step to a transmission destination of each packet;
URL filtering method characterized by including these. Based on a URL access request message transmitted from the client, a packet transfer means for relaying a packet transmitted / received between a client and a server that perform communication using the HTTP protocol, and the URL requested by the message is included. A URL passage determination means for transmitting the received URL determination request to an external device that performs URL passage determination, which is determination of whether or not access to the URL is possible, and obtaining a determination result from the external device as a response thereto. A URL filtering method in a URL filtering device,
The packet transfer means sets the packet received during the TCP termination process from the start of the TCP termination process to the end of the TCP termination process as a TCP termination process target, and received during a period other than during the TCP termination process A packet discrimination step for processing a packet as a TCP layer; and
A TCP layer processing step for extracting a TCP data portion of a packet subject to TCP layer processing and holding the packet;
If it is determined that the packet held in the TCP layer processing step is not a URL access request message based on the TCP data part, the transmission permission of the packet is notified, while it is determined that the packet is a URL access request message. If so, an HTTP syntax analysis step for requesting the URL passage determination means to make a URL passage determination of the URL access request message;
The URL passage determination means transmits a URL determination request including the URL included in the URL access request message to the external device based on the request, acquires a URL passage determination result as a response to the request, When the passage determination result is inaccessible, the start of the TCP termination process is instructed. When the URL passage determination result is accessible, the transmission permission of the packet held in the TCP layer processing step is notified. A URL passage determination step,
A TCP termination process step of performing a TCP termination process for terminating a session when an instruction to start a TCP termination process is given, and outputting a packet generated by the TCP termination process to the packet transfer means;
A transmission permission packet output step of outputting a packet notified of transmission permission to the packet transfer means;
The packet transfer means transmits a packet output by execution of the TCP layer processing step and a packet output by execution of the TCP termination processing step to a transmission destination of each packet;
URL filtering method characterized by including these.

Images