JP6721542B2 - Traffic control device, method, and program - Google Patents

Description

The present invention relates to a traffic control technique for identifying a non-genuine packet and discarding it by analyzing a received packet received from communication traffic.

In a current IP (Internet Protocol) network, an IP network relay device such as a switch or a router between a server and an end user terminal or between servers analyzes a communication packet to perform efficient packet transfer. .. FIG. 11 is a configuration example of a general communication carrier network. As shown in FIG. 11, the end user terminal authenticated by the communication carrier communicates with the transfer device of the communication carrier via the user home device to use the desired service. The telecommunications carrier provides a global Internet connection service by authenticating the user within its own network, performing appropriate traffic control, and interconnecting with other carriers via a network terminating device.

In such a telecommunications carrier network, it is widely known that communication is regulated when communication is concentrated due to a disaster or the like, and congestion occurs in which services cannot be used. On the other hand, the factors that put pressure on the communication band are not only disasters, but also a large proportion of frequently generated data generated by users with unintended intentions, and frequent changes in service contract status, causing a certain proportion of undesired traffic to operators. Such traffic may flow and is referred to as an unauthorized packet. Non-genuine packets not only hinder the efficient network operation of businesses, but also impair the convenience of users, so reduction of non-genuine packets is desired.

SDNet (Software Defined Specification Environment for Networking), http://japan.xilinx.com/support/documentation/backgrounders/j_sdnet-backgrounder.pdf S. Dharmapurikar, et al., "Deep Packet Inspection Using Parallel Bloom Filters", IEEE micro, January/February (vol.24 2004), Issue No.01, p.52-61

However, such a conventional technology is an element technology that is effective only in a limited situation such as an emergency situation such as a disaster, a specific protocol, a part of a packet, or the like. There was a problem that it was difficult.

To reduce the amount of non-genuine packets without depending on a specific protocol, especially for packet analysis, in consideration of a large amount and frequency of data generated by users with unauthorized intentions and repeated changes in service contract status. Technology is an essential technology for operators to continue supporting a safe and secure infrastructure by detecting and blocking abnormal traffic and stabilizing it to reduce security risks.

Conventionally, a packet classification technique has been known as one of methods for analyzing such packets. In packet classification, necessary information can be extracted routinely according to the protocol by analyzing the header part of the packet. Typically, it is mounted on a switch chip, a network processor, or the like, but as shown in Non-Patent Document 1, there is a packet processor that can also be mounted on a programmable device represented by FPGA.

However, these packet classification techniques alone cannot always reduce the number of irregular packets. This is because it is difficult to specify whether the information for specifying exists in the header part or the data part of the packet if the prior knowledge is not sufficient.

On the other hand, a DPI (Deep Packet Inspection) technique is known as another method of analyzing a packet. The DPI collates a pattern designated in advance as a classification condition with a specific bit string at an arbitrary position in the user data portion of the received packet, and determines whether or not they match to identify the target application. Conventionally, as a method for analyzing a data portion of a packet, a plurality of matching filters are configured in parallel according to the data length of the packet, as shown in Non-Patent Document 2, and a traffic pattern is determined at high speed by hardware. A method has been proposed.

However, such a method of constructing a filter according to the data length to be checked is inefficient and causes a problem of mounting cost. Moreover, although a specific bit string at an arbitrary position can be analyzed, it is unsuitable for application to a fixed process such as a packet header whose specifications are fixed. Therefore, it is difficult to obtain the expected effect of reducing irregular packets by using any of the above-mentioned techniques.

In addition, the function of communication service, which has conventionally been configured by a dedicated device, has recently begun to be replaced by the process of virtualized communication function, which is mainly software processing using general-purpose hardware. Therefore, the traffic control device may perform traffic control in cooperation with a higher-level processing device whose communication function used for communication with itself is virtualized. Therefore, it is difficult for the conventional technique to properly process the irregular packet in consideration of such a change in the communication environment.

The present invention is for solving such a problem. Even in the case of traffic in which discard conditions are complicated and it is difficult to specify the non-regular packet, the non-regular packet is considered in consideration of the processing of the virtualized communication function. The objective is to provide a traffic control technology that can appropriately reduce and reduce traffic.

In order to achieve such an object, a traffic control device according to the present invention is a traffic control device that identifies a non-genuine packet by analyzing a received packet received from communication traffic and discards it. From the header analysis specification and the discard condition, a condition setting unit that identifies the analysis range corresponding to the discard condition, and the discard condition that is specified that the analysis range is within the header are registered in the discard table, and the received packet A header analysis unit that compares the received packet whose header is analyzed to determine that the analysis range is within the header, and the discard packet that is identified as having the analysis range outside the header. A condition is registered in the discard filter, and the received packet determined to have the analysis range outside the header is obtained by the data analysis unit that matches the discard condition of the discard filter, the header analysis unit and the data analysis unit. A discard control unit for discarding the packet related to the non-genuine packet based on the collated result obtained, and the discard control unit manages both the discard table of the header analysis unit and the discard filter of the data analysis unit. A discard condition management unit, a regular/non-normal determination unit that determines whether the received packet is a regular packet or an irregular packet based on the collation results obtained by the header analysis unit and the data analysis unit, and When the received packet is a regular packet, the received packet is transferred to an externally connected host processor, and when the received packet is a non-regular packet, a response packet including a response signal according to the packet sender is generated. And a priority output control unit that changes the output priorities of the packet returned by the higher-level processing device and the response packet and transmits the packets.

Further, a traffic control method according to the present invention is a traffic control method of identifying a non-genuine packet by analyzing a received packet received from communication traffic and discarding it, wherein a condition setting unit specifies a specified header analysis specification. And a discarding condition, a condition setting step of identifying an analysis range corresponding to the discarding condition, and a header analysis unit registers the discarding condition identified as being within the header of the analysis range in a discarding table, and receiving the reception A header analysis step of collating the received packet, which is determined by analyzing the header of the packet with the analysis range being within the header, with a discard condition of the discard table, and a data analysis unit, wherein the analysis range is outside the header. A data analysis step of registering the discard condition specified as being present in a discard filter, and collating the received packet determined to have the analysis range outside the header with the discard condition of the discard filter, and a discard control unit. A discarding control step of discarding a packet relating to the non-regular packet based on the matching result obtained by the header analyzing section and the data analyzing section, wherein the discarding controlling step includes a discarding table of the header analyzing section and Whether the received packet is a regular packet or a non-regular packet, based on the discard condition management step of managing both discard filters of the data analysis unit and the collation result obtained in the header analysis step and the data analysis step. Regular/non-regular determination step for determining whether the received packet is a regular packet, the received packet is transferred to an externally connected host processor, and the received packet is a non-normal packet, packet transmission is performed. A distribution control step of generating a response packet in which a response signal corresponding to the original is added to the irregular packet, and priority output control of changing the output priority of the packet returned by the higher-level processing device and the response packet and transmitting the packet. Steps and.

Further, the program according to the present invention is a program for causing a computer to function as each unit constituting the traffic control device described above.

According to the present invention, even in a case where it is difficult to specify an irregular packet due to a complicated discarding condition, the irregular packet can be specified more accurately, and the detection rate of the irregular packet is improved. Even in the case of operating in cooperation with an externally connected upper processing device, the output priority of packets of the upper processing device and the device of the present invention is taken into consideration in consideration of the processing of the virtualized communication function in the upper processing device. You can change the output and output. As a result, unnecessary traffic can be appropriately discarded from the telecommunications carrier network and reduced, and as a result, it is possible to realize efficient network operation of the telecommunications carrier and also to ensure user convenience. Become.

It is a block diagram which shows the structure of a traffic control apparatus. It is a structural example of a condition setting part. It is an example of composition of a header analysis part. It is a structural example of a discard table. This is a packet format used in RADIUS. It is a list of Attributes in RADIUS. It is an example of composition of a data analysis part. It is an example of composition of a disposal filter. It is an example of composition of a discard control part. It is a sequence diagram which shows operation|movement of a traffic control apparatus. It is an example of composition of a general carrier network.

Next, an embodiment of the present invention will be described with reference to the drawings.
[Traffic control device]
First, a traffic control device 10 according to a first exemplary embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of the traffic control device.

The traffic control device 10 is a device that is arranged on a communication carrier network, identifies an unauthorized packet that matches a predetermined discard condition from communication traffic flowing on the network, and discards the corresponding packet. ..
The higher-level processing device 30 is an external device that is externally connected to the traffic control device 10, operates in cooperation with the traffic control device 10, and has a virtualized communication function used for communication with the traffic control device 10. ..

As shown in FIG. 1, the traffic control device 10 has a packet transmission/reception unit 11, a condition setting unit 12, a header analysis unit 13, a data analysis unit 14, a discard control unit 15, a discard table 21, and a main function unit. A discard filter 22 is provided.

The packet transmitting/receiving unit 11 has a function of receiving a packet from communication traffic including an unauthorized packet flowing on the communication carrier network.
The condition setting unit 12 has a function of specifying the analysis range corresponding to the discard condition from the specified header analysis specification and discard condition.

The header analysis unit 13 analyzes the header of the received packet received by the packet transmission/reception unit 11 and the function of registering the discard condition specified by the condition setting unit 12 in the header to the discard condition. , And has a function of collating the received packet whose analysis range is determined to be within the header with the discard condition registered in the discard table 21.

The data analysis unit 14 has a function of registering in the discard filter 22 a discard condition in which the analysis range specified by the condition setting unit 12 is outside the header, and a received packet in which the analysis range is determined to be outside the header. , And has a function of collating with the discard condition registered in the discard filter 22.
The discard control unit 15 has a function of discarding the packet related to the non-genuine packet based on the matching result obtained by the header analysis unit 13 and the data analysis unit 14.

The feature of the present invention is that the packet analysis for identifying and discarding the non-genuine packet is divided into a header portion and a data portion based on the analysis range of each discard condition, and the discard table 21 and the discard filter 22 are used respectively. It is designed to constitute a hierarchical disposal condition. In addition to this, considering the processing of the virtualized communication function, the response packet generated by adding the response signal to the non-genuine packet to be discarded is transmitted with the priority changed to the transmission source client. It was done like this.

In the background art described above, a specific example will be shown with respect to diversification of factors that cause the occurrence of irregular packets. In the past, a large amount of communication request retries under call control at the time of disaster was the main cause of non-genuine packets. However, for example, conditions such as the sender's IP address and port, user ID, and password are not intended by the user. May or may not always change. In addition, information such as a password is more difficult to analyze and control due to encryption. The condition of communication that is a prerequisite for determining such a non-genuine packet is not always included in the header for controlling the packet, and it is not known from which part of the user data the determination should be made. Conditions such as and contents change every moment.

As described above, in order to enable the identification of the non-genuine packet even under various conditions, the present invention narrows down the analysis range by giving not only the discard condition specified by the user but also the header analysis specification as an input. .. The specifications of the header analysis typically conform to the protocol specifications specified in standard documents such as RFC. A well-known technique can be used as a method of defining the specifications. For example, the specifications may be described by the method shown in Non-Patent Document 1.

FIG. 2 is a configuration example of the condition setting unit. The condition setting unit 12 includes an analysis specification input unit 12A for the network administrator to input the header analysis specification of the received packet, a discard condition input unit 12B for the user to input the discard condition of the irregular packet, and a header analysis specification. A specification conformity determination unit 12C that determines whether or not the analysis range of the discard condition is within the header is provided. Thereby, it becomes possible to hierarchically configure the discard conditions in the discard table 21 and the discard filter 22. Whether or not the analysis range of the condition of the irregular packet is the header can be clarified by inputting the specification. Therefore, if the discard condition can be specified by the header range, the packet of the irregular packet is searched by searching the discard table 21 and collating. Can be discarded.

FIG. 3 is a configuration example of the header analysis unit. The header analysis unit 13 includes a discard table registration unit 13A that registers the discard condition set by the condition setting unit 12 in the discard table 21, and a header of the received packet received by the packet transmission/reception unit 11 based on the header analysis specification. The received header analysis unit 13B for analysis, the specification conformity determination unit 13C for determining whether the analysis range of the received packet is inside or outside the header based on the header analysis specifications, and the analysis range for the header is determined by the specification conformity determination unit 13C. A discard table search unit 13D that matches the received packet determined to be with the discard condition searched from the discard table 21 is provided.

FIG. 4 is a configuration example of the discard table. Here, the discard condition is registered for each condition number unique to each discard condition. When the user specifies the discard condition for discarding the non-genuine packet in the condition setting unit 12, the discard table registration unit 13A of the header analysis unit 13 registers the discard condition in the discard table 21 as a new entry. It For example, condition 1: discard the packet whose "source IP address" is "xxx.xxx.xxx.xxx", condition 2: discard the packet whose "source port number" is "yyy",..., condition N: " It is possible to set the discard condition of the non-genuine packet according to the request of the network administrator, such as discarding the packet having the “user ID” of “zzz”.

Next, as an example of communication data to be controlled by the traffic control device 10 of the present invention, an embodiment in which the discard table 21 is set based on user information such as a user ID will be described.
When using the telecommunications carrier network, the user first receives user authentication on the telecommunications carrier network. User authentication is typically performed by a client/server method using RADIUS disclosed in RFC 2138. FIG. 5 shows a packet format used in RADIUS. In this packet format, the user ID itself can be checked by analyzing Attributes (RADIUS attribute).

FIG. 6 is a list of Attributes in RADIUS. Attribute is standardized in so-called TLV format of Type, Length, Value, and the network administrator may specify User-Name Attribute shown in FIG. 6 according to the format. Further, in order to determine whether the user is a legitimate user who has been properly authenticated by the password associated with the user ID, the Authenticator in FIG. 5 may be designated.

According to the present invention, the analysis specification input unit 12A of the condition setting unit 12 is provided with a specification for enabling such specification, so that the header analysis unit 13 of the present invention can be operated according to the request of the network administrator. A series of processes can be performed.

On the other hand, there are cases in which the specifications related to such packet formats are not given by the network administrator, or there are cases where it is necessary to determine that the packet is an unauthorized packet and discard it based on information that is not specified in the specification in the first place. To be In this case, since the discard condition to be specified does not exist in the header and is embedded somewhere in the user data, it is difficult for the header analysis unit 13 alone to identify the non-genuine packet. ..

Therefore, in the present invention, a series of processing units provided in the data analysis unit 14 provides an analysis method that is effective for an irregular packet that is difficult to specify in the header analysis unit 13.

FIG. 7 is a configuration example of the data analysis unit. In this data analysis unit 14, a discard signature calculation unit 14A that obtains a discard signature that is a hash value related to the discard condition designated by the condition setting unit 12, and a discard filter registration unit 14B that registers the obtained discard signature in the discard filter 22. Of the user data stored in the received packet whose analysis range is determined to be outside the header by the header analysis unit 13, a data signature that is a hash value for a bit string of a predetermined arbitrary position and arbitrary length. And a discard filter matching unit 14D that matches the obtained data signature with the discard signature registered in the discard filter 22.

Since many parts of the data analysis unit 14 can be implemented by applying the DPI technology shown in Non-Patent Document 2, the details will be omitted and the difference in configuration from Non-Patent Document 2 will be described.
FIG. 8 is a configuration example of the discard filter. In order to identify the target bit string as an irregular packet in the analysis of the user data portion of the received packet, it is necessary to calculate a signature that is a hash value from the pattern to be detected in advance and register it in the discard filter 22.

The number of signatures that can be registered varies depending on the installed program, device, and system, but when the number of signatures n and the memory bit width m of the hash table in memory are determined, the false positive probability p is minimized. The hash operation number k that can be realized is formulated and is widely known. Although the details are omitted in Non-Patent Document 2, the relational expression between the number of hash operations k, the number of signatures n, and the memory bit width m is expressed by the following equation (1). p is represented by the following formula (2).

By using the discard filter 22 as described above, the false positive probability p is allowed at a certain level, and thus the hash operation number k can be determined while increasing the efficiency m/n of the storage space.
In the method of Non-Patent Document 2, there is a method in which a plurality of matching filters BF(w) are configured in parallel according to the data length of the user data portion of the packet to be analyzed, and the traffic pattern discrimination is processed at high speed by hardware. Although proposed, the number of filters BF(w) increases as the data length increases, which causes a problem of increasing required hardware resources.

According to the present invention, in the previous stage of the data analysis unit 14, the packet that can be identified as the non-genuine packet by the header analysis unit 13 does not need to be analyzed by the data analysis unit 14 again, so that the hardware resources are required to be the minimum required. It is possible to configure the data analysis unit 14 while suppressing the limit. The discard signature of the data analysis unit 14 configured as described above is collated with the data signature calculated from the bit string at the arbitrary position included in the user data portion of the received packet to determine the presence/absence of an irregular packet.

Although most of the data analysis unit 14 can be implemented by applying the DPI technique shown in Non-Patent Document 2, the header analysis unit 13 and the data analysis unit 14, which are characteristic configurations of the present invention, are not included. Since the discard control configured hierarchically functions, it is possible to share and execute the specification conformity determination of the header part and the data part. Therefore, it is only after the present configuration is disclosed that the non-regular packet of the data analysis part 14 is identified. In addition, Non-Patent Document 2 can be utilized. Therefore, even if a person skilled in the art having ordinary knowledge related to Non-Patent Document 2 tries to identify the non-Regular packet by using the technique shown in Non-Patent Document 2, the non-Regular packet like the present invention is used. It is difficult to show the effectiveness of the reduction.

FIG. 9 is a configuration example of the discard control unit. The discard control unit 15 relates to the non-regular packet based on the discard condition management unit 15A that manages both the discard table 21 and the discard filter 22, and the collation results obtained by the header analysis unit 13 and the data analysis unit 14. The packet discard unit 15B discards the received packet.
At this time, in the packet discard unit 15B, the received packet received from the packet transmission/reception unit 11, the header analysis unit 13, or the data analysis unit 14 may be discarded or the transfer output to the subsequent stage may be processed. The packet transmitter/receiver 11 may process the discard or the transfer output to the subsequent stage by instructing the discard necessity.

Specifically, the packet discard unit 15B includes a regular/non-regular determination unit 15C, a distribution control unit 15D, and a priority output control unit 15E.
The regular/non-regular determination unit 15C has a function of determining whether the packet is a regular packet or an irregular packet, based on the matching results obtained by the header analysis unit 13 and the data analysis unit 14.

When the determination result is a regular packet, the distribution control unit 15D transfers the packet to the higher-level processing device 30 via the packet transmitting/receiving unit 11, and when the determination result is an irregular packet, the distribution control unit 15D responds to the packet source. In addition, the transmission source client has a function of generating a response packet to which a response signal for the normal reception of the packet is added to the irregular packet.
By transmitting such a response packet to the transmission source client, it can be expected that retransmission of an unauthorized packet by the transmission source client is suppressed. The response signal is different depending on the content to be transmitted/received, but is generally a signal for rewriting/adding/deleting a part of the header portion which is control information.

The priority output control unit 15E has a function of changing the output priorities of the packet returned by the higher-level processing device 30 and the response packet and transmitting the packets. The packet returned by the higher-level processing device 30 means that the packet received by the higher-level processing device 30 is subjected to processing such as addition/change/deletion of a header part or a data part, and then returned to the same communication partner. It is a packet to do. This makes it possible to control which of the packet transmitted by the higher-level processing device 30 to the packet source and the response packet generated by the distribution control unit 15D is preferentially output. The return legitimate traffic from the upper processing device 30 may be preferentially output, or the traffic determined by the distribution control unit 15D to be an irregular packet may be preferentially output. Which is to be preferentially output depends on the state of the client side, but the configuration of the present invention makes it possible to appropriately discard unnecessary traffic from the carrier network and reduce it.

[Operation of this Embodiment]
Next, the operation of the traffic control device 10 according to the present embodiment will be described with reference to FIG. FIG. 10 is a sequence diagram showing the operation of the traffic control device.

Prior to executing the process of monitoring the received packet received from the communication traffic and discarding the non-genuine packet, the discard condition is registered in the discard table 21 and the discard filter 22.
First, in the condition setting unit 12, the analysis specification input unit 12A inputs the header analysis specification of the received packet in accordance with the instruction from the network administrator (step 100), and the discard condition input unit 12B instructs the user. In response, the discard condition for the non-genuine packet is input (step 101). In response to this, the specification conformity determination unit 12C determines whether or not the analysis range of the discard condition is within the header based on the header analysis specification (step 102).

Here, when the analysis range is not within the header (step 102: NO), the discard signature calculation unit 14A of the data analysis unit 14 obtains a discard signature that is a hash value related to the discard condition designated by the condition setting unit 12 ( In step 103), the discard filter registration unit 14B of the data analysis unit 14 registers the obtained discard signature in the discard filter 22 (step 104).

On the other hand, when the analysis range is within the header (step 102: YES), the discard table registration unit 13A of the header analysis unit 13 registers the discard condition specified by the condition setting unit 12 in the discard table 21 (step 105). ..
Thereafter, the discard condition management unit 15A of the discard control unit 15 manages both the discard table 21 and the discard filter 22. Specifically, in both the discard table 21 and the discard filter 22, registration/change/deletion of the entry to be discarded is performed (step 106).
As a result, a hierarchical discard condition using the discard table 21 and the discard filter 22 is constructed.

After that, each time a packet is received, the following non-genuine packets are discarded for the received packet.
First, when the packet transmission/reception unit 11 receives a packet from communication traffic including an unauthorized packet flowing on the communication carrier network (step 110), the reception header analysis unit 13B of the header analysis unit 13 determines that the received packet The header is analyzed based on the header analysis specification (step 111).

Then, the specification conformity determination unit 13C of the header analysis unit 13 determines whether the analysis range is within the header based on the header analysis specifications (step 112).
Here, when the analysis range is not within the header (step 112: NO), the data signature calculation unit 14C of the data analysis unit 14 stores the user data stored in the received packet in which the analysis range is determined to be outside the header. Among them, a data signature that is a hash value regarding a bit string of a predetermined position and length is obtained (step 113), and the discard filter matching unit 14D determines the obtained data signature with the discard signature registered in the discard filter 22. Collation is performed (step 114).

On the other hand, when the analysis range is within the header (step 112: YES), the discard table search unit 13D of the header analysis unit 13 searches the discard table 21 for the received packet whose analysis range is determined to be within the header. It collates with the disposal conditions (step 115).
After that, the packet discard unit 15B of the discard control unit 15 discards the packet related to the non-regular packet based on the collation result obtained by the header analysis unit 13 and the data analysis unit 14 (steps 116 to 118).

Specifically, the regular/non-normal determination unit 15C determines whether the packet is a regular packet or a non-normal packet based on the matching results obtained by the header analysis unit 13 and the data analysis unit 14 (step 116). ).
If the determination result is a regular packet, the distribution control unit 15D transfers the packet to the higher-level processing device 30 via the packet transmitting/receiving unit 11, and if the determination result is an irregular packet, according to the packet source, A response packet is generated by adding a response signal for the transmission source client to receive the packet normally to the irregular packet (step 117).

By transmitting such a response packet to the transmission source client, it can be expected that retransmission of an unauthorized packet by the transmission source client is suppressed. The response signal is different depending on the content to be transmitted/received, but is generally a signal for rewriting/adding/deleting a part of the header portion which is control information.
The priority output control unit 15E changes the output priority of the packet returned by the higher-level processing device 30 and the response packet and transmits the packet (step 118).

[Effects of this Embodiment]
As described above, in the present embodiment, the condition setting unit 12 specifies the analysis range corresponding to the discard condition from the designated header analysis specification and discard condition, and the header analysis unit 13 determines that the analysis range is within the header. The discard condition is registered in the discard table 21, the received packet whose analysis range is determined to be within the header is compared with the discard condition of the discard table 21, and the data analysis unit 14 determines that the analysis range is outside the header. Is registered in the discard filter 22, the received packet whose analysis range is determined to be outside the header is compared with the discard condition of the discard filter 22, and the discard control unit 15 obtains the header analysis unit 13 and the data analysis unit 14. The packet related to the non-genuine packet is discarded based on the matching result.

At this time, in the discard control unit 15, the discard condition management unit 15A manages both the discard table of the header analysis unit 13 and the discard filter of the data analysis unit 14, and the regular/non-regular determination unit 15C causes the header analysis unit 13 to operate. Also, based on the collation result obtained by the data analysis unit 14, it is determined whether the received packet is a regular packet or a non-regular packet, and when the received packet is a regular packet, the distribution control unit 15D determines the packet transmission/reception unit. When the received packet is transferred to the higher-level processing device 30 via 11 and the received packet is an irregular packet, a response signal corresponding to the packet source is added to the irregular packet to generate a response packet, and the priority output control unit 15E is the one in which the output priority of the packet returned by the upper processing device 30 and the response packet are changed and transmitted.

As a result, among the designated discarding conditions, the discarding condition whose analysis range is within the header is registered in the discarding table 21, and the discarding condition whose analysis range is outside the header is registered in the discarding filter 22. Disposal conditions will be configured. Therefore, it is possible to hierarchically analyze both the header and the user data of the received packet received from the communication traffic and perform discard control.

Therefore, even in the case where the conditions for discarding are complicated and it is difficult to specify the irregular packet, the irregular packet can be specified more accurately, and the detection rate of the irregular packet is improved. Even in the case of operating in cooperation with the externally connected upper processing device 30, the packets of the upper processing device 30 and the traffic control device 10 should be considered in consideration of the processing of the virtualized communication function in the upper processing device 30. The output priority of can be changed and output can be performed. As a result, unnecessary traffic can be appropriately discarded from the telecommunications carrier network and reduced, and as a result, it is possible to realize efficient network operation of the telecommunications carrier and also to ensure user convenience. Become.

The embodiments of the present invention have been shown and described above. In the description of the embodiments, what is described as "-unit" may be "-circuit", "-device", "-device", or "-step", "-means", "-device". ~treatment". In addition, what is described as “-unit” in the present embodiment may be realized by firmware stored in the ROM and hardware such as reconfigurable devices, elements, substrates, and wirings. Alternatively, it may be implemented by a combination of software and hardware, and further by a combination of firmware. The firmware and software are stored as a program in a recording medium such as a magnetic disk, flexible disk, optical disk, compact disk, mini disk, or DVD. The program is read and executed by the CPU. That is, the program causes the computer to function as the "-means" of the embodiment of the present invention. Alternatively, it causes a computer to execute the procedure or method of "- unit" of the embodiment.

[Expansion of Embodiment]
Although the present invention has been described with reference to the exemplary embodiments, the present invention is not limited to the above exemplary embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In addition, the respective embodiments can be implemented in any combination as long as they do not conflict.

10... Traffic control device, 11... Packet transmission/reception unit, 12... Condition setting unit, 12A... Analysis specification input unit, 12B... Discard condition input unit, 12C... Specification matching determination unit, 13... Header analysis unit, 13A... Discard table registration Part, 13B... Received header analysis part, 13C... Specification conformity determination part, 13D... Discard table search part, 14... Data analysis part, 14A... Discard signature calculation part, 14B... Discard filter registration part, 14C... Data signature calculation part, 14D... Discard filter matching unit, 15... Discard control unit, 15A... Discard condition management unit, 15B... Packet discard unit, 15C... Regular/non-regular determination unit, 15D... Sorting control unit, 15E... Priority output control unit, 21 ... discard table, 22... discard filter, 30... upper processing device.

Claims (3)

A traffic control device for identifying and discarding an unauthorized packet by analyzing a received packet received from communication traffic,
From the specified header analysis specifications and discard conditions, a condition setting unit that specifies an analysis range corresponding to the discard conditions,
The discard condition specified by the analysis range being within the header is registered in a discard table, the header of the received packet is analyzed, and the received packet determined to be within the analysis range is discarded. Header analysis unit that matches the discard condition of the table,
Data analysis that registers the discard condition specified as the analysis range being outside the header in a discard filter, and matches the received packet determined that the analysis range is outside the header with the discard condition of the discard filter Department,
A discard control unit that discards a packet related to the non-genuine packet based on the matching result obtained by the header analysis unit and the data analysis unit,
The discard control unit,
A discard condition management unit that manages both the discard table of the header analysis unit and the discard filter of the data analysis unit;
A regular/non-normal determination unit that determines whether the received packet is a regular packet or a non-normal packet based on the matching result obtained by the header analysis unit and the data analysis unit;
When the received packet is a regular packet, the received packet is transferred to an externally connected upper processing device, and when the received packet is a non-normal packet, a response signal corresponding to a packet source is transmitted to the non-normal packet. A distribution control unit that generates a response packet added to
A traffic control device comprising: a priority output control unit that changes the output priority of a packet returned by the higher-level processing device and the response packet and transmits the packet. A traffic control method for identifying and discarding an unauthorized packet by analyzing a received packet received from communication traffic,
A condition setting unit, a condition setting step of specifying an analysis range corresponding to the discard condition from the specified header analysis specification and discard condition;
The header analysis unit registers the discard condition specified that the analysis range is within the header in a discard table, analyzes the header of the received packet, and determines that the analysis range is within the header. A header analysis step of matching the packet with a discard condition of the discard table;
A data analysis unit registers the discard condition specified as the analysis range being outside the header in a discard filter, and the received packet determined to have the analysis range outside the header is discarded as the discard condition for the discard filter. A data analysis step that matches
A discard control unit, which includes a discard control step of discarding a packet related to the non-genuine packet based on the matching result obtained in the header analysis step and the data analysis step,
The discard control step,
A discard condition management step of managing both the discard table of the header analysis unit and the discard filter of the data analysis unit;
A regular/non-normal determination step of determining whether the received packet is a regular packet or a non-normal packet based on the collation result obtained in the header analysis step and the data analysis step ,
When the received packet is a regular packet, the received packet is transferred to an externally connected upper processing device, and when the received packet is a non-normal packet, a response signal corresponding to a packet source is transmitted to the non-normal packet. A distribution control step of generating a response packet added to
A traffic control method comprising: a priority output control step of changing output priorities of a packet returned by the upper processing device and the response packet and transmitting the packets. A program for causing a computer to function as each unit that constitutes the traffic control device according to claim 1.

Images