JPH10133977A - Packet filtering device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform a flexible packet filtering process corresponding to the actual situation by allowing packets to be transferred when filtering conditions set by an application program are met. SOLUTION: When a decision means 15 does not decide that filtering conditions set by an environment setting program 10 are not met, a judging means 14 reads out the filtering conditions set by the application program 11 and stored in a storage means 13 and judges whether or not an issued request to transfer packets meets the read filtering conditions. On receiving the judgement result, a dynamic allowing means 17 allows the transfer of packets requested to be transferred irrelevantly to the decision result of the decision means 15 when the judging means 143 judges that the filtering conditions set by the application program 11 are met. Consequently, the flexible packet filtering process corresponding to the state of the application program 11 can be performed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a packet filtering apparatus for deciding whether to permit packet transfer according to a filtering condition, and more particularly, to a packet filtering apparatus capable of executing a flexible packet filtering process according to a situation. Related to the device.

[0002] A server-client type data processing system may employ a configuration in which a client can access a server on condition that the client has a proper authority. In order to realize such security, a function of executing a packet filtering process called a firewall is used.

[0003] This firewall function determines whether or not a transfer request satisfies a filtering condition when a packet transfer request is issued, and on the condition that the filtering condition is satisfied. By adopting a configuration permitting the transfer of the packet, the packet filtering process is executed.

[0004] In order to make this firewall function practical, it is necessary to construct a configuration that can execute a flexible packet filtering process according to the situation.

[0005]

2. Description of the Related Art In a conventional firewall function, an environment setting program which is started when a system is started up sets a filtering condition which is a condition for a packet filtering process when the system is started up. It is configured to execute.

That is, the conventional firewall function employs a configuration in which a filtering condition is set at the time of system startup, and when a transfer request of a packet to an application program or the like is issued, the transfer request is issued in this manner. By determining whether or not the filtering condition set in the above is satisfied, it is determined whether or not to transfer the packet to an application program or the like.

[0007]

However, if the configuration program adopts a configuration for setting the filtering conditions as in the prior art, it is not possible to execute an appropriate packet filtering process according to the status of the application program. There was a point.

That is, since the environment setting program is started when the system is started, according to the prior art, the filtering conditions are set at the time of starting the system, and therefore, the filtering conditions are fixed. As a result, there is a problem that it is not possible to execute an appropriate packet filtering process according to the situation of the application program.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and has a configuration for deciding whether or not to permit packet transfer in accordance with a filtering condition. The purpose of the present invention is to provide a new packet filtering device capable of executing the packet filtering.

[0010]

FIG. 1 shows the principle configuration of the present invention. In the figure, reference numeral 1 denotes a packet filtering device having the present invention, which determines whether or not to permit transfer of a packet when a packet transfer request is issued.

[0011] Packet filtering device 1 of the present invention
Is an environment setting program 10, an application program 11, a filtering unit 12, and a storage unit 1.
3 and judgment means 14.

The filtering means 12 determines whether or not the packet transfer request issued satisfies the filtering conditions set by the environment setting program 10. A control unit 16 for controlling whether to transfer or discard a packet with a transfer request, and a dynamic permission unit 17 for permitting the transfer of a packet with a transfer request without depending on the determination result of the determination unit 15. .

The storage means 13 stores filtering conditions issued by the application program 11. The determination unit 14 determines whether the issued packet transfer request satisfies the filtering conditions stored in the storage unit 13.

In the packet filtering apparatus 1 of the present invention configured as described above, when a transfer request of a packet is issued, the determination means 15 of the filtering means 12 determines whether the transfer request is a filtering condition set by the environment setting program 10. It is determined whether or not the condition is satisfied. Upon receiving the determination result, the control unit 1 of the filtering unit 12 determines
Step 6 permits the transfer of a packet having a transfer request on condition that the determination unit 15 determines that the filtering condition is satisfied.

When this processing configuration is adopted, the judgment means 14
Reads the filtering condition set by the application program 11 stored in the storage unit 13 when the judging unit 15 does not judge that the filtering condition set by the environment setting program 10 is satisfied. It is determined whether or not the read filtering condition is satisfied. In response to the result of the determination, the dynamic permission unit 17 determines when the determining unit 14 determines that the filtering condition set by the application program 11 is satisfied. Regardless of the determination result of the determination means 15, the transfer of the packet having the transfer request is permitted.

As described above, the packet filtering apparatus 1 of the present invention employs a configuration for determining whether or not to permit packet transfer according to the filtering conditions set by the environment setting program 10. A configuration is adopted in which the setting of the filtering condition by the application program 11 is permitted, and the transfer of the packet is permitted when the filtering condition set by the application program 11 is satisfied even when the filtering condition set by the environment setting program 10 is not satisfied. Therefore, a flexible packet filtering process according to the situation of the application program 11 can be executed.

[0017]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail according to embodiments. FIG. 2 shows an embodiment of a data processing system to which the present invention is applied.

The data processing system shown in FIG. 1 is connected to one or more clients 21 connected to a network 20a, one or more servers 22 connected to a network 20b, and to networks 20a and 20b. It is composed of a security server 23.

The security server 23 receives a packet transmitted by the client 21 and controls whether or not to transfer the received packet to another client 21 / server 22 requested by the client 21 to thereby obtain data. It executes processing security, and includes a firewall environment setting program 230,
Static condition memory area 231, authentication application program 232, dynamic filtering condition setting API2
33, a dynamic condition memory area 234, a filtering control program 235, and a dynamic filtering control program 236.

FIG. 3 shows a processing flow executed by the firewall environment setting program 230. FIG. 4 shows a processing flow executed by the authentication application program 232.
FIG. 5 illustrates a processing flow executed by the filtering control program 235, and FIG. 6 illustrates a processing flow executed by the dynamic filtering control program 236.

Next, the operation processing of this embodiment will be described in detail according to these processing flows. When the firewall environment setting program 230 is started with the start-up of the system, as shown in the processing flow of FIG. 3, the firewall environment setting program 230 sets a filtering condition serving as a condition for determining whether or not to permit packet transfer. , Is stored in the static condition memory area 231.

This filtering condition is set to realize the security required at the time of performing data processing, and indicates, for example, which server 22 is permitted as an access destination of each client 21. Will be.

On the other hand, the authentication application program 2
32, when an authentication request is issued from the client 21, as shown in the processing flow of FIG. 4, in response to the authentication request, dynamic filtering To set a dynamic filtering condition setting AP to be a program interface
Via I233, processing for storing it in the dynamic condition memory area 234 is performed.

This dynamic filtering condition is also set to realize the security required when performing data processing. However, unlike the filtering condition set by the firewall environment setting program 230, the dynamic filtering condition is different from the authentication application program. 232 has the property of being dynamically set when performing data processing. Thereby, for example, even for a client 21 that is not permitted to access a specific server 22, it is possible to set a dynamic filtering condition such that access to the server 22 is permitted during a specific time zone. become.

In response to the filtering condition stored in the static condition memory area 231 and the dynamic filtering condition stored in the dynamic condition memory area 234, the filtering control program 235 transmits the information from the client 21 to the server 22. When a packet to be transmitted is transferred, FIG.
As shown in the processing flow of FIG.
Then, the filtering condition stored in the static condition memory area 231 is read, and in the following step 2, it is determined whether or not the transferred packet satisfies the read filtering condition.

When it is determined in step 2 that the transferred packet satisfies the filtering condition stored in the static condition memory area 231, the transfer of the packet to the server 22 is permitted. Then, the process proceeds to step 6, where the packet is transferred to the transfer destination server 22, and the process is terminated.

On the other hand, when it is determined in step 2 that the transferred packet does not satisfy the filtering condition stored in the static condition memory area 231, the transfer of the packet to the server 22 is permitted. If not, the process proceeds to step 3 where a process for inquiring the dynamic filtering control program 236 is performed.

Upon receiving this inquiry instruction, the dynamic filtering control program 236 reads out the dynamic filtering conditions stored in the dynamic condition memory area 234 and transfers them as shown in the processing flow of FIG. It is determined whether or not the packet satisfies the read dynamic filtering condition. When it is determined that the dynamic filtering condition is satisfied, the processing result of the packet transfer permission instruction is notified to the filtering control program 235. Then, when judging the non-satisfaction, it notifies the filtering control program 235 of the processing result of the packet transfer non-permission instruction.

Then, the filtering control program 235 performs a process for inquiring of the dynamic filtering control program 236 in step 3 of the processing flow of FIG. 5, and then in step 4, the processing result is notified from the dynamic filtering control program 236. In the following step 5, it is determined whether the processing result is a processing result of a packet transfer permission instruction or a non-permission instruction processing result.

If it is determined in step 5 that the processing result notified from the dynamic filtering control program 236 indicates a packet transfer permission instruction, step 6
And forwards the transferred packet to the destination server 2
Then, the process is terminated. On the other hand, in step 5, when the processing result notified from the dynamic filtering control program 236 indicates a packet transfer non-permission instruction, the process proceeds to step 7, and the transferred packet is transferred to the transfer destination server 22. The processing is terminated without discarding.

Thus, the security server 23
Is configured such that, even when a packet having a transfer request does not satisfy the filtering condition set by the firewall environment setting program 230, the packet transfer is permitted when the dynamic filtering condition set by the authentication application program 232 is satisfied. Take. As a result, a flexible packet filtering process according to the data processing situation of the client 21 can be executed.

That is, in the prior art, as shown in FIG. 8, the environment setting program 30 adopts a configuration in which filtering conditions are set at the time of system startup, and the filtering control program 31 sends a packet to the application program 32. When the transfer request is issued, it is determined whether or not the transfer request satisfies the filtering conditions set in this manner, thereby determining whether or not to transfer the packet to the application program 32. In contrast, the present invention adopts a configuration in which the application program 32 sets a dynamic filtering condition, and adopts a configuration in which the filtering condition set in the environment setting program 30 as illustrated in FIG. Dynamic filtering control, even if When the program 33 to determine satisfaction of the dynamic filtering conditions are those employing a configuration that enables you to forward the packet to the application program 32.

[0033]

As described above, the packet filtering apparatus of the present invention employs a configuration for determining whether or not to permit packet transfer in accordance with the filtering conditions set by the environment setting program. By adopting a configuration that allows setting of filtering conditions by a program, even when the filtering conditions set by the environment setting program are not satisfied, the packet transmission is permitted when the filtering conditions set by the application program are satisfied. As a result, flexible packet filtering processing according to the status of the application program can be executed.

[Brief description of the drawings]

FIG. 1 is a principle configuration diagram of the present invention.

FIG. 2 is an embodiment of the present invention.

FIG. 3 is a processing flow executed by a firewall environment setting program.

FIG. 4 is a processing flow executed by an authentication application program.

FIG. 5 is a processing flow executed by a filtering control program.

FIG. 6 is a processing flow executed by a dynamic filtering control program.

FIG. 7 is an explanatory diagram of the present invention.

FIG. 8 is an explanatory diagram of a conventional technique.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Packet filtering apparatus 10 Environment setting program 11 Application program 12 Filtering means 13 Storage means 14 Judgment means 15 Judgment means 16 Control means 17 Dynamic permission means

Claims (1)

[Claims] When a transfer request for a packet is issued, it is determined whether or not the transfer request satisfies a filtering condition set by an environment setting program. A packet filtering device for permitting the transfer of the packet, a storage unit for storing a filtering condition issued by the application program, and a transfer request when the packet transfer request does not satisfy the filtering condition set by the environment setting program. Determining whether or not the filtering condition stored in the storage unit is satisfied; and a dynamic permission unit for permitting packet transfer when the determining unit determines that the filtering condition is satisfied. A packet filtering device comprising: