JPH10271154A - Illegal access prevention method and system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To exclude an illegal packet by means of filtering utilizing an existing area of a packet without adding an area to a packet data form. SOLUTION: An IP header check section 11 of a gateway 1 passes only a legal communication packet based on TT (Time To Live: in-network duration time) information and IP address information included in an IP header. A TTL filtering section 21 of the IP header check section 11 passes only a communication packet having valid TTL information in the IP header. A validity check section 21a checks the validity under the condition that the value of the TTL at packet passing is within a range from a predetermined initial value in a group in advance to a (initial value-maximum passing gateway number). The filtering processing section 21b gives a communication packet whose TTL information does not satisfy a prescribed condition to a packet abort processing section 12.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to the prevention of unauthorized access in routers and gateways for constructing a communication network system, and more particularly to TCP / IP (Transmission Control Protocol) as a communication protocol.
/ Internet Protocol) relates to an unauthorized access prevention system suitable for a communication network system using a transfer control protocol / internet protocol.

[0002]

2. Description of the Related Art Communication network systems such as LA
An N (Local Area Network) system is constructed by connecting a plurality of branch LANs via at least one of a router and a gateway. In such communication network systems, TCP / IP is often used as a communication protocol.

[0003] By the way, on a physically connected network, logical grouping may be performed as necessary. In such a case, there is a case where communication within a logical group is mainly performed, and communication with another group is not required or desired to be eliminated.

[0004] In such a case, the router M and the gateway connecting the branch LAN are used to transmit the packet M.
AC (Media Access Control)
Address or IP (Internet Protocol) address is identified, and packets such as broadcast packets, abnormal packets, or packets that attempt to illegally access terminals of other groups are prevented from passing packets of other groups. It has been practiced to prevent inflow and outflow of unauthorized access packets.

As described above, a function of identifying a MAC address or an IP address of a packet so as not to pass a packet of another group is performed by a MAC address filtering function of filtering by a MAC address or an IP of filtering by an IP address.
This is called an address filtering function.

That is, filtering by MAC address or IP address is performed as follows. A MAC address or an IP address that allows passage is registered in the router or the gateway in advance.
The router or gateway determines the M
MA registered with AC address or IP address
Check with C address or IP address to find correct M
Only the packet of the AC address or the IP address is passed. In this way, the passage of unauthorized access packets is prevented by the router or gateway.

[0007] In many cases, the MAC address is physically set in a terminal device (hereinafter, simply referred to as a "terminal") and cannot be easily changed in many cases. However, since there is a broadcast address in the MAC layer address for allowing the broadcast packet to pass through all networks, it is confused with the broadcast packet. In order to prevent this, the I of the network layer higher than the MAC layer
IP address filtering that filters by P address is used.

[0008] However, the IP address is TCP /
Since it is necessary for the IP protocol and is logically set in the device, it can be changed relatively easily. Therefore, a terminal outside the group incorrectly sets the IP address of a terminal within the group and sets an LA address within the group.
When trying to enter the N system, filtering of the IP address cannot reliably detect an unauthorized access packet.

On the other hand, Japanese Patent Application Laid-Open No. 7-170279 discloses a technique for eliminating an unauthorized access packet without using IP address filtering.

That is, the system disclosed in Japanese Patent Application Laid-Open No. 7-170279 has a function of registering a group number of a branch LAN with a conventional bridge circuit accommodating a plurality of branch LANs for filtering by MAC address. A bridge circuit having a function of adding the group number to the packet when transmitting the packet, and a function of checking the group number added to the packet and the registered group number when receiving the packet is used.

A group number is set for each of the LANs accommodated in the bridge circuit, and the group number is added to a packet transmitted to the backbone bus when transferring between LANs within the same group. When receiving a packet from the backbone bus, before performing filtering by MAC address, which is the filtering function originally performed by the bridge circuit,
Filtering is performed by the group number added to the packet at the time of transmission.

That is, in a system in which a plurality of branch LANs to which a plurality of terminals are connected are connected to a backbone bus via a plurality of bridge circuits, a plurality of branch LANs individually accommodated in the plurality of bridge circuits are connected to a plurality of independent LANs. And the group numbers of the branch LANs to be accommodated in the respective bridge circuits are registered in advance. The bridge circuit adds a group number of the branch LAN to which the terminal belongs to a packet transmitted from the terminal to another branch LAN in the same group, and transmits the packet to the main bus. When receiving a packet via the backbone bus, the bridge circuit
Identifies the group number added to the received packet, compares it with the registered number, and operates the MAC address filtering function on the received packet only when the two match, and the bridge circuit accommodates it. To the local branch LAN.

By doing so, the LAN MA
An unauthorized access packet such as a broadcast packet, an abnormal packet, or a packet that attempts to illegally communicate with another group of terminals to another group of terminals in the C layer can be prevented by the difference in the group number.

[0014]

As described above, in the system disclosed in Japanese Patent Application Laid-Open No. 7-170279, a group number is set for each of a plurality of LANs accommodated in a bridge circuit, and the LANs in the same group are set. At the time of transfer, the group number is added to the packet transmitted to the main bus. When receiving a packet from the backbone bus, the bridge circuit performs filtering by a group number added to the packet at the time of transmission before performing filtering by a MAC address, which is a filtering function originally performed by the bridge circuit.

According to the system disclosed in Japanese Unexamined Patent Publication No. Hei 7-170279, by checking the difference of the group number, a broadcast packet, an abnormal packet in the MAC layer of the LAN or a terminal of another group is illegally transmitted to another group. Unauthorized access packet such as a packet that attempts to communicate with another terminal.

However, a group number is registered in a bridge circuit disclosed in JP-A-7-170279, this group number is added to a transmitted packet, and when a packet is received, the group number is registered as a group number of a received packet. In order to enable filtering for collating the group numbers, it is necessary to add a group number area to the data format of the packet.

However, a LAN packet includes a header portion of a physical layer and a header portion of a transport layer, and the data format of the packet is often specified in detail. Therefore, in a LAN system in which the data format of a packet is specified, in many cases,
An area for storing a group number in a conventional packet cannot be added and secured.
The technique described in Japanese Patent No. 79 cannot be implemented.

The present invention has been made in view of the above-mentioned circumstances, and enables filtering of an illegal packet using an existing area of the packet, and the effect of the illegal packet can be obtained without adding an area to the packet data format. It is an object of the present invention to provide a method and system for preventing unauthorized access, which makes possible the elimination of information.

[0019]

In order to achieve the above object, an unauthorized access prevention method according to a first aspect of the present invention provides a method in which a plurality of branch networks are connected to each other by a connecting device. To prevent unauthorized access in the logical group, the initial value of the network lifetime information included in the communication packet at the time of transmission is set to the secret value in the logical group set in the communication network in advance. As information, it is determined to a predetermined value, the coupling device checks the validity of the network lifetime information when the communication packet passes,
Filtering of a passing packet between inside and outside of the logical group is performed.

[0020] The network lifetime information includes information that is subtracted every time the connection device passes, and an initial value of the network lifetime information as the confidential information is estimated based on a network configuration. When the value of the network lifetime information is set to a value exceeding the maximum passing number of the coupling device, and the value of the network lifetime information is out of the range of the initial value to the initial value−the maximum passing number, the coupling device passes the packet. It may be determined that the packet is invalid.

The method for preventing unauthorized access further comprises:
Filtering based on the P address may be further used.

The method for preventing unauthorized access further comprises:
The filtering based on the AC address may be further used.

In the unauthorized access prevention method, the unauthorized device may discard the unauthorized packet.

[0024] An unauthorized access prevention system according to a second aspect of the present invention is a communication network system in which one or more logical groups are configured in a network in which a plurality of branch networks are connected. Means for setting an initial value of the network lifetime information included in the communication packet to a predetermined value as confidential information in a logical group set in the communication network in advance when transmitting the communication packet; A terminal device having a validity check means for checking the validity of the lifetime information in the network when the communication packet passes, and based on a check result of the validity check means, between the inside and outside of the logical group. Filtering for passing packets It includes a processing unit, while coupling the plurality of branch networks comprises a network coupling means to prevent unauthorized access in the logical group, the.

[0025] The network lifetime information includes information that is subtracted every time the network connection means passes, and the network lifetime setting means sets an initial value of the network lifetime information as the confidential information.
Means for setting a value exceeding the maximum number of passages of the network coupling means expected based on a network configuration, and the validity checking means includes a step of setting the value of the network lifetime information to the initial value to the initial value. If the packet is out of the range of the value—the maximum number of passages, the packet may include a unit that determines the packet as an invalid packet.

[0026] The network connection means may further include IP address filtering means for performing filtering based on an IP address.

[0027] The network connection means may further include a MAC address filtering means for performing filtering based on a MAC address.

[0028] The network coupling means may include packet discarding means for discarding an illegal packet whose passage has been blocked by filtering.

In the method and system for preventing unauthorized access according to the present invention, unauthorized access in a logical network of a communication network in which one or more logical groups are formed in a network in which a plurality of branch networks are connected by a connecting device is prevented. In order to do so, the initial value of the network lifetime information included in the communication packet at the time of transmission is set to a predetermined value as confidential information in a logical group set in the communication network in advance, and the coupling device sets the communication packet By checking the validity of the network lifetime information at the time of passing, the filtering of the passing packets between inside and outside of the logical group is performed. Therefore, it is possible to perform filtering of an unauthorized packet by using the lifetime information in the network, which is an existing area of the packet, and it is possible to effectively eliminate the unauthorized packet without adding an area to the data format of the packet. Become.

[0030]

Embodiments of the present invention will be described below with reference to the drawings.

The unauthorized access prevention system according to the embodiment of the present invention is applied to a communication network system using a TCP / IP protocol. In this embodiment, the illegal packet is filtered by using the TTL, which is an existing area in the IP header of the TCP / IP protocol, to thereby achieve an illegal access in the conventional data format of the communication packet. Prevention.

The IP header of a communication packet according to the TCP / IP protocol has a TTL area for storing TTL (Time To Live: network lifetime) information. The TTL information indicates how long the communication packet can remain in the network, that is, the remaining time in seconds. This lifetime is based on the unit of seconds. However, there are cases where the processing time is less than 1 second and the processing time cannot be measured. In general, every time the data passes through a coupling device such as a router or a gateway, for example, Each time a communication packet having a TTL value of "0" is detected, the communication packet is discarded as having expired. Such TTL information is provided to prevent the generation of packets floating in the network without being delivered forever. TCP
In the / IP protocol, the maximum value of TTL is “25
5 (seconds). In general, the number of coupling devices, such as routers and gateways, from the transmitting terminal to the receiving terminal is overestimated in order to prevent occurrence of unreachable packets. Since the communication packet is discarded 255 seconds after the transmission even if the maximum value is set, the value is usually set to a relatively large value.

In the present invention, within a logical group, T
The initial value of TL is determined in advance as confidential information, and the maximum number of coupling devices, such as routers and gateways, from which packets are expected to pass from the transmitting terminal to the receiving terminal in the group is set. The initial value of the TTL is set to be larger than the maximum number of the coupling devices. When filtering packets, use the TTL
If the value is in the range from the initial value of TTL to (initial value-maximum number of passing coupling apparatuses), it is determined that the packet is a normal packet.

According to such a mechanism, an illegal packet from an illegal terminal outside the group that attempts to illegally access a terminal within the group using the IP address of the terminal within the group can be eliminated.

An embodiment of a network system incorporating the unauthorized access prevention system according to the present invention based on the above-described principle will be described with reference to FIGS.

FIG. 1 shows a configuration of a main part of a gateway incorporating an unauthorized access prevention system according to an embodiment of the present invention.

The gateway 1 shown in FIG. 1 includes an IP header check unit 11 and a packet discard processing unit 12.

The IP header check unit 11 checks the information of the IP header and checks the TTL (Ti
me to Live: network lifetime) information and IP
Based on the address information, a check is made for packets passing from the inside to the outside of the logical group and from the outside to the inside of the logical group, and only non-illegal communication packets are allowed to pass, thereby preventing illegal packets from passing. Packet discard processing unit 12
Discards an illegal packet whose passage has been blocked by the IP header check unit 11.

The IP header check unit 11 has a TTL filtering unit 21 and an IP address filtering unit 22.

The TTL filtering unit 21 has a validity checking unit 21a and a filtering processing unit 21b. The TTL filtering unit 21 checks the validity of TTL information in the IP header, and the communication packet having TTL information that is valid as TTL information. Only to prevent the passage of communication packets having invalid TTL information.

The validity check unit 21a checks the validity of the TTL information based on whether or not the TTL information in the IP header satisfies a predetermined condition when the communication packet passes. The filtering processing unit 21b passes only communication packets whose TTL information satisfies a predetermined condition, based on the check result of the validity check unit 21a, for packets passing between inside and outside of the logical group. Are given to the packet discard processing unit 12.

As described above, T in the gateway 1
In the filtering using TL information, in each logical group, an initial value of TTL in the group is determined as confidential data in advance, and a coupling device such as a gateway and a router through which a packet passes from a transmitting terminal to a receiving terminal in the group. Etc., the maximum number is set. By registering the initial value of the TTL and the maximum number of transit coupling devices in the validity checking unit 21a of the gateway 1 in advance, the validity checking unit 21a sets the TTL value at the time of passing the packet to the initial value of the TTL. The validity is checked on condition that it is within the range from (initial value−maximum number of passing gateways). If the TTL value is within the range, it is determined that the packet is normal, that is, valid. If the value is out of the range, it is determined that the packet is invalid, that is, there is no validity.

The IP address filtering unit 22
Based on the IP address information in the P header, a communication packet from outside the logical group to an address inside the logical group and a communication packet from inside the logical group to an address outside the logical group are passed. The communication packet having the IP address information other than the above is prevented from passing therethrough and given to the packet discarding processing unit 12.

FIG. 2 shows a network system configured using the gateway 1 shown in FIG. In FIG. 2, an unauthorized access prevention system is configured using a conventional gateway having a filtering function and the gateway having a filtering function according to the present invention of FIG.

The network system shown in FIG.
Gateway 1, second gateway 2, first terminal 3, second terminal 4, third terminal 5, first branch line LAN
6, a second branch line LAN7 and a third branch line LAN8. The first terminal 3 and the second terminal 4 are coupled to a first branch LAN 6, and the third terminal 5 is coupled to a third branch LAN 8. The first branch LAN 6 and the second branch LAN 7 are connected by the second gateway 2, and the second branch LAN 7 and the third branch LAN are connected.
8 are connected by the second gateway 1.

First and second gateways 1 and 2
Are the second branch LAN7 and the third branch LAN8, respectively.
And between the first branch LAN 6 and the second branch LAN
7 and transfer data such as a communication packet.

The first gateway 1 is a gateway having a communication packet filtering function based on the present invention shown in FIG. That is, the first gateway 1 has a communication packet filtering function using TTL information according to the present invention and a communication packet filtering function using a conventional IP address.

The second gateway is a conventional gateway, and has only a function of filtering a communication packet using an IP address.

It is assumed that the second terminal 4 and the third terminal 5 form the same group, and the first terminal 3 is a terminal outside the group.

In this case, for example, it is assumed that the initial value of TTL is set to "5" as confidential data in a group composed of terminal 4 and terminal 5. Further, the maximum transit coupling device number, that is, the maximum transit gateway number is “2” because the gateways 1 and 2 exist. These values are stored in the validity check unit 21a of the gateway 1.
Is set in advance.

Since the terminal 3 outside the group does not know the initial value of the TTL determined between the groups of the terminal 4 and the terminal 5, it is assumed that the terminal 3 sets the initial value of the TTL to "32". The operation when the terminal 4 transmits a communication packet to the terminal 5, and the terminal 3 impersonating the terminal 4 in a state where the terminal 4 is not connected to the branch line LAN 6, setting the terminal 4 to the IP address of the terminal 4, The operation when an unauthorized access is attempted will be described with reference to the flowchart shown in FIG. The flowchart shown in FIG. 3 is a flowchart showing the operation of the IP header check unit 11 of the gateway 1 shown in FIG.
The flow of the P header check process is shown.

In the gateway 2, the IP addresses of the terminals 4 and 5 are registered in order to perform only the filtering of the IP addresses. In the gateway 1, the IP addresses of the terminals 4 and 5 are registered for filtering the IP addresses, and the TTL initial value α determined between the terminals 4 and 5 for TTL filtering.
“5” and the maximum number of passing gateways “2” are stored in the internal validity checking unit 21a.

First, the operation when the terminal 4 transmits a communication packet to the terminals 5 in the same group will be described.

The terminal 4 sets the IP address of the terminal 4 to its own IP address, that is, the source IP address,
While setting the IP address of the destination terminal 5 as the destination IP address, that is, the destination (transmission destination) IP address,
The TTL contains an initial value α “5” determined between the groups.
Is set, and the communication packet is transmitted to the branch line LAN 6.

The transmitted packet is received by the gateway 2. Gateway 2 checks the IP header. Since the gateway 2 is the address of the terminal 4 in which the source IP address is registered and the address of the terminal 5 in which the destination IP address is registered, it is regarded as a normal packet. Assuming that the packet is a normal packet, the gateway 2 sets “4” obtained by subtracting “1” from the original TTL value “5” as a new TTL value in the TTL, and transmits the communication packet to the branch LAN 7.

The packet transmitted to the branch LAN 7 is received by the gateway 1. Gateway 1
The IP header check unit 11 checks the IP header according to the flowchart shown in FIG.

When the check of the IP header is started, I
The version of P is checked (step S11),
If the version is abnormal, the packet discard processing unit 1
In step 2, the packet is discarded (step S17). If the version is normal in step S11, the other information in the IP header is checked (step S1).
2) Also, when the abnormality of the other information is detected, the process shifts to step S17 to discard the packet.

If normal in step S12,
It is checked whether the value of TTL is "0" (step S13). If the TTL value is “0” in step S13, the packet is discarded in step S17 because the TTL, that is, the network lifetime has expired. In this case, the value of TTL is “4”
Therefore, in step S13, it is determined to be normal, and TT
The validity checking unit 21a of the L filtering unit 21
The validity of the value of TL is checked (step S1)
4).

The validity check is performed based on whether or not the value of the TTL is equal to or less than the initial value α and exceeds (the initial value−the maximum number of gates) β. If the TTL value is within this range, it is deemed appropriate.

In this case, the initial value α is “5”, (initial value−
The maximum number of gates β is “3” (= 5-2), and the TTL value of the received packet is “4”. If it is determined in step S14 that the IP address is normal, the IP
The IP address is checked by the address filtering unit 12 (step S15). If it is determined that the packet is invalid in step S14, the packet is discarded in step S17.

Since the source IP address of the received communication packet is the IP address of the registered terminal 4 and the destination IP address is the address of the registered terminal 5, it is regarded as a normal packet, and the communication packet is The data is received by the gateway 1 (step S16). The gateway 1 changes the TTL of the received packet from “4” to “1”.
Is set to "3", and the communication packet is transmitted to the branch LAN8. The transmitted communication packet is received by terminal 5, which is the destination terminal.

Next, a description will be given of an operation in a case where a terminal 3 outside the group impersonates the terminal 4 and tries to illegally transmit a packet to the terminal 5 while the terminal 4 is not connected to the branch line LAN 6.

The terminal 3 sets the IP address of the terminal 4 as the source IP address, sets the IP address of the destination terminal 5 as the destination IP address, and transmits the communication packet to the branch line LA.
Send to N6. However, in this case, since the terminal 3 does not belong to the logical group to which the destination terminal 5 belongs, the initial value of the TTL decided within the group is unknown.
Therefore, the terminal 3 sets “32” as an appropriate value in the TTL.
To send a communication packet.

The transmitted communication packet is transmitted to the gateway 2
Is received. The gateway 2 checks the IP header for filtering the IP address. However, since the gateway 2 is the address of the terminal 4 where the source IP address is registered and the address of the terminal 5 where the destination IP address is registered. , The IP address is considered to be normal.
Therefore, the gateway 2 sets “31” obtained by subtracting “1” from “32” in the TTL, and transmits the communication packet to the branch LAN 7.

The packet transmitted to the branch LAN 7 is received by the gateway 1. In the gateway 1, the IP header check unit 11 checks the IP header according to the flowchart shown in FIG.

When the checking of the IP header is started, the version of the IP is checked in step S11. If the version is abnormal, the process proceeds to step S17, and the packet discarding unit 12 discards the packet. If the version is normal in step S11, the other information in the IP header is checked in step S12, and if an abnormality is detected, the packet is discarded in step S17.

If the other information of the IP header is normal in step S12, the TT is determined in step S13.
It is checked whether the value of L is "0". In the check in step S13, if the value of TTL is "0", the packet is discarded.
Since the value of the TTL is “31”, it is determined that the value is normal in step S13, and the validity of the value of the TTL is checked in step S14.

In the validity check in step S14, as described above, the initial value α is “5”, and β which is (initial value−maximum number of passing gateways) is “3” (= 5).
-2), but since the TTL value of the received communication packet is “31”, it is regarded as abnormal, and the process proceeds to step S17.
Then, the communication packet is discarded.

As described above, the filtering function using the TTL in the IP header portion detects and discards an illegal packet that cannot be detected by IP address filtering, thereby improving the reliability of the terminal's unauthorized access prevention function. can do.

In the embodiment of the present invention described with reference to FIGS. 1 to 3, the filtering using the TTL information is used in combination with the filtering based on the IP address. A means for performing this function may be provided so as to use the MAC address filtering function together.

[0071]

As described above, in the method and system for preventing unauthorized access according to the present invention, a communication network in which one or more logical groups are formed in a network in which a plurality of branch networks are connected by a connecting device. In order to prevent unauthorized access in the logical group, the initial value of the network lifetime information included in the communication packet at the time of transmission is set to a predetermined value as confidential information in the logical group set in the communication network in advance, The coupling device performs filtering of a passing packet between inside and outside of the logical group by checking validity of the network lifetime information when the communication packet passes. Therefore, it is possible to perform filtering of an unauthorized packet by using the lifetime information in the network which is an existing area of the packet.

That is, according to the present invention, it is possible to filter an illegal packet using an existing area of the packet, and to effectively eliminate the illegal packet without adding an area to the data format of the packet. An unauthorized access prevention method and system can be provided.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a main part of a gateway incorporating an unauthorized access prevention system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration of a network system using the gateway of FIG.

FIG. 3 is a flowchart showing a flow of checking an IP header in an IP header check unit of a gateway, for explaining an operation of the system of FIG. 1;

[Explanation of symbols]

1, 2 Gateway 3-5 Terminal (terminal device) 6-8 Branch LAN (Local Area Network) 11 IP (Internet Protocol) header check unit 12 Packet discard processing unit 21 TTL (Time to Live) filtering unit 21a Validity check unit 21b Filtering processing unit 22 IP address filtering unit

Claims (10)

[Claims] 1. In a communication network in which one or more logical groups are configured in a network in which a plurality of branch networks are connected by a connecting device, in order to prevent unauthorized access in the logical groups, a communication packet at the time of transmission is used. The initial value of the network lifetime information included is set to a predetermined value as confidential information in a logical group set in the communication network in advance, and the coupling device transmits the network lifetime when the communication packet passes. A method for preventing unauthorized access, characterized in that passing information between inside and outside of the logical group is filtered by checking the validity of the information. 2. The in-network lifetime information includes information that is subtracted each time the coupling device passes, and an initial value of the in-network lifetime information as the confidential information is estimated based on a network configuration. When the value of the network lifetime information is out of the range from the initial value to the initial value minus the maximum number of passages, the coupling device The method according to claim 1, wherein the packet is determined to be an unauthorized packet. 3. The method according to claim 1, wherein filtering based on an IP (Internet Protocol) address is further used. 4. The method according to claim 1, wherein filtering based on a MAC (media access control) address is further used. 5. The method according to claim 1, wherein the illegal packet is discarded by the coupling device. 6. In a communication network system in which one or more logical groups are configured in a network in which a plurality of branch networks are connected, the communication network is connected to the branch network and included in the communication packet when a communication packet is transmitted. A terminal device having network lifetime information setting means for setting an initial value of network lifetime information as confidential information in a logical group set in a communication network in advance to a predetermined value, and Validity checking means for checking the validity of the network lifetime information, and based on the check result of the validity checking means,
Filtering means for filtering passing packets between inside and outside of the logical group, and network coupling means for coupling the plurality of branch networks and preventing unauthorized access in the logical group. And unauthorized access prevention system. 7. The network lifetime information includes information that is subtracted every time the network coupling unit passes, and the network lifetime setting unit includes an initial value of the network lifetime information as the confidential information. To
Means for setting a value exceeding the maximum number of passages of the network coupling means expected based on a network configuration, and the validity checking means includes a step of setting the value of the network lifetime information to the initial value to the initial value. 7. The unauthorized access prevention system according to claim 6, further comprising means for judging the packet as an unauthorized packet when the value is out of a range of a value minus the maximum number of passages. 8. The unauthorized access prevention system according to claim 6, wherein the network connection unit further includes an IP address filtering unit that performs filtering based on an IP (Internet Protocol) address. 9. The network connection means according to claim 9, wherein
(Media access control) The unauthorized access prevention system according to any one of claims 6 to 8, further comprising a MAC address filtering means for performing filtering based on an address. 10. The apparatus according to claim 6, wherein said network coupling means includes a packet discarding means for discarding an illegal packet whose passage has been blocked by filtering.
10. The unauthorized access prevention system according to any one of claims 9 to 9.