KR102387010B1 - Monitoring apparatus and monitoring method - Google Patents

Abstract

An object of the present invention is to provide a monitoring technique capable of detecting an illegal terminal in an IPv6 environment while reducing the burden of monitoring ICMPv6 packets flowing in a network.
The monitoring device 1 includes a generation unit 11 that generates a transmission packet including a preset illegal header, and all-node multicast transmission of the transmission packet via the network NW, and receives the transmission packet from the terminal. A transmission/reception unit 10 for receiving a reply packet including an error message via the network NW, and an acquisition unit 13 for obtaining unique identification information included in the reply packet for identifying a terminal that is a transmission source of the reply packet and the matching unit 14 that collates the acquired identification information with the white list of identification information stored in the storage unit 12, and based on the matching result of the collating unit 14, the terminal of the sender of the reply packet A judging unit 15 is provided for judging whether or not it is a terminal accessing the network NW illegally.

Description

MONITORING APPARATUS AND MONITORING METHOD

The present invention relates to a monitoring apparatus and a monitoring method, and more particularly, to a technique for monitoring illegal access to a network in an IPv6 environment.

In recent years, with the spread of IoT, various devices have come to be connected to the Internet. Accordingly, the number of devices connected to the Internet has also increased explosively, and the transition from IPv4, which has been used as an Internet protocol, to IPv6, a new protocol having an address length of 128 bits is in progress. Moreover, also in many network security products, such as a network monitoring apparatus, one corresponding to IPv6 is requested|required rapidly.

Conventionally, when a terminal in a network is identified, an agent (SW) is put in each terminal, or ARP (Address Resolution Protocol), which is a communication protocol used in IPv4, or the like is used.

However, it is particularly difficult to insert an agent into a built-in device (eg, a camera), and in a situation where various devices are connected to a network, there may be cases in which a specific device or terminal on the network cannot be identified. In addition, even in the search for a terminal accessing the network illegally, ARP is based on the protocol of IPv4, and it is difficult to search for an unauthorized terminal in an IPv6 environment.

Therefore, conventionally, a technique for preventing unauthorized access to a network in an IPv6 environment has been proposed. For example, in Patent Document 1, a monitoring device is installed in a network to monitor NS (Neighbor Solicitation) packets flowing in the network, and based on the source address or MAC address of the NS packet, whether the terminal is permitted to access the network decide whether or not

Japanese Patent Laid-Open No. 2007-104396

However, in the technique described in Patent Document 1, when a terminal (hereinafter referred to as "rogue terminal") that connects illegally to a network for the purpose of wiretapping does not transmit an NS packet or the like by itself, an unauthorized terminal cannot be detected.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a monitoring technique capable of detecting an illegal terminal in an IPv6 environment while reducing the monitoring burden of ICMPv6 packets flowing in a network.

In order to solve the above problems, a monitoring device according to the present invention includes: a generator configured to generate a transmission packet including a preset illegal header; and a transmission unit configured to transmit the transmission packet by all-node multicast transmission via a communication network; , a receiving unit configured to receive, via the communication network, a reply packet including an error message from a terminal that has received the transmit packet, and a unique identification included in the reply packet to identify the terminal that is the source of the reply packet an acquisition unit configured to acquire information; a collating unit configured to collate the acquired identification information with a list of identification information stored in a storage unit; and a judging unit configured to determine whether or not the terminal is illegally accessing the communication network.

In addition, in the monitoring apparatus according to the present invention, the list includes unique identification information of a terminal to which access to the communication network is permitted, and the determination unit includes: the identification information acquired by the acquisition unit; If it is not included in the list, it may be determined that the terminal is a terminal illegally accessing the communication network.

Moreover, the monitoring apparatus which concerns on this invention WHEREIN: You may further comprise the notification part comprised so that the determination result by the said judgment part may be notified.

Further, in the monitoring apparatus according to the present invention, the communication network is a communication network corresponding to IPv6, and the transmission packet includes an illegal IPv6 header that the terminal receiving the transmission packet determines to have a problem with the packet. may be

Further, in the monitoring apparatus according to the present invention, the reply packet may include a parameter denial message according to ICMPv6.

Further, in the monitoring apparatus according to the present invention, the identification information may be a MAC address.

Further, in the monitoring apparatus according to the present invention, the acquisition unit detects a terminal connected to the communication network, and acquires at least any of an IP address and a MAC address as information of the terminal, and the determination unit includes: Based on the information on the terminal and the matching result of the matching unit, it may be determined whether or not the terminal of the transmission source is a terminal illegally connecting to the communication network.

In order to solve the above problems, a monitoring method according to the present invention includes a generating step of generating a transmission packet including a preset illegal header, a transmission step of transmitting the transmission packet by all-node multicast transmission through a communication network; a receiving step of receiving a reply packet including an error message from the terminal that has received the transmit packet through the communication network; an acquisition step of acquiring and a determination step of determining whether the terminal is illegally accessing the network or not.

According to the present invention, all-node multicast transmission of a transmission packet including a preset illegal header is performed, and identification information of a terminal included in a reply packet including an error message from a terminal that has received the transmission packet is acquired and identified By collating the list of information, it is possible to detect illegal terminals in the IPv6 environment while reducing the burden of monitoring ICMPv6 packets flowing in the network.

1 is a block diagram showing the configuration of an illegal connection monitoring system including a monitoring device according to an embodiment of the present invention.
Fig. 2 is a block diagram showing the configuration of a monitoring device according to the present embodiment.
Fig. 3 is a block diagram showing the hardware configuration of the monitoring device according to the present embodiment.
4 is a flowchart for explaining the operation of the monitoring device according to the present embodiment.
Fig. 5 is a diagram showing an example of a data structure of a white list according to the present embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 5 .

[Configuration of fraudulent access monitoring system]

An illegal access monitoring system according to an embodiment of the present invention searches for an illegal terminal 3 that is illegally connected to a network NW by unauthorized access. The illegal access monitoring system includes a monitoring device 1 , a regular terminal 2 , and an illegal terminal 3 as shown in FIG. 1 .

The monitoring device 1, the regular terminal 2, and the illegal terminal 3 are mutually connectable via a network NW, such as LAN. In Fig. 1, a regular terminal 2 is a terminal such as a PC in which IPv6 connection to the network NW is permitted operates. On the other hand, the unauthorized terminal 3 is a terminal such as a PC in which IPv6 is not permitted to connect to the network NW.

In the present embodiment, the fraudulent connection monitoring system searches for and detects the fraudulent terminal 3 performing an illegal connection to the network NW on the same segment in the link local area. In the example of FIG. 1 , IPv6 addresses "1", "2", and "3" are assigned to each of the three regular terminals 2, and MAC addresses "A", "B", and "C" has In addition, the illegal terminal 3 has an IPv6 address "4" and a MAC address "D". In addition, a link local address "a" is assigned in the illegal connection monitoring system.

The illegal connection monitoring system according to the present embodiment uses the agreement regarding the ICMPv6 Parameter Problem (ICMP Parameter Problem) specified in the specification of the Internet Communication Message Protocol (ICMP) in IPv6, and the illegal terminal 3 in the link local ) is detected.

[Function Block of Supervisor]

As shown in FIG. 2 , the monitoring device 1 includes a transmission/reception unit (transmission unit, reception unit) 10 , a generation unit 11 , a storage unit 12 , an acquisition unit 13 , a matching unit 14 , and a judgment A unit 15 and a notification unit 16 are provided.

Transceiver unit 10 all-node multicast transmission of packets to regular terminal 2 and illegal terminal 3 via network NW. In addition, the transceiver 10 receives packets sent from the regular terminal 2 and the illegal terminal 3 through the network NW. More specifically, the transceiver 10 transmits a multicast packet including an illegal IPv6 header, which will be described later, to an all-node multicast address. In addition, the transceiver 10 receives, as a reply to the multicast packet, an ICMPv6 error message, which will be described later, returned from each terminal in the network NW.

The generation unit 11 generates a multicast packet (transmission packet) to be sent to an all-node multicast address including an illegal header set in advance. The preset illegal header refers to an IPv6 header that is determined to have a problem in a packet by the regular terminal 2 and the illegal terminal 3 that are IPv6 nodes, or an IPv6 header in which a problematic field is included in the extended header.

Here, in the specification (RFC) of ICMP for IPv6, there are the following agreements. According to the RFC, when an IPv6 node processing a packet finds a problematic field included in an IPv6 header or extended header that cannot completely process the packet, the packet should be discarded. In addition, it is said that the IPv6 node should transmit an ICMPv6 parameter negation message indicating the type and problem location to the source of the packet.

The generating unit 11 sends a reply of an ICMPv6 parameter invalid message (ICMPv6 error message) from the regular terminal 2 and the illegal terminal 3 on the network NW (hereinafter sometimes referred to as "ICMPv6 error message") This creates a multicast packet with an invalid header.

For example, the generator 11 may generate a multicast packet that is data of an IPv6 extension header in which the value of the Hop-by-Hop Option in the IPv6 header cannot be recognized by the IPv6 node. Moreover, the generation unit 11 may be configured to read out an illegal header prepared in advance from the storage unit 12 .

The memory|storage part 12 memorize|stores the unique identification information of the regular terminal 2 by which the connection to the network NW was permitted. The storage unit 12 stores, for example, a white list in which the MAC addresses of the regular terminals 2 are registered.

The acquisition unit 13 acquires unique identification information indicating the transmission source included in the reply packet from the regular terminal 2 and the illegal terminal 3 in the network NW received by the transmission/reception unit 10 . The acquisition unit 13 can acquire, for example, the MAC address of the sender at a predetermined position in the packet of the ICMPv6 error message.

Moreover, the acquisition part 13 can detect the apparatus containing the regular terminal 2 and the illegal terminal 3 connected to the network NW, and can acquire the information of these apparatuses. For example, the acquisition unit 13 can detect at least one of an IP address and a MAC address of a device on the network NW.

The collation unit 14 collates the identification information of the sender included in the packet of the ICMPv6 error message acquired by the acquisition unit 13 with the identification information of the regular terminal 2 registered in advance in the storage unit 12 . do. More specifically, the collation unit 14 collates the MAC address included in the packet of the ICMPv6 error message with the MAC address registered in the white list.

The determination unit 15 determines whether or not the terminal that is the source of the ICMPv6 error message is a terminal that connects to the network NW illegally, based on the verification result of the collation unit 14 . Specifically, the determination unit 15 is configured to, if none of the MAC addresses included in the packet of the ICMPv6 error message correspond to the MAC addresses registered in the white list, the terminal having the MAC address is an illegal terminal 3 ) is judged to be

Further, the determination unit 15 may make the above determination based on the information of the device on the network NW detected and acquired by the acquisition unit 13 and the result of the verification of the matching unit 14 .

The notification unit 16 outputs the determination result by the determination unit 15 . For example, identification information of the terminal determined to be the illegal terminal 3 by the determination unit 15 may be displayed on the display device 107 . In addition, it is possible to notify an external server (not shown) connected via a communication network such as the Internet or the like that the fraudulent terminal 3 has been detected and identification information of the fraudulent terminal 3 .

[Hardware configuration of the monitoring device]

Next, an example of the hardware configuration of the monitoring device 1 having the above-described functions will be described with reference to FIG. 3 .

As shown in FIG. 3 , the monitoring device 1 includes, for example, a processor 102 connected via a bus 101 , a main memory device 103 , a communication interface 104 , an auxiliary storage device 105 , and input/output I/ It can be realized by a computer including O(106) and a program for controlling these hardware resources.

In the main memory device 103, a program for the processor 102 to perform various kinds of control and arithmetic is stored in advance. Each function of the monitoring device 1, such as the generation unit 11, the acquisition unit 13, the collation unit 14, and the determination unit 15, shown in Fig. 2 by the processor 102 and the main memory unit 103 This is realized.

The communication interface 104 is an interface circuit for network connection between the monitoring device 1, the regular terminal 2, the illegal terminal 3, and various external electronic devices.

The auxiliary storage device 105 includes a read/write storage medium and a drive device for reading/writing various types of information such as programs and data to the storage medium. For the auxiliary storage device 105, a semiconductor memory such as a hard disk or a flash memory can be used as a storage medium.

The auxiliary storage device 105 has a program storage area in which the monitoring device 1 stores a program for executing the detection process of the illegal terminal 3 . Further, the auxiliary storage device 105 stores a white list of the regular terminals 2 that are permitted to connect to the network NW. The auxiliary storage device 105 realizes the storage unit 12 described in FIG. 2 . Further, for example, a backup area for backing up the above-described data, programs, or the like may be provided.

The input/output I/O 106 is constituted by I/O terminals for inputting a signal from an external device or outputting a signal to the external device.

The display device 107 is constituted by a liquid crystal display or the like. The display device 107 implements the notification unit 16 described with reference to FIG. 2 . The notification by the notification unit 16 is displayed on the display device 107 .

[Monitoring method]

Next, the operation of the monitoring device 1 having the above-described configuration will be described with reference to the flowchart of FIG. 4 . As a premise below, it is assumed that a white list including identification information of terminals permitted to connect to the network NW in advance is stored in the storage unit 12 .

First, the generation unit 11 generates a packet having an illegal header to which a reply of an ICMPv6 parameter illegal message (ICMP Parameter Problem) is received from the regular terminal 2 and the illegal terminal 3 on the network NW (step S1) ). Specifically, the generation unit 11 may generate a multicast packet that is data of an IPv6 extension header in which the value of the Hop-by-Hop Option in the IPv6 header cannot be recognized by the IPv6 node. there is.

Next, the transceiver 10 transmits the generated multicast packet having an illegal header to all-node multicast (step S2). Specifically, as shown in Fig. 1, the transceiver 10 transmits multicast packets to the three regular terminals 2 and the illegal terminal 3 via the network NW to all-node multicast (for example, " FE02::1”).

Thereafter, the transmitting/receiving unit 10 receives an ICMPv6 error message as a reply packet from the regular terminal 2 and the illegal terminal 3 that have received the multicast packet having an illegal header (step S3). Next, the acquisition unit 13 acquires unique identification information indicating the transmission source included in the packet of the received ICMPv6 error message (step S4). For example, the acquisition unit 13 can acquire the MAC address of the transmission source as unique identification information.

Next, the matching unit 14 collates the unique identification information acquired by the acquisition unit 13 with the white list stored in the storage unit 12 (step S5). Specifically, the collation unit 14 collates the MAC address of the sender included in the packet of the ICMPv6 error message with the MAC address registered in the white list.

5 shows an example of the white list stored in the storage unit 12 . MAC addresses "A", "B", and "C" are registered in the white list prepared in advance. The matching unit 14 outputs, as a matching result, whether or not the MAC address included in the packet of the ICMPv6 error message matches "A", "B", or "C".

If the MAC address included in the packet of the ICMPv6 error message exists in the white list (step S6: YES), proceed from step S3 to step S6 until all obtained MAC addresses are collated with the white list (step S8: NO) Repeat.

On the other hand, when the MAC address included in the packet of the ICMPv6 error message does not exist in the white list (step S6: NO), the determination unit 15 determines that the terminal having the matched MAC address is the invalid terminal 3 . do (step S7).

Thereafter, the notification unit 16 notifies the existence of the illegal terminal 3 and the MAC address of the illegal terminal (step S9). For example, the notification unit 16 can display the MAC address of the illegal terminal 3 or the like on the display device 107 . In addition, the notification unit 16 may perform a notification indicating that, when the illegal terminal 3 is not detected.

As described above, according to the monitoring apparatus 1 according to the present embodiment, an ICMPv6 error message returned from the terminal after all-node multicast transmission of a multicast packet including an illegal header to a terminal in the network NW is performed. The fraudulent terminal 3 is detected using the unique identification information of the sender included in the packet of . Therefore, it is possible to detect the illegal terminal 3 connected to the link local in the IPv6 environment without waiting for each terminal in the network NW to transmit the NS packet.

In addition, since the information contained in the packet of the ICMPv6 error message is used, it is possible to detect the fraudulent terminal 3 in a shorter time by transmitting a smaller amount of discovery packets.

In addition, in the described embodiment, the case where the MAC address was used as unique identification information of the terminal in the network NW was illustrated. However, the information used as unique identification information is not limited to this. For example, a combination of an IPv6 address and a MAC address may be used.

As mentioned above, although embodiment in the monitoring apparatus and monitoring method of this invention was described, this invention is not limited to the described embodiment, It is the scope of the invention described in the claim, and various modifications which those skilled in the art can assume are made. it is possible

DESCRIPTION OF SYMBOLS 1: Monitoring device, 2: Regular terminal, 3: Improper terminal, 10: Transceiver unit, 11: Generation|generation part, 12: Memory|storage part, 13: Acquisition unit, 14: Verification unit, 15: Judgment unit, 16: Notification unit, 101: bus, 102: processor, 103: main memory, 104: communication interface, 105: auxiliary storage, 106: input/output I/O, 107: display device, NW: network.

Claims (8)

a generating unit configured to generate a transmission packet including a preset illegal header;
a transmission unit configured to transmit the transmission packet through an all-node multicast transmission network;
a receiving unit configured to receive a reply packet including an error message from a terminal that has received the transmit packet through the communication network;
an acquisition unit configured to acquire unique identification information for identifying the terminal, which is a transmission source of the reply packet, included in the reply packet;
a collating unit configured to collate the acquired identification information with a list of identification information stored in the storage unit;
a judging unit configured to judge whether or not the terminal of the transmitting source is a terminal illegally accessing the communication network, based on a matching result of the matching unit
A monitoring device comprising a. According to claim 1,
The list includes unique identification information of a terminal permitted to access the communication network,
and the determination unit determines that the terminal is a terminal illegally accessing the communication network when the identification information acquired by the acquisition unit is not included in the list. 3. The method of claim 1 or 2,
and a notification unit configured to notify a result of determination by the determination unit. 3. The method of claim 1 or 2,
The communication network is a communication network corresponding to IPv6,
The transmission packet includes an illegal IPv6 header that the terminal that has received the transmission packet determines that there is a problem with the packet. 3. The method of claim 1 or 2,
The reply packet includes an ICMPv6 parameter denial message. 3. The method of claim 1 or 2,
The monitoring device, characterized in that the identification information is a MAC address. 3. The method of claim 1 or 2,
The acquisition unit detects a terminal connected to the communication network, and acquires at least any one of an IP address and a MAC address as information of the terminal;
The judging unit determines whether or not the terminal of the transmitting source is a terminal illegally accessing the communication network, based on the detected information on the terminal and a matching result of the matching unit. A generating step of generating a transmission packet including a preset illegal header;
A transmission step of transmitting the transmission packet through an all-node multicast transmission network;
a receiving step of receiving a reply packet including an error message from the terminal receiving the transmit packet through the communication network;
an acquisition step of acquiring unique identification information for identifying the terminal, which is a transmission source of the reply packet, included in the reply packet;
a collation step of collating the acquired identification information with a list of identification information stored in a storage unit;
A judgment step of judging whether or not the terminal of the sender is a terminal illegally accessing the communication network based on the matching result in the matching step
A monitoring method comprising a.

Images