KR20030050883A - Method and Apparatus of ATM(Asynchronous Transfer Mode) Firewall Switch having distributed CAC(Call Admission Control) and Parallel Cell Screen Structure - Google Patents

Abstract

PURPOSE: An ATM firewall switch device with a call admission control structure and a parallel cell screen structure and a method therefor are provided to minimize the deterioration of an ATM switch and delay of a cell processing time when adopting a virtual connection or packet level security policy. CONSTITUTION: A signal cell filter(200) extracts a signal cell from cells introduced into a screened input unit(102). A management cell filter(201) extracts a management cell from cells which have passed the signal cell filter(200). A parallel cell screen unit(202) reduces a cell processing time delay according to a screen policy application. A header converter(205) adds switch information to a user cell which has passed the parallel cell screen unit(202), and outputs it to a cell switching unit(104). A VP(Virtual Path)/VC(Virtual Connection) table(206) stores allocated VPI(Virtual Path Indicator)/VCI(Virtual Connection Indicator) information and policy information on a virtual line. A security policy cash(207) is referred to determine a security policy. A cell duplicator(203) duplicates introduced user cell as many as the user cell filters(204) and transfers it to a cell filter(204). The user cell filter(204) filters only the cells allocated to itself by referring a VPI(Virtual Path Indicator).

Description

Asynchronous transfer mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure and a method therefor {Method and Apparatus of Asynchronous Transfer Mode (ATM) Firewall Switch having distributed Call Admission Control (CAC) and Parallel Cell Screen Structure)

The present invention relates to an asynchronous transmission mode firewall switch having a distributed call admission control structure and a parallel cell screen structure, and a method thereof and a computer-readable recording medium recording a program for realizing the method. ATM firewall switch with parallel cell screen structure is designed to minimize bottlenecks and delays in connection processing when applying virtual line or packet level security policies, and to minimize changes to existing switches. Eliminating the need to use tags reduces the complexity of ATM firewall switch architectures.

The intrusion prevention function based on the conventional Internet Protocol (IP) is based on the router-based packet screen technique, and the inflow of unauthorized traffic from the network using the Transmission Control Protocol (TCP) / IP header information of the packet Blocked. However, when the router-based packet screening scheme is applied to an ATM network that performs 53-byte cell-based processing, segmentation and reassembly (SAR) is required to apply the screen rule, so that the ATM switch cell There was a problem of lowering the processing speed.

In order to solve this problem, the proposed cell screen scheme is based on the fact that the TCP / IP header information for the application of the screen rule is located in the first cell of the packet when the IP packet is divided into ATM cells. In this case, the security policy is determined by examining the first cell of the divided packet.

As a method of configuring an ATM firewall system based on the conventional cell screen technique, the switch intrudes through an independent ATM firewall system configuration method that applies a cell screen technique by extracting a cell stream from a physical line and changes to an existing ATM switch structure. There was a way to configure an ATM firewall switch that would enable blocking.

However, in the above-described ATM firewall system configuration, the classification of the signal cell, the management cell, and the user cell must be performed in the process of extracting the cell stream from the physical circuit, and the connection screen for the switched virtual connection (SVC) is performed. Since the performance of the function has to be performed after the cell separation process, it is difficult to guarantee scalability in an ATM network environment in which a large amount of traffic flows.

Here, the connection screen function refers to a screen function for processing the verification and authentication of the input data for the end-to-end call connection settings, and is used in the same meaning below.

On the other hand, the ATM firewall switch configuration proposed in recent years to solve the problem of the method is applied to the Cell Processing block of the input module in the switch is performed to distinguish between the signal cell, the management cell, and the user cell The switch structure is designed to perform the cell screen function through the modification.

Here, the cell screen function refers to processing the screen function of the cells at the time when the flow of data transmitted through the connection path of the user flows into the cell after the actual connection is made.

However, the ATM firewall switch configuration method also has a Call Admission Control (CAC) block that additionally performs a connection screen function in a network environment where a large number of switched virtual connections (SVCs) are created and destroyed. In the case of centralized configuration, it is difficult to guarantee scalability and there is still a problem that a cell delay may occur in the process of determining a security policy for a packet. In addition, the techniques applied to minimize such cell delay have a problem of increasing the complexity of the system in the implementation due to the excessive use of the tag inside the switch.

The present invention has been proposed to solve the above-mentioned problems of the prior art, and includes an asynchronous transmission mode firewall switch having a distributed call admission control structure and a parallel cell screen structure, a method thereof, and a program for realizing the method. Its purpose is to provide a computer-readable recording medium having recorded thereon.

In other words, by introducing a distributed Call Admission Control (CAC) unit, when the connection screen function is performed on a large network with a high frequency of Switched Virtual Connection (SVC), the bottleneck of connection establishment is alleviated. In other words, the cell screen of the parallel structure is used to minimize the delay of the cell processing time due to the application of the screen policy. In addition, the cell buffering function involved in the policy decision process is performed at the screened input unit, thereby minimizing the change to the existing switch and at the same time eliminating the need for the use of internal tags, thereby reducing the complexity of the ATM firewall switch structure.

1 is a block diagram of an embodiment of an ATM firewall switch according to the present invention.

2 is a detailed block diagram of an embodiment of a screened input unit in an ATM firewall switch according to the present invention;

3 is a flowchart illustrating an embodiment of a method for applying a security policy according to the present invention.

4 is a flowchart illustrating an embodiment of a method for applying a security policy at a virtual line level according to the present invention.

5 is a flowchart illustrating a method for applying a packet level security policy according to the present invention.

6 is a flowchart illustrating an embodiment of a method for processing a last cell of a packet when a packet level security policy is applied according to the present invention.

* Explanation of symbols for the main parts of the drawings

100: ATM firewall switch 101: distributed call acceptance control

102: screen input unit 103: system management unit

104: cell switching unit 105: output unit

200: signal cell filter 201: management cell filter

202: parallel cell screener 203: cell replication / load divider

204: User Cell Strainer 205: Header Converter

206: VP / VC Table 207: Security Policy Cache

208: security policy inspection unit 209: security policy storage unit

The present invention for achieving the above object, the signal connection in a distributed structure in an Asynchronous Transfer Mode (ATM) firewall switch device having a distributed call admission control (CAC) structure and a parallel cell screen structure Distributed call admission control (CAC) means for performing a screen function; Screened input means for applying the security policy using the parallel cell screen function to the cells flowing into the ATM firewall switch device to block the inflow of the divided cells from unauthorized packets; Device management means for controlling all functions of the ATM firewall switch device; Cell switching means for receiving a cell to which a security policy has been previously applied from the screened input unit and performing a switching operation; And output means for receiving a cell from the cell switching means and outputting the cell to the outside.

Meanwhile, the present invention provides a method for applying a security policy to an Asynchronous Transfer Mode (ATM) firewall switch device having a distributed call admission control (CAC) structure and a parallel cell screen structure. The incoming user cell is examined for the policy set at the virtual line level of the virtual path (VP) / virtual channel (VC) storage means to determine whether to apply a packet level security policy to the virtual line. A first step of making; When the packet level security policy check is set for the virtual circuit to which the security policy is applied, the security policy is determined by referring to the security policy temporary storage means. When there is no entry matching the security policy temporary storage means, the entire security policy is determined. A second step of determining a security policy by inspecting the policy information of the storage means; And when the last cell of the packet arrives in the state where the packet level security policy decision is not made, blocking the last cell from the user cell filtering means until the security policy decision is made to block the inflow of unauthorized packets. Characterized in that it comprises three steps.

On the other hand, the present invention is introduced into the Asynchronous Transfer Mode (ATM) firewall switch device having a distributed call admission control (CAC) structure and a parallel cell screen structure having a processor, the user cell filtering means Checking a policy set at the virtual line level of the virtual path (VP) / virtual channel (VC) storage means for the user cell, and determining whether to apply a packet level security policy to the virtual line. 1 function; When the packet level security policy check is set for the virtual circuit to which the security policy is applied, the security policy is determined by referring to the security policy temporary storage means. When there is no entry matching the security policy temporary storage means, the entire security policy is determined. A second function of determining a security policy by inspecting policy information of the storage means; And when the last cell of the packet arrives in the state where the packet level security policy decision is not made, blocking the last cell from the user cell filtering means until the security policy decision is made to block the inflow of unauthorized packets. A computer readable recording medium having recorded thereon a program for realizing the function is provided.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an ATM firewall switch according to an embodiment of the present invention, and as shown in a non-centralized diagram existing in the system management unit 103, to perform a signal connection screen function in a distributed structure. The cell screen function is added to the distributed call admission control unit (CAC) 101 and the conventional input unit to apply the security policy to the cells flowing into the cell switching unit 104 to introduce the divided cells from the unauthorized packets. And a screened input unit 102, a cell switching unit 104, and an output unit 105 for blocking the screen.

2 is a detailed block diagram of an embodiment of a screened input unit in an ATM firewall switch according to the present invention, wherein the screened input unit 102 is a signal cell among cells introduced into the screened input unit 102. Parallel cell screen to reduce cell processing time delay due to application of screen policy and management cell filter 201 for extracting the management cell from the cell that has passed through the signal cell filter 200 and the signal cell filter 200 for extraction Header converter 205 for adding switch information to the user cell that has passed through the device 202 and the parallel cell screener 202 and outputting the cell information to the cell switching unit 104, and the allocated VPI / VCI information and the virtual circuit. A VP / VC table 206 for storing policy information and a security policy cache 207 for reference for security policy decisions are included.

First, among the cells introduced into the screened input unit 102, the signal cells are extracted by the signal cell filter 200, and then transferred to the distributed call admission control unit (CAC) unit 101 by the connection screen function. It is determined whether a connection is established, and the licensed virtual circuit stores the allocated VPI / VCI information and policy information about the virtual circuit in the VP / VC table 206.

Thereafter, the cell passing through the signal cell filter 200 undergoes an extraction process for the management cell in the management cell filter 201, and the filtered management cells are transferred to the system manager 103. Cells that have passed through the management cell filter 201 are also delivered to the parallel cell screener 202.

Subsequently, the cell replication / load divider 203 in the parallel cell screener 202 receiving the user cell performs a function of replicating or distributing the incoming user cell to the parallelly arranged user cell filter 204. Which is optionally available.

Cell Duplicator 203 replicates the incoming user cells by the number of parallel user cell filters 204, and then delivers the duplicated user cells to each user cell filter 204. The cell filter 204 performs the filtering function only for the cell assigned to it with reference to the virtual path indicator (VPI) identifier, and does not process the remaining cells.

On the other hand, the load balancer 203 does not directly transfer the introduced cells to the user cell filter 204, but loads the cells currently being processed by each of the parallel cell user cell filters 204. The cell is output to the user cell filter 204 having the least load.

Thereafter, each of the parallel user cell filters 204 that received the cells from the cell replication / load distributor 203 performs a filtering operation on the incoming cells using the cell screen function.

The filtration operation will be described in more detail as follows.

First, the user cell filter 204 refers to the virtual path level security policy determined by the call admission control (CAC) unit 101 of the distributed structure with reference to the virtual path (VP) / virtual connection (VC) table 206. Check it.

In this case, when the virtual line level security policy requires packet level security policy determination, the user cell filter 204 checks the security policy for the cell with reference to the security policy cache 207 to determine the security policy. .

Here, if there is an entry that matches the security policy cache 207, the security policy is selected. If not, the security policy storage unit 209 transmits the header information including the cell to the security policy checker 208. Refer to the information to determine your security policy. The user cell filter 204 discards or forwards the user cell to the header converter 205 according to the security decision.

The user cell that has passed through the user cell filter 204 is added to switch information of each cell by the header converter 205 and transferred to the cell switching unit.

3 is a flowchart illustrating a method of applying a security policy according to the present invention.

First, when a user cell flows into the user cell filter 204, the VP / VC table 206 is examined to check the policy set at the virtual circuit level to pass all the cells flowing into the virtual circuit. It is determined whether to apply a packet-level security policy to (300).

Subsequently, if the packet level security policy check is set for the virtual circuit to which the security policy application is set, the security policy is determined by referring to the security policy cache 207, and if there is no entry matching the security policy cache 207 In operation 301, the security policy is determined by inspecting the policy information of the entire security policy storage unit 209.

On the other hand, when the last cell of the packet arrives in the state where the packet level security policy is not made, the inflow of unauthorized packet is prevented by not passing the last cell in the user cell filter until the security policy decision is made. Block 302.

4 is a flowchart illustrating a method of applying a security policy of a virtual line level according to the present invention.

First, referring to the security policy information recorded in the VP / VC table 206 corresponding to the virtual circuit to which connection is allowed, as a result of the connection screen function performed by the distributed rock control unit (CAC) unit 101 during connection establishment. Check the virtual line level security policy (400).

Subsequently, it is determined whether or not the security policy of the virtual line level (401), when the virtual line level security policy recorded in the VP / VC table 206 is set to "pass", the cells having the same VPI / VCI number All cells are forwarded to the header translator 205 for 402, and if the virtual line level security policy is set to " apply, " the packet level security policy is applied.

5 is a flowchart illustrating a method of applying a packet level security policy according to the present invention.

First, the security policy on the VP / VC table 206 is checked for the packet including the cell introduced into the user cell filter 204 (500).

Here, if the packet-level security policy is set to "pass", the cell is transmitted to the header converter 205 (515), and if the packet-level security policy is set to "blocking", cell inflow is blocked. (514).

On the other hand, if the packet-level security policy is set to "IP_Option", after storing the cell in the buffer (512), and attempts to determine the security policy with the header information extracted from the first cell, packet-level security Set the policy to "Apply" (513). In this case, when the security policy is set to "IP_Option", it means that the packet is checked using the "IP Option" field by checking the first cell of the packet.

On the other hand, if the security policy is set to "policy undecided," it immediately goes through the last cell processing of the packet. This is described in more detail with reference to FIG. 6.

On the other hand, if the security policy is set to "Apply", it is first checked whether the packet using the "IP_ Option" field (502). Here, the security policy set to "apply" means that the first cell of the packet has arrived.

As a result of the check, in case of the packet using the "IP_Option" field, the cell is copied to the buffer (516), the cell is transferred to the header converter 205 (517), and the security policy is changed to "IP_Option". (518).

On the other hand, in the case of the packet does not use the "IP_Option", the security policy cache 207 is checked to determine the security policy (504). If the security policy of the packet exists in the entry of the security policy cache 207, the cell is processed (506) according to the security policy set on the security policy cache 207. Here, if the security policy on the security policy cache 207 is "pass", the cell is forwarded to the header converter 205 (508), and the packet-level security policy is set to "pass" (509). On the other hand, if the security policy on the security policy cache 207 is set to "block", cell inflow is blocked (510), and the packet-level security policy is set to "block" (511).

On the other hand, if there is no entry in the security policy cache 207, the security policy checker 208 requests a policy decision (519), and changes the packet level security policy to "policy undecided" ( 520).

6 is a flowchart illustrating an embodiment of a method for processing a last cell of a packet when a packet level security policy is applied according to the present invention.

As shown in FIG. 5, a packet subjected to a packet level security policy is inspected by the user cell filter 204 to determine whether the cell is the last cell of the packet (600).

Here, if the cell is the last cell of the packet, it is checked whether the security policy of the packet is in the "policy undecided" state (602), and if the cell is the last cell belonging to the packet of the "policy undecided" state, the security policy has not yet been determined. The last cell is stored in a buffer to block the ingress of unsolicited packets (604). After processing the last cell in this manner, the security policy is initialized to "Apply" for processing the next packet (605).

On the other hand, even if the cell is not the last cell of the packet it is checked whether or not the packet cell of the "policy undecided" state (606). This is because the checking of the last cell of the cells of the "policy undecided" packet is performed in this step.

In the case of the cell of the policy undecided packet, the cell is forwarded to the header converter 205 (608), and the processing for the cell is terminated.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention reduces the performance of an ATM switch generated by applying a router-based packet screen technology, which has been used for the intrusion prevention function in a conventional IP network, to a cell screen technique. There is an effect to minimize the, and improve the cell processing efficiency.

That is, by configuring the CAC performing the connection screen function in a distributed structure, scalability can be secured in a large network, and by introducing a cell screen unit arranged in parallel, an ATM firewall switch can be caused by performing the cell screen function. This has the effect of reducing the cell processing delay.

Claims (13)

In the asynchronous transfer mode (ATM) firewall switch device, Distributed call admission control (CAC) means for performing a signaling screen function in a distributed structure; Screened input means for applying the security policy using the parallel cell screen function to the cells flowing into the ATM firewall switch device to block the inflow of the divided cells from unauthorized packets; Device management means for controlling all functions of the ATM firewall switch device; Cell switching means for receiving a cell to which a security policy has been previously applied from the screened input unit and performing a switching operation; And Output means for receiving a cell from the cell switching means and outputting the cell to the outside; An asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 1, The screened input means, Signal cell filtration means for extracting signal cells from cells introduced into the screened input means; Management cell filtering means for extracting a management cell from the cells output from the signal cell filtering means; Parallel cell screen means for reducing cell processing time delay caused by application of a screen policy by using a user cell filter disposed in parallel with a cell received from the management cell filtering means; And Header conversion means for adding switch information to a user cell received through the parallel cell screen means and outputting the switch information to a cell switching means; VP / VC storage means for storing virtual path (VP) / virtual channel (VC) information and policy information for the virtual circuit; And Temporary storage of security policy for reference for security policy decision An asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 2, The parallel cell screen means, Cell copying means for replicating the user cells introduced into the parallel cell screening means by the number of parallelly arranged user cell filtering means and transferring them to each user cell filter; Load distributing means for calculating the load on the cell currently being processed by the parallel cell screen filtering means and transmitting the user cell introduced into the parallel cell screen means to the user cell filtering means having the least load; And User cell filtering means for receiving the cell from the cell replication means or the load distribution means arranged in parallel to perform the filtration operation on the cell using a cell screen function An asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 3, wherein The cell replication means and the load distribution means, An asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure, characterized in that it is optionally usable. The method according to claim 3 or 4, The user cell filtering means, Distributed call admission control structure, characterized in that the user cell is received from the cell replication means and performs filtering function only on the assigned cell by referring to a virtual path indicator (VPI) and does not process the remaining cells. Asynchronous transmission mode firewall switch device having a parallel cell screen structure. Asynchronous Transfer Mode (ATM) In the security policy application method of the firewall switch device, For the user cell flowing into the user cell filtering means, the policy set at the virtual line level of the Virtual Path (VP) / Virtual Channel (VC) storage means is examined, and a packet level security policy is applied to the virtual line. A first step of determining whether to do so; When the packet level security policy check is set for the virtual circuit to which the security policy is applied, the security policy is determined by referring to the security policy temporary storage means. When there is no entry matching the security policy temporary storage means, the entire security policy is determined. A second step of determining a security policy by inspecting the policy information of the storage means; And In a state in which the packet level security policy is not determined, when the last cell of the packet arrives, the third cell is blocked by the user cell filtering means until the security policy decision is made to block the inflow of unauthorized packets step Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 6, The first step is, As a result of the connection screen function performed by Call Admission Control (CAC) means at the time of connection establishment, a virtual path (VP) / virtual channel (VC) corresponding to a virtual circuit to which connection is allowed is performed. A fourth step of determining whether a security policy at the virtual line level is referred to by referring to the security policy information recorded in the storage means; As a result of the determination in the fourth step, when the virtual line level security policy recorded in the VP / VC storage means is set to "pass", the same virtual path indicator (VPI) / virtual channel indicator (VPI) A fifth step of delivering all cells having a Virtual Channel Indicator (VCI) number to header conversion means; And A sixth step of applying a packet level security policy when the virtual line level security policy is set to "apply" as a result of the determination in the fourth step; Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method according to claim 6 or 7, The second step, Determining a security policy recorded in the VP / VC storage means for the packet including the cell introduced into the user cell filtering means; An eighth step of delivering the cell to the converting means when the packet level security policy is set to "pass" as a result of the determination in the seventh step; A ninth step of blocking inflow of a corresponding cell when the packet-level security policy is set to "blocking" as a result of the determination in the seventh step; A tenth step of determining whether the packet is the last cell when the packet-level security policy is set to "policy undecided" as a result of the determination in the seventh step; An eleventh step of copying a cell to a buffer and setting the packet level security policy to "apply" when the packet level security policy is set to "IP_Option" as a result of the determination in the seventh step; A twelfth step of determining whether to use the “IP_Option” when the packet level security policy is set to “apply” as a result of the determination in the seventh step; As a result of the determination in the twelfth step, in the case of using “IP_Option”, a thirteenth step of performing a cell processing corresponding thereto; And As a result of the determination in the twelfth step, when the "IP_Option" is not used or the security policy is set to "apply" in the eleventh step, the fourteenth step of referring to the policy information of the security policy temporary storage means Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 8, The thirteenth step, A fifteenth step of storing the first cell of the packet in a buffer; A sixteenth step of delivering the cell to header conversion means; And Step 17 of setting the packet level security policy to "IP_Option" Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 8, The fourteenth step, A fifteenth step of determining whether an entry exists in the policy information of the security policy temporary storage means; A sixteenth step of transmitting a policy decision request signal to the security policy checking means when it is determined that there is no existence, and setting the packet level security policy to "policy undecided"; And A 17th step of processing the cell according to the policy information of the security policy temporary storage means when it is determined that there exists the determination result in the 15th step Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 10, The seventeenth step, An eighteenth step of inspecting policy information of the security policy temporary storage means; A nineteenth step of transmitting the cell to the header converting means when the check result of the eighteenth step is set to "pass", and setting a packet level security policy to "pass"; And As a result of the inspection in the eighteenth step, in the case of being set to "blocking", the inflow of the cell is blocked, and the 20th step of setting a packet-level security policy to "blocking" Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. The method of claim 6, The third step, A fourth step of checking whether the packet is the last cell of the packet; A fifth step of checking again whether a policy undecided packet is found if it is not the last cell as a result of the check in the fourth step; A sixth step of transmitting the cell to a header converting means if it is a policy undecided packet as a result of the check in the fifth step; A seventh step of re-checking whether or not a policy is undecided packet in the case of the last cell as a result of the check in the fourth step; An eighth step of initializing the security policy of the packet to "apply" after storing the last cell in a buffer as a result of the check in the seventh step; And A ninth step of initializing the security policy of the packet to "apply" without storing the last cell in a buffer if it is not a policy undecided packet as a result of the check in the seventh step Security policy application method of asynchronous transmission mode firewall switch device having a distributed call admission control structure and a parallel cell screen structure. In an Asynchronous Transfer Mode (ATM) firewall switch device having a distributed call admission control (CAC) structure having a processor and a parallel cell screen structure, For the user cell flowing into the user cell filtering means, the policy set at the virtual line level of the Virtual Path (VP) / Virtual Channel (VC) storage means is examined, and a packet level security policy is applied to the virtual line. A first function of determining whether to do so; When the packet level security policy check is set for the virtual circuit to which the security policy is applied, the security policy is determined by referring to the security policy temporary storage means. When there is no entry matching the security policy temporary storage means, the entire security policy is determined. A second function of determining a security policy by inspecting policy information of the storage means; And In a state in which the packet level security policy is not determined, when the last cell of the packet arrives, the third cell is blocked by the user cell filtering means until the security policy decision is made to block the inflow of unauthorized packets function A computer-readable recording medium having recorded thereon a program for realizing this.