KR20070024957A - Apparatus and method for packet filtering - Google Patents

Abstract

An apparatus and a method for intercepting packets are provided to carry out packet processing, such as packet interception, under an IPv6 network environment just as a network manager intended, even though the address of a node within an internal network, a state of the node or an address prefix is changed. An apparatus for intercepting packets comprises a network address management part(210), a host address management part(220), a receiving part(230), an updating part(240), and a packet processing part(250). The network address management part(210) intercepts and manages the packets supplied to an internal network from an external network. The host address management part(220) intercepts or manages packets in transmitting packets to a host from an external network. The receiving part(230), in case a network address is changed into the IP address of a host in an internal network or a network prefix is changed, receives an IP address change notification or a network prefix change notification. The updating part(240) updates the network address management part(210) and the host address management part(220) when the receiving part(230) receives the IP address change notification or the network prefix change notification. In transmitting packets to an internal network from an external network, the packet processing part(250) intercepts packets if the validity of the network prefix expired. However, in case the network prefix is valid, the packet processing part(250) transmits packets on the basis of the updated network address management part(210).

Description

Apparatus and method for packet filtering

1 is a diagram illustrating a next-generation Internet protocol network environment as an embodiment of the present invention.

2 shows an internal configuration diagram of a packet blocking device.

3 shows a network address management unit.

4 shows a host address manager.

5 is a flowchart illustrating a packet processing method when a prefix of a network is changed.

6 is a flowchart illustrating a packet processing method when an address of a host is changed.

7 shows an exemplary embodiment in which an IPv6 address is changed and added.

8 illustrates a preferred embodiment in which a network prefix address is changed and added.

The present invention relates to an apparatus and method for blocking a packet in a next generation Internet protocol network environment.

In the IPv4 network environment, each host is assigned a single address and the assigned address remains static. Therefore, if a packet is to be blocked, a single block that does not change is blocked.

However, in the case of next-generation Internet protocols, such as IPv6, each host can be assigned a plurality of addresses, and the address can be changed dynamically.

In other words, in the case of IPv6 network environment, unlike the conventional IPv4 network environment, each host can be assigned an address from the outside through stateful address autoconfiguration (eg DHCP), Stateless Address Autoconfiguration allows you to create your own address automatically, have multiple addresses instead of one, and dynamically change to another address. Not only the address of the host part but also the prefix part of the network address can be changed dynamically, so the entire address of the network can be changed.

Therefore, the conventional packet blocking technology is difficult to apply the same under the next generation Internet protocol network environment.

In order to solve the above problems, the present invention is to provide an apparatus and method for blocking packets in the host and the internal network intended by the network administrator even in the next generation Internet protocol network environment.

In one preferred embodiment of the present invention, a packet blocking apparatus includes a network address management unit including a network ID for identifying an internal network, a network prefix, and a validity period of the network prefix; A host address management unit including a unique identification ID, an IP address, and an expiration date of the IP address that physically identify the host; A receiver configured to receive a change notification of the network prefix or a change notification of the IP address; An address update unit for updating the network address management unit and the host address management unit, respectively, when the reception unit receives the network prefix change notification or the IP address change notification; and an arbitrary packet when transmitting a packet from an external network to an internal network. Apply a packet blocking rule that sets whether to block a network based on the network ID and the network prefix during the validity period of the network prefix, and applies the packet blocking rule to the host when transmitting a packet from an internal network to a host. And a packet processing unit applied based on the unique identification ID and the IP address.

In a preferred embodiment of the present invention, in the packet blocking device, the receiving unit receives a notification of a change in the network prefix and the IP address from the host having changed the network prefix or the IP address.

In addition, as a preferred embodiment of the present invention, in the packet blocking device, the receiving unit detects a host whose IP address is changed by a neighbor node detection technique (Neighbor Discovery) for checking whether a host having the same IP address exists in the network. Receive the IP address change notification.

In addition, as a preferred embodiment of the present invention, in the packet blocking device, the receiving unit detects whether the neighbor node detection scheme has the same address as the address of the host created in the network and the previous address check (DAD) and the previous router. Peripheral Node Reach check (NUD) is included to determine whether or not to reach.

As another embodiment of the present invention, a packet blocking method includes receiving a notification of a change in network prefix or a notification of a change in IP address; A unique identification ID for updating a validity period of a network ID, a network prefix, and a network prefix for distinguishing an internal network based on the received network prefix change notification, and for physically distinguishing a host based on the received notification of the change of the IP address. Updating the validity period of the IP address, the IP address; Applying a packet blocking rule that sets whether to block an arbitrary packet based on the network ID and the network prefix during the validity period of the network prefix when transmitting a packet from an external network to an internal network; And applying the packet blocking rule based on the unique identification ID and the IP address during the validity period of the IP address when transmitting a packet from the internal network to the host.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. It should be noted that the same elements in the figures are represented by the same reference numerals and symbols as much as possible even though they are shown in different figures. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a diagram illustrating a next-generation Internet protocol network environment as an embodiment of the present invention.

Packet blocking device 110 from the external network 110 to the internal network 120, or in the internal network When sending a packet to the host, the packet is inspected in the middle to determine whether to block the packet according to the packet blocking rule set by the network administrator.

In the internal network 120, there is an internal network router 130 that is a boundary of another link or site, and each internal network host 140. When the state-based address setting is used, a server that automatically performs state-based address assignment An operating host 150 (hereinafter referred to as a DHCP server) may be operated, and a DNS server 160 that manages a domain name on a network may be operated for a DNS (Domain Name System) service.

Although only one internal network is illustrated in FIG. 1, it should be noted that the packet blocking apparatus 110 may manage a plurality of internal networks.

2 shows an internal configuration diagram of a packet blocking device 200.

The packet blocking device 200 is a packet blocking device that blocks the reception of a packet having an arbitrary address, and the network manager tracks and reflects the address change even when the first address assigned to the host is changed, thereby allowing the network manager to operate in the next generation Internet protocol network environment. (Eg IPv6 network environment) It can flexibly cope with the dynamic change of address.

The packet blocking device 200 includes a network address manager 210, a host address manager 220, a receiver 230, an updater 240, and a packet processor 250.

The network address management unit 210 is composed of a network ID for identifying an internal network, a network prefix, and a valid period of a network prefix, and blocks and manages packets coming into the internal network from the external network. A more detailed description thereof will be made with reference to FIG. 3.

The host address manager 220 includes a unique identification ID, an IP address, and an expiration date of an IP address that physically distinguish a host, and blocks or manages a packet when transmitting a packet from an internal network to a host. A more detailed description thereof will be made with reference to FIG. 4.

The receiving unit 230 receives a notification of a change in IP address and / or a change in network prefix when the IP address of a host in the internal network is changed or the network prefix is changed.

In a next generation internet protocol network, for example, an IPv6 network, a plurality of IP addresses may be assigned to one host, and the IPv6 address assigned to the host may be dynamically changed.

In this case, the receiving unit 230 directly receives the notification of the change of the network prefix and the IP address from the host having changed the network prefix or the IP address, or the host having changed the network prefix or the IP address has an address to another host. You can be notified of changes and receive notification of changes in network prefixes and IP addresses sent by other hosts.

In addition, the receiver 230 may receive the IP address change notification from a host that detects a host whose IP address has been changed by a neighbor discovery method that checks whether a host having the same IP address exists in the network. .

In the detection method of the neighbor node, the host attempting to change the IP address transmits an unsolicited neighbor advertisement (u-NA) message to notify other hosts and routers of the same network that their address has been changed.

Because u-NA messages are sent to all-nodes multicast addresses, both routers and hosts on the same network can listen to u-NA messages.

In addition to the new address information, the sender sets the O-flag on the u-NA message (Override Flag) to update the existing self information with new information.

Peripheral node detection also uses address redundancy check (DAD) and neighbor node arrival check (NUD).

Duplicate Address Detection checks whether the same address as that of the host created in the network exists. The duplicate address detection is performed by the following procedure.

a) Newly connected UE sends N Neighbor Solicitation (NS) message to the network to check whether the generated Link Local address is used in the same network after creating and assigning the Link Local address. .

b) If another terminal is using the same address, it transmits a Neighbor Advertisement (NA) message saying that the terminal using the address should not be used because it is already used by all the systems in the network.

c) If the new terminal does not receive the NS message for a certain time, the new terminal uses the generated Link Local address.

d) If the terminal sending the NS message confirms that the link local address generated by the NS message is duplicated with other terminals, the link local address is not assigned to the network interface.

The NS (Neighbor Solicitation) message mentioned above is a message generated by the host to use as its own address and forwarded to those systems, including the address within the link that the address will use to verify that the systems in the link are in use. to be.

In addition, NA (Neighbor Advertisement) message is a message sent to all systems in the link, meaning that the system that received the NS message is not used because the address included in the NS message is already in use. to be. That is, if the system that sent the NS message receives the NA message within a certain time, the address created for use should not be assigned to the system.

Neighbor Unreachability Detection (NUD), which is used in the neighbor node detection technique, is a test to check whether hosts and routers on the same network are alive.

Peripheral node reach check (NUD) is performed in two ways. One method is to determine whether or not to reach the target by checking whether the communication with the target host and the router has been continuously performed.

Another method is to artificially send a message to receive a response from the target host and the router, and then determine whether the response has been reached. In this case, a unicast neighbor solicitation (u-NS) message is used as a message sent to the target host and the router.

Send a u-NS message to the unicast address of the destination host and router to receive the message alone, and set the S-flag (Solicited Flag) in the u-NS message to respond to it. Check whether or not to set so that the received NA message is a response to the u-NS message requested by the user.

In addition, the receiver 230 may receive the IP address change notification from a host that detects a host whose IP address has been changed through a query to a DHCP server or a DNS server.

It should be noted that the above-described method for receiving the notification of change of network prefix and IP address in the reception unit 230 is a preferred embodiment of the present invention, and is not limited to the above-described method. It should be noted that all ranges including the same idea or easily substituted are included.

The updater 240 updates the network address manager and the host address manager, respectively, when the receiver 230 receives a network prefix change notification and / or an IP address change notification.

In addition, the updater 240 adds or deletes the network prefix or the IP address to the network address manager and the host address manager, respectively, according to the change notification, and the network prefix validity period or the IP address validity, respectively. Change the period.

For example, when the receiving unit 230 receives the notification of changing the IPv6 address of the host, when the IPv6 address of the host is already deleted, the validity period of the IPv6 address is updated to 0, and the IPv6 address of the host is predetermined. If it is deleted after the elapse of time, set the remaining time as the validity period of the IPv6 address.

When the validity period of the IPv6 address elapses, the updater 240 deletes the IPv6 address from the network address manager and / or the host address manager.

When the packet processing unit 250 transmits the packet from the external network to the internal network, if the validity period of the network prefix has not elapsed, the packet processing unit 250 transmits the packet based on the updated network address management unit, and the validity period of the network prefix has elapsed. If it blocks the packet reception.

In addition, when the packet is transmitted from the internal network to the host, the packet is transmitted based on the updated host address manager if the valid period of the IP address has not elapsed, and the packet is blocked if the valid period of the IP address has elapsed. do.

The packet in the packet processing unit 250 may be processed according to a packet processing command arbitrarily set by the network administrator.

When the packet to be transmitted from the external network to the internal network is to be processed, for example, the network manager may transmit the packet processing unit 250 to the packet processing unit 250 in the same manner as "if (Net_out-> Net_in) then (allow): user setting command 1". By arbitrarily setting a command, when the validity period of the network prefix of Net_in has elapsed, the packet processing unit 250 no longer is affected by the user setting command 1 when the validity period of the Net_in has elapsed ( In this case, note that it may be affected by other user-configured packet blocking commands). Only when the validity period of the prefix has not elapsed, the packet is transmitted by the packet blocking command such as the user setting command 1.

Similarly, when a packet to be transmitted from the external network to the host is to be processed, for example, the network manager may arbitrarily change the packet processing unit 250 in a manner such as "if (Net_out-> Host 1) then (command)". A command can be set and a packet processing method corresponding to the set command can be set.

3 shows a network address management unit.

The network address manager 300 includes a network ID 310 for distinguishing an internal network, a network prefix 320, and an expiration date 330 of the network prefix.

Network ID 310 is a unique number or string assigned to each internal network to distinguish it from other internal networks. In the present invention, the packet blocking rule is used as a network name. This can be assigned explicitly by the network administrator or created arbitrarily.

Each network ID 310 may have a number of network prefixes 320. In addition, when the packet blocking rule is set in units of the individual network prefix 320, the network address management unit 300 may be configured with the network prefix 320 and the validity period 330 of the network prefix 320 without using the network ID 310. Can be configured.

The network prefix 320 is a portion of an address indicating a bit with a fixed value or the number of bits of a network IP, which includes a prefix of IPv6.

The validity period 330 of the network prefix refers to the validity period of the network prefix 320, and each network prefix 320 has a respective network prefix validity period, and when the designated validity period has elapsed, the network address management unit 300. Delete the corresponding network prefix (320).

4 shows a host address manager.

The host address manager 400 includes a unique identification ID 410 that physically distinguishes a host, an IP address 420, and an expiration date 430 of an IP address.

The unique identification ID 410 is a unique number or string assigned to each host to physically distinguish the host from other hosts in the internal network in one internal network. use. It can be assigned explicitly by the administrator, created arbitrarily, or can use information within the host (eg MAC address, hostname).

The IP address 420 is an Internet protocol address used by each unique identification ID 410, and one unique identification ID 410 may have one or more IP addresses 420.

The validity period 430 of the IP address indicates how long each IP address 420 is valid, and when the specified validity period elapses, the corresponding IP address 420 is deleted from the host address management unit.

A preferred embodiment of the case where the IPv6 address is changed or added will be described with reference to FIG. 7.

5 is a flowchart illustrating a packet processing method when a prefix of a network is changed.

When the prefix is added, deleted, or changed, the host and / or router that recognizes the change of the prefix notifies the packet blocking device of the addition, deletion, and change of the prefix. At this time, the host and / or router that has recognized the change of the prefix informs the packet blocking device of the validity period of the network prefix.

The packet blocking device notified of the change of the network prefix from the host and / or the router updates the network address management unit 210 through the update unit (see FIG. 2) based on the contents of the notification, and the packet is based on the updated network address management unit. To process.

In more detail, the addition, deletion, and change of a prefix is recognized by the host by the router forwarding a Router Advertisement (RA) message to the subnet to which the prefix is applied.

The RA message contains all prefix information used in the network. Since each prefix information includes a prefix and a validity period, a host receiving an RA message can recognize all prefixes and validity information of its own network.

When prefixes are added, deleted, and changed, the router sends the prefix information to be updated in the RA message so that the host can compare the prefix information it has and recognize the difference so that the prefix information can be updated.

A preferred embodiment of the case where the network prefix address is changed or added will be described in more detail with reference to FIG. 8.

6 is a flowchart illustrating a packet processing method when an address of a host is changed.

In one preferred embodiment of the present invention, one host may have a plurality of IPv6 addresses in an IPv6 network environment, and an IPv6 address may be dynamically changed.

As a method of detecting a case where a node's address is changed in one host, the peripheral node is configured to perform address duplicate detection (DAD) and neighbor unreachability (NUD), which are used in neighbor discovery (Neighbor Discovery). Detection is available. In addition, you can query the DHCP server or DNS server to obtain the address list of the host to recognize the change, or the node to change the address can directly notify the packet blocking device that its address has changed.

After receiving the address change notification of the host, the receiver 230 of the packet blocking apparatus updates the host address manager 220 through the updater 240 and processes the packet based on the updated host address manager 220. do.

7 shows an exemplary embodiment in which an IPv6 address is changed and added.

The initial host address management unit 400 is 'NODE_ID # 1' as a unique identification ID 410 that physically distinguishes the host, 'Address 1' as the IP address 420, and '20 as the validity period 430 of the IP address. Minute 'is allocated.

In this case, when the administrator arbitrarily sets a packet blocking rule such as "if (external network-> NODE_ID # 1) then (blocking)" to operate the packet blocking device, the host address management unit 400 assigns to NODE_ID # 1. Since the corresponding address is only 'address 1', the packet is blocked when the destination address of the packet is 'address 1'.

After that, a new entry with a new IPv6 address 'Address 2' and a validity period of "60 minutes" was added to 'NODE_ID # 1'. When the entry is added in this way, since the address corresponding to NODE_ID # 1 in the host address management unit 400 is not only 'address 1' but also 'address 2', the destination address of the packet is not only 'address 1'. Even if the address is '2', the packet is blocked.

After 20 minutes have elapsed since adding the new IP address 420, the validity period of "Address 1" is "20 minutes" is "0", and the validity period of "Address 2" is "40 minutes" is "40 minutes". do.

The IPv6 address of the entry whose validity period is "0" is no longer used. After that, only IPv2 address of NODE_ID # 1 is used as a valid address.

That is, since the validity period of 'address 1' is '0', 'address 1' is no longer an address belonging to NODE_ID # 1. Therefore, the packet destined for 'address 1' is no longer affected by the packet blocking command "if (external network-> NODE_ID # 1) then (block)".

8 illustrates a preferred embodiment in which a network prefix address is changed and added.

The initial network address manager 300 assigns' NID # 1 'to the network ID 310 identifying the internal network,' Prefix1 'as the network prefix 320, and '10 minutes' as the validity period 330 of the network prefix. It is. In this case, when the administrator sets a packet blocking rule of "if (external network-> NID # 1) then (block)" to perform a packet blocking operation, the network address management unit 300 corresponds to 'NID # 1'. Only packets with 'Prefix1' as the prefix of the destination address are blocked by the above packet blocking command.

Subsequently, when an entry of a new network prefix 'Prefix2' and a validity period '40 minutes' is added, the network ID 'NID # 1' further includes the network prefix 320 'Prefix 2' in addition to 'Prefix1'. do.

As a result, a packet whose network prefix of the destination address is 'Prefix2' is also blocked by the packet blocking rule "if (external network-> NID # 1) then (blocking)".

After 10 minutes, the initial network prefix 'Prefix1' has a validity period of '10 minutes' and '0' and the validity period of 'Prefix2' '40 minutes' becomes '30 minutes'.

The network prefix of entries whose validity period is '0' is no longer used. After that, only the prefix address of NID # 1 is 'Prefix2'.

Therefore, since 'Prefix 1' is no longer a network prefix belonging to the network ID of 'NID # 1', packets with a network prefix of 'Prefix1' of the destination address are no longer "if (external-> NID # 1). ) is not affected by the then "block" command.

 In the present invention, even in a next-generation Internet protocol network environment, a packet may be blocked in a host and an internal network intended by a network administrator.

In addition, according to the packet blocking apparatus and method according to the present invention, even if the address change, node state change, or address prefix change of a node of an internal network in a next-generation Internet protocol network environment, a packet such as packet blocking as originally intended by the network administrator Processing is possible. In other words, even if the address of the node changes, by tracking and reflecting the address change, the effect that can be continuously controlled occurs.

In addition, it reflects the case where the network prefix is changed, and as with the case where the host's IP address is changed, the effect of continuous packet processing is generated, and thus, it is possible to flexibly cope with dynamic changes under the next generation Internet protocol network environment. .

Claims (12)

A network address management unit including a network ID for identifying an internal network, a network prefix, and a validity period of the network prefix; A host address management unit including a unique identification ID, an IP address, and an expiration date of the IP address that physically identify the host; A receiver configured to receive a change notification of the network prefix or a change notification of the IP address; An address update unit for updating the network address manager and the host address manager, respectively, when the receiver receives the network prefix change notification or the IP address change notification; and When transmitting a packet from an external network to an internal network, apply a packet blocking rule that sets whether to block an arbitrary packet based on the network ID and the network prefix during the validity period of the network prefix, and transmits the packet from the internal network to the host. And a packet processing unit which applies the packet blocking rule based on the unique identification ID and the IP address during the validity period of the IP address. The method of claim 1, wherein the receiving unit And a notification of the change of the network prefix and the IP address from the network prefix or the host which changed the IP address. The method of claim 1, wherein the receiving unit And receiving the IP address change notification from a host that detects a host whose IP address has been changed by neighbor discovery (Neighbor Discovery) for checking whether a host having the same IP address exists in a network. The method of claim 3, wherein The peripheral node detection scheme includes an address duplication check (DAD) for checking whether an address identical to the address of a host generated in the network exists and a neighbor node arrival check (NUD) for checking whether a previous router has been reached. Packet blocking device. The method of claim 1, wherein the receiving unit And receiving the IP address change notification from a host that detects a host whose IP address has been changed by querying a DHCP server or a DNS server. The method of claim 1, wherein the address update unit When the receiving unit receives the network prefix change notification or the IP address change notification, respectively, the network prefix or the IP address is added or deleted according to the change notification contents, respectively, And the network prefix validity period or the IP address validity period. Receiving a change notification of a network prefix or a change notification of the IP address; A unique identification ID for updating a validity period of a network ID, a network prefix, and a network prefix for distinguishing an internal network based on the received network prefix change notification, and for physically distinguishing a host based on the received notification of the change of the IP address. Updating the validity period of the IP address, the IP address; Applying a packet blocking rule that sets whether to block an arbitrary packet based on the network ID and the network prefix during the validity period of the network prefix when transmitting a packet from an external network to an internal network; And Applying the packet blocking rule based on the unique identification ID and the IP address during the validity period of the IP address when transmitting a packet from an internal network to a host. 8. The method of claim 7, wherein the receiving step And receiving a notification of a change in the network prefix and the IP address from the host having changed the network prefix or the IP address. The method of claim 7, wherein the receiving step And receiving the IP address change notification from a host that detects a host whose IP address has been changed by a peripheral node detection technique for checking whether a host having the same IP address exists in a network. The method of claim 9, The peripheral node detection scheme includes an address duplication check (DAD) for checking whether an address identical to the address of a host generated in the network exists and a neighbor node arrival check (NUD) for checking whether a previous router has been reached. Packet blocking method. The method of claim 7, wherein the receiving step And receiving the IP address change notification from a host that detects a host whose IP address has been changed by querying a DHCP server or a DNS server. 8. The method of claim 7, wherein the address update step is When the network prefix change notification or the IP address change notification is received, the network prefix or the IP address is added or deleted according to the change notification contents, and the network prefix validity period or the IP address validity period is changed. Packet blocking method characterized in that.

Images