KR20110060534A - Apparatus and method for session management - Google Patents

Abstract

PURPOSE: A session management method is provided to secure wire-speed in session tracking and managing even on a Giga network having higher complexity. CONSTITUTION: A management unit(500) constitutes the entry of a single packet and a plurality of fraction packets in a session table(300) and a fragment table(400). The session table comprises an entry composed for the status information of a packet for session connection and session close and a single packet which is not fragmented. The fragment table comprises entries composed for the status information of 1 to N fragment packets.

Description

Apparatus and Method for Session Management}

The present invention relates to session management, and more particularly, to a session management method capable of managing a session of a fragmented and transmitted packet.

The present invention is derived from a study conducted as part of the Ministry of Knowledge Economy's technology innovation project [Task Management No .: 2009-S-038-01, Task name: Distributed service rejection (DDoS) attack development technology development].

In general, when the size of an IP datagram to be transmitted is larger than the maximum transmission unit (MTU) of the link layer, the IP layer is fragmented into a plurality of TCP segments through a fragmentation operation as shown in FIG. 1. By transmitting, IP datagrams can be recognized by heterogeneous destination systems with different maximum transmission units.

The destination system may reconstruct the IP datagram by reassembling the TCP segment using information of the identification, flags, and fragment offset fields of the IP header among the IP header and the TCP header configured as shown in FIG. 2.

That is, the Identification field is a 16-bit field and is called an "IP Identification Number". It contains a unique value for each IP datagram and is used as an identifier in the fragmentation process of fragment packets.

In addition, the Flags field is a 3-bit field, and is composed of <Reserved, Don't Fragment, More Fragments>, and the "More Fragments" bit indicates that there are more fragment packets, and for other fragment packets except the last fragment packet. Is set. And, the "Don't Fragments" bit indicates no fragmentation, and indicates that the IP datagram is not fragmented.

Finally, the Fragment Offset field indicates to which position the fragment packet is offset (from 8 bytes) from the beginning of the original datagram.

Conventional security equipment tracks sessions using the source header and destination port of the TCP header, as well as the protocol, source address, and destination address of the IP header. And management.

However, as shown in FIG. 1, since the second to fourth fragment packets other than the first fragment packet do not include a TCP header, it is difficult to measure traffic, so that when there are many fragment packets, less fragments are measured than actual traffic. There is this.

In addition, there is a serious problem that fragment packets are not inspected by network security equipment, and thus are likely to be used as a means of bypass intrusion by hackers.

In order to solve the above problems, an object of the present invention is to provide a session management method that can manage session state information of fragmented packets and non-fragmented packets, respectively.

According to an aspect of the present invention, there is provided a session management method, including receiving a first fragment packet including a TCP header and an IP header according to a TCP session connection, determining a session state and a direction including the first fragment packet; Determining a first address using information of the TCP header and the IP header, constructing an entry of the first address, and storing the entry with the session state and directivity; When the second to N-th fragment packets including the IP header are received, determining the session state and the direction by using information of the IP header; And determining the second to Nth addresses by using the information of the IP header, and constructing an entry of the second to Nth addresses and storing the second to Nth addresses together with the session state and the directionality. If the fragment packet is the last packet of the fragmented packet, the entries of the configured second to Nth addresses are deleted.

According to the present invention, since the session state information is tracked using a table based on hardware, there is an effect of guaranteeing the speed (Wire-Speed) in session tracking and management even on a high-value network of high complexity.

The present invention manages fragmented packets and non-fragmented packets in separate tables to search for bypass attacks due to fragmented packets as well as unfragmented packets.

Hereinafter, a communication mechanism of a client and a server according to an embodiment of the present invention will be described with reference to FIG. 3. 3 is a flowchart illustrating a communication mechanism of a client and a server according to an embodiment of the present invention.

As shown in FIG. 3, the client 100 and the server 200 connect a TCP session through a 3-way handshaking setting process in which SYN, SYN / ACK, and ACK packets are interchanged (S310).

Subsequently, as the client 100 transmits a plurality of fragment packets or a single packet to the server 200, the server 200 uses the session table 300 and the fragment table 400 to determine the session of each session. The state information is managed (S320).

Here, the status information includes the status value of the session and the transmission / reception direction, and may be used for packet filtering in the firewall, packet inspection in the intrusion detection and prevention system.

After the transmission and reception of a packet including a plurality of fragment packets is completed, the client 100 and the server 200 terminate the session through a 4-way handshaking termination process of exchanging FIN and ACK packets. (S330).

As described above, the present invention can efficiently manage the state information for packet inspection, thereby increasing the efficiency of packet inspection.

Hereinafter, a session management apparatus for managing a session in step S320 will be described with reference to FIG. 4. 4 is a block diagram illustrating an apparatus for managing a session according to an embodiment of the present invention.

As shown in FIG. 4, the session management apparatus 10 according to an exemplary embodiment of the present invention includes a manager 500, a session table 300, and a fragment table 400.

The management unit 500 configures and manages entries of a single packet and a plurality of fragment packets in the session table 300 and the fragment table 400. Here, a single packet is a packet used for connection and termination of a session, and an information packet transmitted without being fragmented, and the plurality of fragment packets are information packets that are fragmented and transmitted in plural to correspond to the maximum transmission unit of the link layer.

The management unit 500 determines whether the packet is a single packet or a fragment packet by checking the flags field of the IP header of the received packet. If the single packet is a single packet, the manager 500 configures a single packet entry in the session table 300. If it is a packet, the fragment table 400 constructs an entry of the fragment packet.

In detail, the management unit 500 checks the <protocol, source address, destination address, source port, and destination port> from the IP header and the TCP header of the single packet, and determines the entry address of the single packet using the session. Check the status and direction and save it with the determined entry address.

The management unit 500 checks the <protocol, source address, destination address, source port, and destination port> of the first fragment packet including the IP header and the TCP header among the plurality of fragment packets to determine the first fragment from the session table 300. The connection state ("Established" State) and flow direction (Flow Direction: Client to Server / Server to Client) of the session in which the packet is transmitted and received are identified, and the fragment table 400 is used to display the state information of the first fragment packet. Constitutes an entry for

When the management unit 500 receives the second to Nth fragment packets including only the IP header without including the TCP header, the management unit 500 uses the <protocol, source address, destination address, and ID> from the fragment table 400. An entry of the first fragment packet is identified and an entry including state information of the second to Nth fragment packets is configured with reference to the entry.

In this case, the management unit 500 determines whether the plurality of fragment packets are the first fragment packet, the second to N-th fragment packets, or the Nth fragment packet according to the following equation. By creating a new entry in the fragment table 400 and deleting an entry in use, if the Nth fragment packet is used, the memory including the fragment table 400 can be efficiently used.

if (More Fragments == 1 && Fragment Offset == 0)

Received packet = first fragment packet (ie, the first fragment packet)

else if (More Fragments == 1 && Fragment Offset! = 0)

Received Packet = Second to N-th Fragment Packet (i.e. Intermediate Fragment Packet)

else if (More Fragments == 0 && Fragment Offset! == 0)

Received packet = Nth fragment packet (ie last fragment packet)

The session table 300 includes entries configured for the status information of packets and non-fragmented single packets used for session connection and session termination. At this time, each entry is divided into addresses of entries created from five elements (Tuple) of <protocol, source address, destination address, source port, and destination port>, and are stored together with the status and direction of the session identified from the five elements. .

The fragment table 400 includes entries configured for the state information of the first to Nth fragment packets. In this case, each entry is classified into an address of an entry generated from four elements (Tuple) of <protocol, source address, destination address, and ID>, and the session identified from the session table 300 by five elements of the first fragment packet. Stores status information about the current status and direction of the.

As described above, the present invention separates and manages the session table and the fragment table, thereby saving resources and increasing flexibility compared to the session table managed as a single conventional table.

In other words, since the present invention manages a single packet and a fragment packet with each identifier, the fragment table can be used for other storage when the fragment packet is transmitted from the sender, and the fragment table can be fragmented in the session table even when the fragment packet is transmitted. There is no need to configure a separate ID field to grasp the packet status information, which is advantageous for resource saving and securing flexibility.

Hereinafter, a fragment table management method of the management unit 500 according to an embodiment of the present invention will be described with reference to FIG. 5. 5 is a diagram illustrating a fragment table management method of the management unit 500 according to an embodiment of the present invention.

As shown in FIG. 5, the manager 500 includes an extractor 510, an association 520, and a hash generator 530. The manager 500 includes a fragment table 400 using a first key and a second key. Manage.

When the first to Nth fragment packets are received in the session connection state, the extractor 510 extracts 5 and 4 elements from the IP header and the TCP header of the first fragment packet, and the IP of the second to Nth fragment packets. Extract 4 elements from the header. The detailed configuration of the extractor 510 will be described later with reference to FIG. 6.

The association unit 520 checks the current status and the transmission / reception direction of the session including the first fragment packet from the session table 300 using five elements of the first fragment packet.

When the first fragment packet is received, the hash generator 530 generates a first key using four elements of the first fragment packet, and generates a second key using four elements of the first fragment packet. In addition, the hash generator 530 generates an entry of the first fragment packet along with the status and direction of the session identified by the association unit 520 at the address indicated by the first key and the second key. In this case, the hash function may be any function such as an XOR function or a CRC function.

Subsequently, when the hash generator 530 receives the four elements of the second to Nth fragment packets, the hash generator 530 generates a first key and a second key to retrieve an entry of the first fragment packet, and from there, the second to Nth fragments. Check the packet status information.

Here, the fragment table 400 is a table composed of rows consisting of L columns and M (M> 0) entries, and each entry has a k-Way Set Associative Fragment Table structure composed of k bits. Thus, the first key generated by hash generator 530 indexes each row, and the second key points to each entry in each indicated row.

Each entry of the fragment table 400 is composed of k bits, each entry including a current state indicating a connection state of a session, a timestamp, and a hash address that is an address of each entry. .

Here, the timestamp is updated by an internal timer each time an entry of each session is accessed, and the fragment table 400 becomes full so that when the entry of a new session can no longer be allocated, A Least Recently Used (LRU) algorithm is used that compares the timestamp of each entry and replaces the oldest session with the newly allocated entry.

Accordingly, when the second to Nth fragment packets are received, the management unit 500 may check an entry of the first fragment packet using four elements and search for state information of the second to Nth fragment packets.

5 is a 72 Mb SRAM in which each row of the fragment table 400 is composed of 16 entries and a total of 2 ¹⁷ columns, each entry having a 2-bit session status value, an 8-bit timestamp, Although a case in which a hash address generated from a 26-bit hash function has been described as an example, the fragment table 400 is not limited thereto and may be configured in various ways.

As described above, since the present invention manages the fragment table 400 using the dual hash structure, the search time can be shortened and hash collision can be reduced.

Hereinafter, a method of extracting four elements of the extractor 510 according to an embodiment of the present invention will be described with reference to FIG. 6. 6 is a diagram illustrating a four-element extraction method of the extraction unit 510 according to an embodiment of the present invention.

Referring to FIG. 6, since the hash generator 530 generates a hash address from each of four elements of 88 bits, even if the protocol and the ID are the same, there is a problem in that the hash address varies depending on the transmission and reception directions. It can cause confusion.

Therefore, the extractor 510 compares the source address and the destination address and rearranges the smallest of the two, so that the hash generator 530 constantly generates the hash address regardless of the transmission / reception direction.

Hereinafter, the change of the present state value contained in each entry is demonstrated with reference to FIG. 7 is a state diagram showing a change in the status value according to an embodiment of the present invention.

FIG. 7 illustrates an example in which a current state value of each entry of the fragment table 400 is represented by 2 bits as shown in Table 1 below.

In the initial state in which the fragment packet was not previously received, the management unit 500 sets the current status value to "00" in each entry of the fragment table 400 (S710).

Subsequently, when the first to Nth fragment packets are received, the manager 500 checks the session state and the transmission / reception direction from the session table 300.

If the received packet is a packet transmitted from the client to the server, the management unit 500 transfers the current state value of the fragment table 400 to "10" (S720).

On the other hand, if the received packet is a packet transmitted from the server to the client, the management unit 500 transfers the current state value of the fragment table 400 to "11" (S730).

At this time, when the Nth fragment packet, which is the last fragment packet, is received, the management unit 500 deletes an entry for the first fragment packet from the fragment table 400 and transfers the current status value of the session to "00" (S740). .

While the present invention has been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications, Of course, this is possible. Accordingly, the scope of protection of the present invention should not be limited to the above-described embodiments, but should be determined by the description of the following claims.

1 is a diagram illustrating a fragmentation process of a packet.

2 is a diagram illustrating the structure of an IP header and a TCP header.

3 is a flowchart illustrating a communication mechanism of a client and a server according to an embodiment of the present invention.

4 is a block diagram illustrating an apparatus for managing a session according to an embodiment of the present invention.

5 is a diagram illustrating a fragment table management method according to an embodiment of the present invention.

6 is a view showing a four element extraction method according to an embodiment of the present invention.

Figure 7 is a state diagram showing a change in the status value according to an embodiment of the present invention.

Claims (1)

When the first fragment packet including the TCP header and the IP header is received according to the TCP session connection, determining a session state and a direction in which the first fragment packet is included; Determining a first address using information of the TCP header and the IP header, constructing an entry of the first address, and storing the entry with the session state and directivity; When the second to N-th fragment packets including the IP header are received, determining the session state and the direction by using information of the IP header; And Determining second to N-th addresses by using the information of the IP header, and constructing an entry of the second to N-th addresses and storing the second to N-th address together with session state and directionality; And deleting the entry of the configured second to Nth addresses if the second to Nth fragment packets are the last of fragmented packets.

Images