WO2006075378A1

WO2006075378A1 - Network management program, server control program, network management device, server, and network management method

Info

Publication number: WO2006075378A1
Application number: PCT/JP2005/000335
Authority: WO
Inventors: Nobuhiro Kawamura; Hiroshi Nishida; Takashi Imai; Daiji Ito; Yoshiyuki Iijima
Original assignee: Fujitsu Limited
Priority date: 2005-01-14
Filing date: 2005-01-14
Publication date: 2006-07-20

Abstract

A network management program causes a computer to execute a network management method in a system having a client (1) and a server. The program causes the computer to execute: an attack report reception step for receiving an attack report including information for identifying a client which has executed a DoS attack when one is caused from the client (1) to the server; an access control judgment step for judging access control to limit or release limit of access from the client which has executed the DoS attack to the server according to the attack report received in the attack report reception step; and an access control instruction step for executing an instruction of access control to outside according to the judgment in the access control judgment step.

Description

Specification

Network management program, server control program, network management apparatus, server, network management method

Technical field

The present invention relates to a network management program, a server control program, a network management device, a server, and a network management method that perform access control against a DoS attack on a server.

Background art

In recent years, there has been an increasing demand for client Z server systems in which many users enjoy services such as file distribution and information disclosure. Here, the user accesses the server from a client via a wide area communication network such as the Internet or a mobile phone. As an example of a client Z server system, an IP telephone service is implemented in which call control is implemented by a user accessing a VoIP (Voice over Internet Protocol) server.

[0003] The configuration of a conventional IP telephone system will be described. FIG. 9 is a block diagram showing an example of the configuration of a conventional IP telephone system. This IP phone system consists of client 1, IP (Internet Protocol) network 2, FW (firewall) 3, SCS (SIP control server: Session Initiation Protocol control server) 111, IMS (instant message server) 112, Web server 113 Speak. The SGS111, IMS 112, and Web Sano 113 ^ "servers work together to provide IP phone services.

[0004] The client 1 normally accesses each server via the IP network 2 and the FW 3 for processing related to an IP telephone such as a call. The SCS 111 provides call processing including SIP protocol control, routing storage location information management, and the like. IMS 112 provides Presence Z messaging service call control, subscriber data management, and Web-IF favorites list and user information management. The Web server 113 provides a password change, a nickname change, and a stock communication front end.

[0005] As a related art related to the present invention, for example, Patent Document 1 shown below is known. This line connection permission device registers connection permission information of the partner computer in advance. This determines whether or not the partner computer can be connected.

Patent Document 1: Japanese Patent Laid-Open No. 1-293040 (Page 2, Figure 1)

Disclosure of the invention

Problems to be solved by the invention

[0006] However, in the services described above, the number of users is increasing, and temporary access concentration occurs when a large number of clients access a specific server irregularly. . In IP phone service, a large amount of control messages are temporarily transmitted and received in response to a sano reset by the service provider. A similar situation occurs when a user performs unauthorized access. As a result of such concentration of access, the load on the relay network and server increases, resulting in service quality degradation, service interruption, and so on.

[0007] In addition, in the above-described conventional IP telephone system, clients 1 and others SCSI 11, IMS

Assume that a DoS (Denial of Service) attack is made on each of the servers 112 and Web server 113. F

力 Data format suitable for FW transmission conditions that can be set in advance in W3 can be protected by FW3 DoS attacks with regular data formats seen in recent years pass through FW3 and reach the server.

[0008] Furthermore, the server has a DoS attack detection function, and if it is determined to be a DoS attack, the server regulates access to the transmission source client. FIG. 10 is a sequence diagram showing an example of operation during a DoS attack in the conventional IP telephone system. Even if the server monitors the attack, detects the attack, and regulates it, if the server is not attacked for a predetermined time, the server automatically releases the regulation. Therefore, when repeated attacks are performed, the operations of regulation and deregulation are repeated, and this operation alone increases the load on the server.

[0009] Here, DoS attacks in the IP phone system include DoS attacks by legitimate SIP signals, DoS attacks by illegal SIP signals, DoS attacks by one-off, and DoS attacks on Web servers. A DoS attack by one-off is a case where the operation of canceling immediately after a call is repeated in large numbers.For example, when a cancel operation is repeated 17 times or more in 180 seconds, the server to decide. The present invention has been made to solve the above-described problems, and includes a network management program, a server control program, and a network for performing appropriate access control in accordance with the DoS attack situation on the server. The purpose is to provide a management device, server, and network management method.

Means for solving the problem

[0011] In order to solve the above-described problem, the present invention is a network management program for causing a computer to execute a network management method in a system including a client and a server, and there is a DoS attack from the client to the server. In response to the attack notification including the information for identifying the client that has performed the DoS attack from the server, the attack notification receiving step, and the attack notification received by the attack notification receiving step. An access control determination step for determining access control for restricting or releasing access to the server from the client that has performed the DoS attack, and the outside based on the determination by the access control determination step. An access control instruction step for instructing the access control is executed on a computer. Is shall.

[0012] Further, in the network management program according to the present invention, the access control determination step displays a display for performing the access control operation to a maintenance person, and performs the operation of the maintenance person. Based on the above, the access control is determined.

[0013] In the network management program according to the present invention, the access control step changes the access list to a firewall or router connected between the client and the server. It is characterized by making it.

[0014] Further, in the network management program according to the present invention, the access control step performs deletion of user information on the user of the client who has performed the DoS attack or suspension of login to the server. It is characterized by making it.

[0015] Further, in the network management program according to the present invention, the access control step may access the server from the client that has performed the DoS attack, and may perform an external simulation from the client that has performed the DoS attack. A routing setting that replaces access to a server is performed by a firewall or a router connected between the client and the server. [0016] In the network management program according to the present invention, the pseudo server delays communication with the client.

[0017] Further, in the network management program according to the present invention, the access control determination step is configured to link a client subject to the restriction for a certain server when a plurality of servers to be linked exist. Connect to other servers! It is characterized by being regulated.

[0018] Also, in the network management program according to the present invention, the access control determination step counts the number of attack notifications within a predetermined period, and based on the number of attack notifications within the predetermined period. And determining the access control.

[0019] Also, in the network management program according to the present invention, the attack notification includes a priority of the access control, and the access control is based on the number of the attack notifications within the predetermined period and the priority. It is characterized by making a judgment.

[0020] Further, in the network management program according to the present invention, the access control determination step is performed when an attack notification for a client being restricted is not received during a predetermined restriction release time. In addition, it is characterized by making a decision to deregulate

[0021] Further, in the network management program according to the present invention, the access control determination step sets the restriction release time based on the number of times the restricted client has been restricted in the past. It is characterized by determining.

[0022] In the network management program according to the present invention, the attack notification is transmitted using any one of SNM P-Trap, Syslog, and Telnet.

[0023] In the network management program according to the present invention, the information for specifying the client is information for identifying a network device such as an IP address.

[0024] In the network management program according to the present invention, the information for specifying the client is information for identifying a user, such as a login ID. [0025] Further, the present invention provides a server control program for causing a computer to execute a server control method in a system including a client and a server, the attack detection step for detecting a Do S attack from the client, and the attack Based on the detection in the detection step, the computer executes an attack notification transmission step of transmitting an attack notification including information for identifying the client that has performed the DoS attack to the outside.

[0026] Further, the present invention is a network management apparatus for managing a system including a client and a server, and when a DoS attack is made from the client to the server, the client that has performed the DoS attack is specified. An attack notification receiving unit that receives an attack notification including information to be received from the server, and an access to the server from a client that has performed the DoS attack based on the attack notification received by the attack notification receiving unit V An access control determination unit for determining access control for restricting or releasing the control, and an access control instruction unit for instructing the access control to the outside based on the determination by the access control determination unit It is.

[0027] Further, the present invention is a server that provides a service to a client, and is based on an attack detection unit that detects a DoS attack from the client, and detection by the attack detection unit. And an attack notification transmission unit that transmits an attack notification including information for identifying the client that has performed the DoS attack to the outside.

[0028] Further, the present invention is a network management method in a system including a client and a server, and when a DoS attack is made from the client to the server, the client that performed the DoS attack is specified. An attack notification receiving step for receiving an attack notification including information to be received from the server, and an access to the server from the client that has performed the DoS attack based on the attack notification received by the attack notification receiving step. An access control determination step for determining access control for restriction or deregulation, and an access control instruction step for instructing the access control to the outside based on the determination by the access control determination step. It is a thing.

[0029] Further, the present invention is a server control method in a system including a client and a server, the attack detection step for detecting a DoS attack from the client, and the detection based on the attack detection step. Identifies the client that made the DoS attack An attack notification transmission step for transmitting an attack notification including information to be transmitted to the outside.

Brief Description of Drawings

FIG. 1 is a block diagram showing an example of the configuration of an IP telephone system according to the present invention.

FIG. 2 is a block diagram showing an example of the configuration of a server according to the present invention.

FIG. 3 is a block diagram showing an example of a configuration of a network management device according to the present invention.

FIG. 4 is a sequence diagram showing an example of an operation during a DoS attack in the IP telephone system according to the present invention.

FIG. 5 is a flowchart showing an example of the operation of the network monitoring apparatus according to the present invention.

FIG. 6 is a screen showing an example of an attack monitoring screen according to the present invention.

FIG. 7 is a flowchart showing an example of an operation when access control is automatically performed in the network management device according to the present invention.

FIG. 8 is a block diagram showing an example of a configuration when a pseudo server is used in the IP telephone system according to the present invention.

FIG. 9 is a block diagram showing an example of the configuration of a conventional IP telephone system.

FIG. 10 is a sequence diagram showing an example of an operation during a DoS attack in a conventional IP telephone system.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Similar to the background art, an IP telephone system will be described as an example of the client Z server system according to the present invention.

First, the configuration of the IP telephone system according to the present invention will be described.

FIG. 1 is a block diagram showing an example of the configuration of the IP telephone system according to the present invention. In FIG. 1, the same reference numerals as those in FIG. 9 denote the same or corresponding parts as those in FIG. 9, and the description thereof is omitted here. Compared to Fig. 9, the IP phone system in Fig. 1 has a new network management device 10. Compared with FIG. 9, the IP telephone system of FIG. 1 includes SCSI 1 instead of SCSI 11, IMS 112 instead of IMS 112, and Web server 13 instead of Web Sano 113. Here, FW3 may be a router. FIG. 2 is a block diagram showing an example of the configuration of the server according to the present invention. The server represents any one of S CS11, IMS 12, and Web server 13. This server includes a service processing unit 21, an attack detection unit 22, and an attack notification transmission unit 23. FIG. 3 is a block diagram showing an example of the configuration of the network management apparatus according to the present invention. The network management device 10 includes an attack notification receiving unit 31, an access control determining unit 32, a maintenance input / output unit 33, and an access control instruction unit 41.

Next, the operation at the time of DoS attack of the IP telephone system according to the present invention will be described.

FIG. 4 is a sequence diagram showing an example of an operation at the time of DoS attack in the IP telephone system according to the present invention. FIG. 5 is a flowchart showing an example of the operation of the network monitoring apparatus according to the present invention. First, the server attack detection unit 22 monitors a Do S attack from the client 1 (Ti l) (T31). The setting items of the attack detection unit 22 include, for example, a flag indicating the power / unavailability of releasing the server restriction on the DoS attack, the time to release the server restriction on the DoS attack, the DoS attack monitoring target, There is a flag indicating whether to monitor for each type of DoS attack, time to monitor consecutive DoS attacks, frequency threshold for detecting DoS attacks, etc.

[0038] When the client 1 makes a DoS attack to the server and the attack detection unit 22 determines that the DoS attack has occurred, the attack notification transmission unit 23 transmits an attack notification representing information on the DoS attack to the network management device 10 (T12). (T32). The attack notification includes information such as the client IP address, user ID, and DoS attack type. Here, the SCS 11 and the IMS 12 transmit an attack notification to the network management apparatus 10 using SNMP-Trap or Telnet. Further, the Web server 13 transmits an attack notification to the network management apparatus 10 using Syslog or Telnet.

[0039] In the network management device 10, the attack notification receiving unit 31 determines whether or not an attack notification has been received (S11). If no attack notification has been received (Sl l, N), the process returns to step S11 and waits. On the other hand, when an attack notification is received (Sl l, Y), the access control determination unit 32 stores the attack notification content as an attack history (S 12) (T21) (T41), It is determined whether or not (S13). Restricted objects are clients whose access to the corresponding server is restricted by blocking or reducing their tolerance. Where The access control determination unit 32 counts the number of attack notifications within a predetermined period for each server and each client using the attack history, and determines whether or not the client is subject to regulation according to this number of times. Determine the type of control.

[0040] If not subject to restriction (S13, N) (T22), this flow ends. On the other hand, if it is subject to regulation (S13, Y) (T42), the maintenance input / output unit 33 displays the attack monitoring screen and indicates the subject of regulation to the maintenance person (S21) (Τ43). Next, the maintenance input / output unit 33 determines whether the maintenance force has been operated or not (S22). When the operation of the regulation is insufficient (S22, N), this flow is finished. When there is a restriction operation (S22, Y), the access control instruction unit 41 gives a restriction instruction to the FW and the server (S23) (T44), and this flow ends. Furthermore, the network management device 10 repeats this flow.

[0041] The FW 3 regulates access from the client to be regulated to the server by changing the access list in accordance with the regulation instruction received from the network management device 10 (T51). Further, the server changes the user information or stops the login for the client user to be regulated in accordance with the regulation instruction received from the network management device 10 (Τ52).

Next, the attack monitoring screen will be described.

FIG. 6 is a screen showing an example of the attack monitoring screen according to the present invention. This attack monitoring screen includes items such as a filter setting button, subscriber IP address, initial reception date and time, latest reception date and time, access count, status, restriction Z restriction release date and deletion button. These items are displayed for each client notified by the attack notification.

[0044] The filter setting button is a restriction button unless the corresponding client is under restriction. When the button is pressed, a filter for restriction is set. If the corresponding client is under restriction, it becomes a release button, and when pressed, the restriction filter is released. The subscriber IP address represents the IP address of the corresponding client. The first received date / time indicates the date / time when the corresponding client attack notification was first received, and the latest received date / time indicates the last received date / time. The access count represents the access count from the corresponding client. The status usually indicates either monitoring or regulation. Restriction Z The date and time when the restriction is released is the date and time when the restriction was released in the past if it is not under restriction, and the date and time when the restriction was started if it is under restriction. Delete When the button is pressed, the corresponding client is removed from the list. Clients may be sorted in the order in which they receive the attack notifications. In addition, clients that have received the attack notification more than a predetermined number of times may be highlighted.

Next, the operation of releasing the restriction during the restriction will be described.

The maintenance input / output unit 33 being regulated displays a release button for the restriction target on the above-described attack monitoring screen, and waits for an operation for releasing the restriction by the maintenance person. Next, when the maintenance input is performed by the maintenance person at the maintenance input / output unit 33, the access control instruction unit 41 instructs the FW and the server to release the regulation according to the operation by the maintenance person.

[0047] Note that the attack notification sent from the server to the network management device 10 is a restriction priority.

(Priority) may be included. Regulation Priority is information that indicates the necessity of dealing with the reported DoS attack. The maintenance person input / output unit 33 ranks emergency, warning, caution, information, etc. on the attack monitoring screen based on the regulation priority, the number of attack notifications notified within a predetermined period, the number of affected users, etc. By displaying as, it is easy for the maintenance person to determine the power that needs to be dealt with immediately and whether continuous monitoring is acceptable. In addition, the urgency of response is maintained early by sorting and displaying clients in the order in which they need to be handled, or by highlighting clients that require urgent action even when sorted by other items. Can be notified.

[0048] In the present embodiment, it is assumed that a maintenance person issues a restriction release instruction by pressing a release button during the restriction. Here, at the time of restriction, the access control determination unit 32 may determine a time until the restriction is released and notify the maintenance person of the restriction release time. This deregulation time is determined according to the maliciousness of the DoS attack, such as the frequency of DoS attacks that can be obtained from the date and time when the attack notification was received, and the number of times the regulated client has been regulated. In addition, a deregulation priority indicating whether or not deregulation is possible may be displayed on the attack monitoring screen. Similarly, deregulation Priority is determined according to the maliciousness of DoS attacks. By displaying this deregulation priority, it is possible to prevent an operator from performing an erroneous deregulation operation.

In the present embodiment, the maintenance person performs a restriction operation or a restriction release operation based on the attack monitoring screen. Here, network management without the need for maintenance The device 10 may automatically issue a restriction instruction or a restriction release instruction. The operation of the network management device in this case will be described.

[0050] FIG. 7 is a flowchart showing an example of an operation when access control is automatically performed in the network management apparatus according to the present invention. Processes S11 to S13 are the same as in FIG. When there is a restriction target (S13, Y), the access control instruction unit 41 instructs the FW and the server to restrict the restriction target (S31). Next, the access control determination unit 32 determines the restriction release time by the method described above (S41), and determines whether or not the restriction release time has elapsed (S42). If the deregulation time has not elapsed (S42, N), return to process S42 and wait. On the other hand, when the deregulation time has elapsed (S42, Y), the access control determination unit 32 determines whether or not an attack notification is received during the deregulation time (S43). If an attack notification has been received (S43, Y), this flow ends. On the other hand, if no attack notification has been received (S43, N), the access control instruction unit 41 issues a restriction release instruction (S44), and this flow is terminated. Further, the network management device 10 repeats this flow.

[0051] By performing this operation, the network management device 10 can automatically perform regulation and deregulation without requiring the operation of a maintenance person.

In the present embodiment, network management device 10 performs access control only to a server based on a DoS attack on a server. Here, when multiple servers cooperate to provide a service, a DoS attack may be performed on multiple servers. Therefore, if the network management device 10 has a list of multiple servers with which it is linked and a client is subject to regulation for one of the multiple servers that are linked, It may be determined that all of a plurality of servers are regulated.

[0053] In this case, the attack history for a certain client is collected for all linked servers V, and the number of attack notifications for a certain client! / Is also linked for all supported servers. Is summed for the server. By performing this operation, the network management device 10 can perform efficient regulation when multiple servers provide services in cooperation. Note that the IP telephone system according to the present embodiment may further include a pseudo server. FIG. 8 is a block diagram showing an example of the configuration when a pseudo server is used in the IP telephone system according to the present invention. The same reference numerals as those in FIG. 1 denote the same or corresponding parts as those in FIG. 1, and the description thereof is omitted here. Compared to Fig. 1, the IP phone system in Fig. 8 has a new pseudo server 14.

Next, the operation when the IP telephone system according to the present embodiment includes a pseudo server will be described. Changed the routing table for FW3 or router so that access to SCS11, IMS12, Web server 13 !, or any of them is replaced with access to pseudo server 14 in the control instruction by access control instruction unit 41 Set the routing to be used. Furthermore, the pseudo server 14 intentionally delays communication with the client. By providing the pseudo server 14 in this way, it is possible to prevent attacks to the server and reduce the frequency of DoS attacks without being known to the client that performs the DoS attack.

Note that the client 1 according to the present invention may include, for example, a workstation, a personal computer, a PDA (Personal Digital Assistant), a mobile phone, and the like.

Furthermore, a program for causing a computer constituting the network management apparatus to execute the above steps can be provided as a network management program. The above-described program can be executed by a computer constituting the network management apparatus by storing the program in a computer-readable recording medium. Here, the recording medium readable by the computer includes a portable storage medium such as a CD-ROM, a flexible disk, a DVD disk, a magneto-optical disk, an IC card, a database holding a computer program, or other Computers and their databases, as well as transmission media on the line.

Note that the access control determination unit or the access control determination step corresponds to the access control determination unit 32 and the maintenance input / output unit 33 in the embodiment.

Industrial applicability

[0059] As explained above, system congestion can be avoided by the network management device performing access control using FW and router based on the attack notification from Sano-kun that received DoS attack. It becomes. The server also identifies clients and manages the network When the device controls access to the client, pinpoint access control is possible. Since the server transmits an attack notification using a general-purpose communication means, the present invention can be easily applied regardless of the model, vendor, and server specifications. Also, by performing access control according to the history, frequency, and priority of DoS attacks, effective access control according to the situation becomes possible. When performing access control to a client that has performed a DoS attack on a server, it is possible to minimize the impact on multiple servers by controlling access to multiple servers in cooperation. . In addition, the network management device automatically performs access control, so that maintenance operations can be omitted.

Claims

The scope of the claims

[1] A network management program for causing a computer to execute a network management method in a system including a client and a server,

An attack notification receiving step of receiving, from the server, an attack notification including information for identifying the client that has performed the DoS attack when there is a DoS attack from the client to the server;

Based on the attack notification received by the attack notification reception step, an access control determination step for determining access control for restricting or releasing access to the server from a client that has performed the DoS attack;

An access control instruction step for instructing the access control to the outside based on the determination in the access control determination step;

Network management program that causes a computer to execute.

[2] In the network management program according to claim 1,

The access control determining step displays a display for performing the access control operation for a maintenance person, and determines the access control based on the operation of the maintenance person. Management program.

[3] In the network management program according to claim 1,

In the network management program, the access control step causes a firewall or router connected between the client and the server to change the access list.

[4] In the network management program according to claim 1,

The network management program characterized in that the access control step causes the server to delete the user information or stop the login for the client user who has performed the DoS attack.

[5] In the network management program according to claim 1,

In the access control step, a routing setting that replaces access to the server from the client that has performed the DoS attack with access from the client that has performed the DoS attack to an external pseudo server is performed. Between servers A network management program characterized by having a firewall or router connected to it.

[6] In the network management program according to claim 5,

The network management program, wherein the pseudo server delays communication with the client.

[7] In the network management program according to claim 1,

In the access control determining step, when there are a plurality of servers that cooperate, the client that is subject to the restriction on a certain server is subject to restriction on another server that cooperates. Management program.

[8] In the network management program according to claim 1,

The network management program characterized in that the access control determination step counts the number of attack notifications within a predetermined period and makes the access control determination based on the number of attack notifications within the predetermined period.

[9] In the network management program according to claim 1,

The network management program characterized in that the attack notification includes a priority of the access control, and judges the access control based on the number of the attack notifications within the predetermined period and the priority.

[10] In the network management program according to claim 1,

The network management program according to claim 1, wherein the access control determination step makes a determination on deregulation when an attack notification is not received for a regulated client for a predetermined deregulation time.

[11] In the network management program according to claim 10,

The network management program characterized in that the access control determination step determines the restriction release time based on the number of times the restricted client has been restricted in the past.

[12] In the network management program according to claim 1,

The network management program characterized in that the attack notification is transmitted using any one of SNMP-Trap, Syslog, and Telnet.

[13] In the network management program according to claim 1,

The network management program characterized in that the information for identifying the client is information for identifying a network device such as an IP address.

[14] In the network management program according to claim 1,

The network management program characterized in that the information for identifying the client is information for identifying a user such as a login ID.

[15] A server control program for causing a computer to execute a server control method in a system including a client and a server,

An attack detection step for detecting a DoS attack from the client;

A server control program for causing a computer to execute an attack notification transmission step for transmitting an attack notification including information identifying the client that has performed the DoS attack based on detection by the attack detection step.

[16] A network management device for managing a system including a client and a server, and when there is a DoS attack from the client to the server, an attack notification including information for identifying the client that has performed the DoS attack An attack notification receiving unit for receiving from the server;

An access control determination unit for determining access control for restricting or releasing access to the server from a client that has performed the DoS attack based on the attack notification received by the attack notification receiving unit; ,

Based on the determination by the access control determination unit! /, An access control instruction unit for instructing the access control to the outside,

A network management apparatus comprising:

[17] A server that provides services to clients,

An attack detection unit for detecting a DoS attack from the client;

Based on detection by the attack detection unit, an attack notification transmission unit for transmitting an attack notification including information for identifying the client that has performed the DoS attack to the outside;

A server comprising

[18] A network management method in a system including a client and a server, An attack notification receiving step of receiving, from the server, an attack notification including information for identifying the client that has performed the DoS attack when there is a DoS attack from the client to the server;

A network management method comprising:

A server control method in a system comprising a client and a server, comprising: an attack detection step for detecting a DoS attack from the client;

An attack notification transmission step of transmitting an attack notification including information identifying the client that has performed the DoS attack to the outside based on detection by the attack detection step.