JP2005005994A - Network attack preventing device, network attack preventing method, network attack prevention program and recording medium with its program recorded thereon - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology to be performed to a device existing on a network for preventing attack using any illegal packet. <P>SOLUTION: This network attack preventing device is provided with a means for testing whether or not the transmission origin address of a packet to be inputted from an interface connected to the outside is an address registered in the interface, and for abandoning the packet when the address is not registered in order to prevent the inflow of the packet whose transmission origin address is illegally altered, a means for applying a priority identifier for delivering the packet with high priority to the packet when both the transmission origin and transmission destination of the packet are directly connected to the interface in order to give high priority to the communication of devices directly connected to the interface, and for applying the priority identifier for delivering the packet with low priority to the packet in the other case and a means for preferentially delivering the packet to the transmission destination according to the priority identifier. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network attack prevention apparatus and method for preventing an attack using an illegal packet performed on a device existing on a network, and a network attack prevention program used for realizing the network attack prevention technique. And a recording medium on which the program is recorded.
[0002]
Recently, a DoS attack on a server has made it difficult for other users to access the server.
[0003]
A “DoS attack (Denial of Service attack: denial of service attack)” refers to a server or communication route that is sent by an attacker sending an unauthorized communication packet to a server that can be accessed by an unspecified number of users via the Internet or the like. This is an attack that makes it difficult for other users to access the server by adversely affecting the resources (processing capacity and transferable bandwidth) of the above device.
[0004]
[Prior art]
The DoS attack is roughly classified into the following three types.
[0005]
(A) By sending an abnormally formatted packet from the source device that performs the attack to the server, it causes an abnormality in the processing of the destination device or the device on the communication path, making it difficult for the server to continue the service. Things (abnormal packet transmission DoS attack).
[0006]
(B) By sending a large number of packets in a normal format from a single or a small number of transmission source devices to the server, it consumes server resources and circuit bandwidth on the route, making access difficult for authorized users What to do (mass packet transmission DoS attack).
[0007]
(C) From a large number of transmission source devices, a small amount of normal-format packets are sent to the server. As a result, a large amount of attack packets are sent to the server, thereby reducing server resources and circuit bandwidth on the route. Consumes and makes access from authorized users difficult (highly distributed DoS attack).
[0008]
There are the following two attacks as the main attacks classified as (C).
[0009]
(C1) A device managed by a person who is not an attacker is used as a springboard by an attacker because the operation from the viewpoint of security is insufficient. For example, if a security hole fix program is not applied or computer virus removal software is not used, an attacker may embed an attack program and use it as an attack. (Highly distributed DoS attack using an inadequate device).
[0010]
(C2) Even if a device managed by a non-attacker is sufficiently operational from a security point of view, a reply packet to a received packet is used as an attack packet, so that it can be used as a stepping stone by an attacker. Things. For example, by sending a spoofed packet with the address of the target device as a source address to a large number of publicly available web servers, the response packets from those large number of web servers are targeted. An attack that consumes the resources of the target device by returning it to the device is applicable (distributed reflection DoS attack).
[0011]
Next, a conventional technique for countermeasures regarding (A) and a conventional technique for countermeasures regarding (B) will be described.
[0012]
As a countermeasure for (A), a server or a device on a communication path is improved / corrected by executing a system upgrade or a correction program so that processing abnormalities are not caused by an abnormal packet. Alternatively, there is a method of discarding an abnormally formatted packet in a server or a device on a communication path between the server and a transmission source device. In the latter case, the determination that the packet format is abnormal is mainly performed by pattern matching.
[0013]
As a measure for (B), the amount of transmitted packets is compared for each packet transmission source, and packets from transmission sources that transmit a large amount of packets compared to other users are blocked or the transmission amount is limited. There is a method to do. In some cases, the source is identified by the IP address in the packet header. However, if the IP address is spoofed, the source cannot be identified correctly. There are a method for embedding information for identifying a transfer device in a packet, and a method for identifying an attacked device by measuring the amount of packets transmitted to a target server for each device on the route. is there.
[0014]
In addition, there exists a thing described in the following nonpatent literature 1 as a prior art provided as a countermeasure with respect to a DoS attack.
[0015]
[Non-Patent Document 1]
FloodGuard [Search April 4, 2003], Internet <URL: http: // www. reactive network. com / products / floodguard2point1.com / products / floodguard2point1. pdf>
[0016]
[Problems to be solved by the invention]
As described above, the measures relating to (A) and the measures relating to (B) have been provided in the prior art.
[0017]
However, as a countermeasure for (C), there has been no sufficient countermeasure in the past.
[0018]
The reason is that when an attack is performed by a large number of transmission source devices, the amount and transmission pattern of attack packets sent by one transmission source device are not different from those sent by authorized users. This is because it is difficult to identify the attack source with the distinction by.
[0019]
Against this backdrop, the present applicant is able to protect a public server and the like from the highly distributed DoS attack described in (C1) described above in Japanese Patent Application No. 2003-111741 filed earlier. Filed an invention related to network attack prevention technology.
[0020]
It is another object of the present invention to provide a new network attack prevention technique capable of protecting a device on a network from the distributed reflection DoS attack described in (C2) described above. To do.
[0021]
[Means for Solving the Problems]
The network attack prevention apparatus according to the present invention has a configuration in which a plurality of interfaces for inputting and outputting packets are prepared, and a list of source addresses that packets to be input from the interfaces should have is registered in each interface Take.
[0022]
The network attack prevention apparatus according to the present invention, in order to perform a process for preventing an attack using an illegal packet performed on a device existing on the network under this configuration, (1) External It checks whether the source address of the packet input from the interface connected to is the address registered in the interface, and if it is a registered address, input the packet A forged packet inflow prevention unit that prevents an inflow of a packet to be input from another interface impersonating a transmission source address by discarding the packet if the received address is not a registered address; (2 ) High priority for a packet when both the source and destination of the packet are directly connected to the interface When a priority identifier for delivery is assigned and either or both of them are indirectly connected to the interface via an external network, etc., the packet is delivered with a low priority. (3) In addition to this, priority control for delivering packets to the destination preferentially according to the priority identifier assigned by the priority identifier assignment unit A transfer unit may be provided.
[0023]
Here, each of the above processing means can be realized by a computer program. When the processing means is realized by a computer program, the computer program is provided by being recorded on a recording medium such as a semiconductor memory, or a network is provided. Can be provided through.
[0024]
Thus, the network attack prevention apparatus of the present invention has a priority control transfer unit inside, and the priority control transfer unit and the interface connected to the outside are forged packet inflow prevention units prepared for each interface. And a priority identifier assignment unit. In each interface, a source address of a packet that is permitted to flow inward from the interface is registered in advance.
[0025]
Here, the address being registered in the interface means that the address of the transmission source device or the transmission destination device connected to the device of the present invention through the interface is registered for each interface. , It is not assigned as the interface address itself.
[0026]
When a packet flowing in from the outside illegally uses an address registered in another interface as its source address, the spoofed packet inflow prevention unit sends the source address of the input packet to the input interface. By confirming that it does not match the registered address, it is determined that the transmission source of the packet is forged, and the packet is discarded.
[0027]
Packets that are not discarded by the spoofed packet inflow prevention unit are sent to the priority identifier assigning unit, and both the device indicated by the source address of the packet and the device indicated by the destination address do not pass through an external network or the like. When directly connected to the apparatus of the present invention, the priority identifier assigning unit assigns a priority identifier to the packet for delivery at a high priority in the priority control transfer unit. On the other hand, when either the device indicated by the source address of the packet or the device indicated by the destination address is connected to the device of the present invention via an external network or the like, the priority identifier assigning unit is The priority control transfer unit gives a priority identifier to the packet to be delivered with a low priority.
[0028]
Thereafter, the packet is sent to the priority control transfer unit, and is delivered to the destination side interface in the priority control transfer unit. At this time, the priority control transfer unit performs delivery with a priority according to the priority identifier assigned to the packet. Thereafter, the packet is sent to the destination via the interface on the destination side.
[0029]
In the distributed reflection type DoS attack, as described above, a spoofed source address is sent from an attacking device to a legitimate device operated by a third party, and a response packet from the legitimate device is targeted. It is implemented by sending to the device.
[0030]
Here, when the packet directly sent to the target device is a response packet, if the source of the response packet is directly connected to the device of the present invention, a prior packet (request packet that is the source of the response packet) Must be sent through the device of the present invention. Furthermore, in order for the reply packet to be used for an attack, the source of the previous packet needs to be camouflaged as the destination of the reply packet. Here, the destination of the reply packet is also directly connected to the apparatus of the present invention. If it is connected, a forged packet that is about to flow in from another interface is discarded by the function of the forged packet inflow prevention unit.
[0031]
Therefore, if both the transmission source and the transmission destination are directly connected to the apparatus of the present invention, the packet is not a response packet used for the distributed reflection type DoS attack. In the device of the present invention, packets between the directly connected source device and destination device are preferentially delivered, so that while the distributed reflection type DoS attack is performed using other packets. However, the delivery of packets between devices directly connected to the device of the present invention is not affected by the attack.
[0032]
In this way, according to the present invention, devices existing on the network can be protected from the distributed reflection DoS attack.
[0033]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail according to embodiments.
[0034]
FIG. 1 illustrates an example of an embodiment of a main apparatus 1 that implements the present invention.
[0035]
As shown in this figure, a main apparatus 1 that implements the present invention is arranged around a priority control transfer unit 10 for transferring packets, and between the priority control transfer unit 10 and an interface connected to the outside. The spoofed packet inflow prevention units 11-1 to 11-12 and the priority identifier assigning units 12-1 to 12-12 are arranged.
[0036]
The main device 1 having the above configuration is installed between the transmission destination device 2 and the transmission source devices 3-1 to 3-6, and is connected to the main device 1 from the transmission source device 3-i. A function of protecting communication to the destination apparatus 2 directly connected to the network from a distributed reflection type DoS attack is realized.
[0037]
The devices that can be the transmission source and the transmission destination can share the same interface, but in this case, attacks between the devices sharing the interface cannot be prevented.
[0038]
It is also possible to connect to the main apparatus 1 via the external networks 4-1 to 4-2 shared by a third party, either or both of the transmission source apparatus 3-i and the transmission destination apparatus 2. In this case, basically, communication from the transmission source device 3-i to the transmission destination device 2 cannot be protected from the distributed reflection type DoS attack. However, a device that has made a VPN connection (Virtual Private Network connection) with the VPN connection device 6 directly connected to the external network 4-i directly to the main device 1 without going through the external network 4-i. It can be handled in the same way as a connected device.
[0039]
In addition, in a specific organization, a device connected to a LAN configured by the router 5 or the like can be handled as a device directly connected to the main device 1. However, it is impossible to prevent a distributed reflection type DoS attack from a device in the organization to another device in the same organization and a distributed reflection type DoS attack using a device in the same organization as a stepping stone. It is desirable to treat the device as being directly connected to the main device 1 only when the possibility of carrying out an attack is low.
[0040]
Note that the main device 1 according to the present invention is not necessarily realized as a single device, and may be realized by a plurality of device elements arranged in a distributed manner.
[0041]
Hereinafter, how each component in FIG. 1 functions will be described with reference to FIG. 2 and based on a packet flow.
[0042]
Here, in FIG. 1, a packet transmitted from the transmission source device 3-i is “transmission source device 3-i → spoofed packet inflow prevention unit 11-i → priority identifier assigning unit 12-i → priority control transfer unit 10 → It is assumed that the packet is delivered to the transmission destination device 2 through the route of the priority identifier giving unit 12-i → the forged packet inflow prevention unit 11-i → the transmission destination device 2.
[0043]
First, the packet is transmitted from the transmission source device 3-i (step 201). This packet is delivered to the destination device 2 via the main device 1 of the present invention. At this time, when entering the main device 1, it is sent to the forged packet inflow prevention unit 11-i, where the forged packet is sent. Inflow prevention processing is executed (step 202).
[0044]
The spoofed packet inflow prevention unit 11-i performs the processing shown in FIG.
[0045]
When processing in the forged packet inflow prevention unit 11-i is started (step 301), first, is the packet input to the forged packet inflow prevention unit 11-i flowing from the outside of the main device 1? If it is determined whether or not the packet has flowed in from the outside of the main device 1, the source address of the received packet is connected to the spoofed packet flow prevention unit 11-i. It is determined whether the address is within the range of addresses registered in the interface (step 303).
[0046]
If it is determined in step 303 that the source address of the received packet is within the registered address range, the packet sent from the source device 3-i connected to the interface As a result, the packet is transmitted to the directly connected priority identifier assigning unit 12-i (step 304), and the process ends (step 305).
[0047]
On the other hand, if it is determined in step 303 that the source address of the received packet is not within the registered address range, it is sent from the source device 3-i connected to another interface. The packet is discarded (step 306), and the process is terminated (step 305).
[0048]
On the other hand, when it is determined in step 302 that the packet does not flow in from the outside of the main apparatus 1, that is, the packet is not flowed in from the outside, but is sent from the inner priority identifier assigning unit 12-i. If it is, the packet is delivered to the destination apparatus 2 via the interface directly connected to the forged packet inflow prevention unit 11-i (step 307), and the process is terminated (step 305). .
[0049]
In this way, when the processing for the packet input to the forged packet inflow prevention unit 11-i is completed in step 202 shown in FIG. 2, the packet is discarded by the processing of the forged packet inflow prevention unit 11-i. If so (step 203), the processing of the main device 1 for the packet ends (step 209).
[0050]
On the other hand, when the packet input to the main device 1 has not been discarded (step 203), the packet should have been sent to the priority identifier assigning unit 12-i. Processing is executed (step 204).
[0051]
In the priority identifier assigning unit 12-i, the process shown in FIG. 4 is performed. Here, since the packet has been sent from the spoofed packet inflow unit 11-i, the process of step 407 described later is not executed.
[0052]
When processing in the priority identifier assigning unit 12-i is started (step 401), first, is the packet input to the priority identifier assigning unit 12-i sent from the spoofed packet inflow unit 11-i? Judgment is made (step 402).
[0053]
If it is determined in step 402 that the packet is sent from the spoofed packet inflow unit 11-i, the source and destination of the packet are transmitted by checking the source address and destination address of the packet. It is determined whether the destination is directly connected to the main apparatus 1 (step 403).
[0054]
For example, a database storing a list of IP addresses of devices directly connected to the main device 1 is prepared in advance, and whether the IP addresses of both the transmission source and the transmission destination are included in these IP addresses at the time of determination in step 403 By examining whether or not the packet transmission source and transmission destination are both directly connected to the main apparatus 1.
[0055]
If it is determined in step 403 that both the transmission source and the transmission destination of the packet are directly connected to the main apparatus 1, a priority identifier indicating that the transfer is performed with high priority is given to the packet. (Step 405). Then, the packet is transmitted to the priority control transfer unit 10 (step 406), and the processing of the priority identifier assigning unit 12-i is ended (step 408).
[0056]
On the other hand, in the determination in step 403, it is determined that either or both of the packet transmission source and the transmission destination are not directly connected to the main apparatus 1, so that either the packet transmission source and / or the transmission destination are determined. When it is determined that the main apparatus 1 is connected via an external network or the like, a priority identifier indicating that the transfer is performed with a low priority is given to the packet (step 404). Then, the packet is transmitted to the priority control transfer unit 10 (step 406), and the processing of the priority identifier assigning unit 12-i is ended (step 408).
[0057]
On the other hand, if it is determined in step 402 that the packet is not sent from the spoofed packet inflow prevention unit 11-i, that is, if it is sent from the priority control transfer unit 10, the priority is given. The packet is transmitted to the forged packet inflow prevention unit 11-i to which the identifier assigning unit 12-i is directly connected (step 407), and the process is terminated (step 408).
[0058]
In this manner, when the processing for the packet input to the priority identifier assigning unit 12-i is completed in step 204 shown in FIG. 2, the processing of the priority control transfer unit 10 is executed for the packet. (Step 205).
[0059]
The priority control transfer unit 10 performs the process shown in FIG.
[0060]
That is, when the priority control transfer unit 10 starts processing by receiving a packet (step 501), the priority control transfer unit 10 transfers the packet to the interface to which the transmission destination of the packet is connected. At this time, a plurality of packets may be simultaneously transferred through the priority control transfer unit 10. In this case, transfer control is performed according to the priority according to the priority identifier assigned to the packet. That is, transfer control is performed such that a packet having a high priority is transferred with priority (step 502). When all the transfer processes are completed, the process of the priority control transfer unit ends (step 503).
[0061]
In this manner, when the processing for the packet input to the priority control transfer unit 10 is completed in step 205 shown in FIG. 2, the packet that has been transferred inside the priority control transfer unit 10 is sent to the destination. Arrives at the priority identifier assigning unit 12-i connected to the interface to which it is going (step 206).
[0062]
Here, the processing of the priority identifier assigning unit 12-i shown in FIG. 4 is performed again, and this time, since the packet is sent from the priority control transfer unit 10, the packet is given the priority identifier according to the processing of step 407. Sent to the spoofed packet inflow prevention unit 11-i to which the unit 12-i is connected.
[0063]
Then, when the packet is sent to the forged packet inflow prevention unit 11-i, the process of the forged packet inflow prevention unit 11-i shown in FIG. 3 is performed again (step 207). Since the packet is sent from 12-i, the packet arrives at the destination apparatus 2 via the interface connected to the spoofed packet inflow prevention unit 11-i in accordance with the processing of step 307 (step 208).
[0064]
Hereinafter, specific examples of the components of the present invention will be described.
[0065]
The priority identifier is not limited to adopting a new packet format for the priority identifier, but an existing packet identification method, that is, a TOS field (Type Of Service field), a DS field (Differentiated Service field) in the IP header, An IEEE 802.1Q label, an MPLS (Multi Protocol Label Switching) label, or the like can be used.
[0066]
As the priority control transfer unit 10, a device that performs priority control according to the content of the priority identifier is used. For example, a device that performs priority control according to the value of the TOS field is used.
[0067]
In addition, the priority control function of the priority control transfer unit 10 not only performs priority control according to the value of the priority identifier, but also for the first packet (such as a TCP SYN packet) for establishing a communication connection. However, it is desirable to introduce the one that can specify the maximum bandwidth and that performs priority control according to the priority identifier within that bandwidth. However, priority control is simply performed according to the content of the priority identifier without distinguishing the packet type. It does not matter if you introduce a device to do.
[0068]
The priority control transfer unit 10 can use the backbone of the IP network in which the priority control device is installed. This may be provided by a single ISP or carrier, but it may also be provided by a plurality of ISPs or carriers, and the priority identifier is forged by a third party by connecting them directly or by VPN. Need to be prevented.
[0069]
Although the present invention has been described according to the illustrated embodiment, the present invention is not limited to this. For example, although not specifically described in the embodiment, the present invention can prevent a DoS attack performed on a specific user terminal, and can also prevent a DoS attack performed on a public server. It can be prevented.
[0070]
【The invention's effect】
In recent years, as the number of users of the Internet has increased explosively, there has been an active movement to provide services on which communication quality is important, such as online securities trading services and online banking services.
[0071]
However, on the Internet, it is easy to disguise the packet source, and a large amount of packets can be transmitted at low cost. The threat of DoS attacks that send Therefore, how to prevent this DoS attack is a problem.
[0072]
Various methods for preventing DoS attacks have been proposed as described above, but sufficient countermeasures have not been provided for highly distributed DoS attacks. The present invention provides a countermeasure against a distributed reflection type DoS attack among highly distributed type DoS attacks that is difficult to prevent by a conventional method.
[0073]
When the present invention is used, an attacker cannot send a packet spoofing a source address as a target address connected to the apparatus of the present invention to a host connected to the apparatus of the present invention.
[0074]
This ensures that a packet between two devices directly connected to the device of the present invention is not a reflection packet in a distributed reflection DoS attack, and the present invention preferentially forwards this packet within the device. Thus, even when a distributed reflection DoS attack is being performed on the transmission destination, communication can be performed between the two devices directly connected to the device of the present invention without being affected by the attack.
[0075]
The fact that the source device or destination device is directly connected to the device of the present invention means that the third party does not impersonate the source between the source device or destination device and the device of the present invention. It means that there is. Therefore, if a source address is not spoofed from a device in a specific organization, a device connected to the device of the present invention via a LAN shared in the organization is also included in the present invention. It may be handled as a device directly connected to the device.
[0076]
It should be noted that the present invention cannot defend against an attack directly performed from the transmission source device. Different methods are needed to defend the target from direct attacks.
[0077]
By providing an apparatus in the present invention by an Internet Service Provider (ISP), the ISP can provide a value-added service that protects a user from a distributed reflection type DoS attack. In addition, a plurality of ISPs can jointly operate the apparatus according to the present invention to provide a service that is not limited to one ISP.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of an embodiment of a main apparatus for realizing the present invention.
FIG. 2 is a diagram showing a flow of processing for a packet.
FIG. 3 is a diagram illustrating processing of a forged packet inflow prevention diagram.
FIG. 4 is a diagram illustrating processing of a priority identifier assigning unit.
FIG. 5 is a diagram illustrating processing of a priority control transfer unit.
[Explanation of symbols]
1 Main unit
2 Destination device
3 Source device
4 External network
5 routers
10 Priority control transfer unit
11 Forged packet inflow prevention part
12 Priority identifier assignment unit

Claims (6)

A network attack prevention device for preventing an attack using an illegal packet performed on a device existing on a network,
Checks whether the source address of a packet input from an interface connected to the outside is an address registered in that interface, and if it is a registered address, inputs the packet Means to discard the packet if it is not a registered address,
If both the source and destination of a packet are directly connected to the above interface, a priority identifier is assigned to the packet for delivery with a high priority. Providing a priority identifier for delivering a packet with low priority for delivery,
A network attack prevention device characterized. The network attack prevention apparatus according to claim 1,
Comprising means for preferentially delivering a packet to a destination according to the priority identifier,
A network attack prevention device characterized. A network attack prevention method for preventing an attack using an illegal packet performed on a device existing on a network,
Checks whether the source address of a packet input from an interface connected to the outside is an address registered in that interface, and if it is a registered address, inputs the packet And if the address is not registered, discard the packet,
If both the source and destination of a packet are directly connected to the above interface, a priority identifier is assigned to the packet for delivery with a high priority. Providing a priority identifier for delivering packets with low priority delivery,
A characteristic network attack prevention method. The network attack prevention method according to claim 3,
Providing a process of preferentially delivering a packet to a destination according to the priority identifier,
A characteristic network attack prevention method. A network attack prevention program for causing a computer to execute processing used to realize the network attack prevention device according to claim 1. A recording medium storing a network attack prevention program for causing a computer to execute processing used to realize the network attack prevention apparatus according to claim 1.

Images