JP4271199B2 - BAND CONTROL METHOD AND BAND CONTROL DEVICE - Google Patents

Description

  The present invention relates to a bandwidth control method and a bandwidth control device, and in particular, a bandwidth control method and a bandwidth control device for controlling the bandwidth of a non-priority packet when a non-priority packet uses a surplus bandwidth due to the use of a priority packet. About.

A distributed service outage (DDoS) attack that causes a service stop by concentrating traffic exceeding the processing capacity of the server from a large number of terminals to a specific web site or the like is increasing. In DDoS attack countermeasures, traffic control performed based on an attack detected is conceivable.
In the attack detection system, for each packet, a normal traffic flow (L flow), an attack traffic flow (M flow), or a suspected traffic flow (S flow) that cannot be determined, is distinguished by a packet header or the like. After making it possible, the control system identifies which flow the packet belongs to by each packet header and performs traffic control according to each flow.
The goal of countermeasures against DDoS attacks is to allow regular traffic to communicate as much as possible without stopping the attacked server where traffic concentrates, and to continue maximizing service provision even during an attack. .
At the time of an attack, congestion occurs from a relatively small part of the network, server, etc., but usually the attacked server becomes a bottleneck.

For this reason, among the packets destined for the attacked server, a packet belonging to the L flow is secured as much as possible, and the M flow packet is controlled to be blocked.
Since the packet of the S flow is a packet for which it is impossible to determine whether the packet is legitimate or attack, in order to ensure maximum communication with the legitimate packet, the packet belonging to the L flow with respect to the processing capability (Cbps) of the attacked server It is necessary to perform bandwidth control so as to ensure communication for the surplus processing capacity of processing.
In other words, if the traffic amount of the L flow is Lbps, bandwidth control for realizing a (CL) bps rate is required. For this purpose, it is necessary to measure the traffic amount Lbps of the L flow and adjust the rate of (CL) bps from time to time accordingly.
There is a token bucket method as a method for easily performing bandwidth control without actually measuring the traffic volume.
The token bucket method is a method of consuming a token every time a packet is transmitted by issuing a token that permits transmission of a packet at a constant rate per unit time. Various bandwidth controls using token buckets have been proposed (see Patent Document 1 below).

As prior art documents related to the invention of the present application, there are the following.
JP 2004-336549 A

In order to avoid the complexity of measuring traffic and adjusting the rate from time to time, an application of a token bucket system that easily performs bandwidth control without actually measuring it can be considered.
However, the conventional proposals such as the above-mentioned Patent Document 1 are intended to guarantee service quality on the network, fairness between traffic flows, and use of surplus bandwidth, and are intended to take measures against DDoS attacks. is not.
Also, a method for adjusting the amount of tokens by measuring traffic and a method for rearranging surplus tokens are proposed, and the methods are different, and it is not possible to take measures against a DDoS attack.
As a countermeasure for DDoS attacks, the goal is to allow regular traffic to communicate as much as possible without stopping the server under attack, where traffic is concentrated, and to continue maximizing service provision even during an attack. There is a need for a bandwidth control method and bandwidth control device that do not involve the complexity of actually measuring traffic.
As a method and apparatus for this problem, a priority queue and a non-priority queue are provided, priority packets belonging to the L flow are placed in the priority queue, and non-priority packets belonging to the S flow are placed in the non-priority queue, and packets discharged from both are distinguished. A method of narrowing down at the rate of the processing capability C of the attacked server by a narrowing-down method such as a token packet method can be considered. In this case, it is necessary to provide a priority queue and a non-priority queue, that is, a queue function and a function for giving priority to the queue function.
The present invention was made to solve the problems of the prior art, and the object of the present invention is to allow normal traffic to communicate as much as possible without stopping the attacked server where the traffic is concentrated. Bandwidth control method and bandwidth control realized without providing priority and non-priority queues, that is, a queue function and a function for giving priority to it as a technology that can continue to provide services to the maximum possible even during an attack To provide an apparatus.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
The main points of the first and second band control methods of the present invention (band control methods according to claims 1 and 2 of the present invention) will be described with reference to FIG.
The token is replenished every unit time at the rate of the processing capability C to be controlled such as the attacked server. When sending a packet, tokens are consumed by the amount of data in the packet. However, for priority packets, tokens are consumed and token borrowing is permitted even when tokens are insufficient.
In the case of non-priority packets, packets are discarded when there is a shortage of tokens, or when a non-priority packet storage function is provided, the non-priority packets are sequentially sent out when tokens are replenished and packet transfer is allowed to be stored.
Thereby, without providing a queue function and a function for giving priority to this, and without actually measuring the flow (L) of the priority packet, the non-priority packet is transmitted at the rate of (CL). Band control is possible.
That is, according to the first and second bandwidth control methods of the present invention, tokens that are issued at a constant rate per unit time and permit the packet transmission of a predetermined amount of data are stored in the token storage device and supplied packets. The packet type is identified as a priority packet and a non-priority packet, and even if a token is insufficient at the time of sending the priority packet, the priority packet is sent and the token remaining amount is allowed to be a negative value. the amount corresponding to the amount of packet data consumes tokens said accumulated in the token storage device calculates the remaining amount of tokens upon delivery, stored in the token storage device the result of the calculation as a token remaining in the token storage device Compare the amount of packet data that can be sent with the remaining amount of tokens accumulated and the amount of non-priority packet data that you want to send. Or former said to allow delivery of the non-priority packet is large, the discards packets when not sending a non-priority packet, or by storing the non-priority packets in the non-priority packet storage device, the token storage device The tokens are replenished, and when the tokens are accumulated so as to allow the token storage device to transmit the non-priority packets, the non-priority packets are sequentially transmitted.
Thereby, without providing a queue function and a function for giving priority to this, and without actually measuring the flow (L) of the priority packet, the non-priority packet is transmitted at the rate of (CL). The bandwidth can be controlled.

The main points of the third bandwidth control method of the present invention (the bandwidth control method according to claim 3 of the present invention) will be described with reference to FIG.
The third bandwidth control method of the present invention shows a scheme for neutral packets that are neither priority nor non-priority. For this neutral packet, the packet is transmitted without consuming the token.
For this reason, in the third bandwidth control method of the present invention, the packet types of the supplied packets are identified as the priority packet, the non-priority packet, and the neutral packet, and a token is used when the neutral packet is transmitted. Do not consume.
The bandwidth control device according to claims 4 to 6 of the present invention is a bandwidth control device for implementing the bandwidth control method according to claims 1 to 3 of the present invention.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, regular traffic can be communicated to the maximum without stopping an attacked server on which traffic is concentrated, and service provision can be continued to the maximum even during an attack.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
[Example 1]
FIG. 3 is a diagram illustrating a network environment to which the bandwidth control device according to the first embodiment of the present invention is applied.
As shown in FIG. 3, a user network 3 and a network operator network 4 are connected by an access link, an attacked server 1 subject to a DDoS attack is in the user network, and the network device is an edge device 2 corresponding to the edge of the network. A case is assumed in which the bandwidth control device of this embodiment is used to perform control for countermeasures against DDoS attacks.
The edge device 2 can be a normal router device, and the router performs the bandwidth control method, but may be an external control device added to the router.

FIG. 4 is a block diagram illustrating a schematic configuration of the bandwidth control apparatus according to the first embodiment of the present invention.
The packet receiving device 10 receives a plurality of types of packets and transfers the packets to the packet type identification device 11.
The packet type identification device 11 identifies whether the packet is a priority packet or a non-priority packet. Although information for identification is not shown, it is received in advance from a separately provided attack detection system. For example, assuming a TCP Syn-flood attack, there may be a case where a packet with the TCP Syn flag set is identified as a non-priority packet, and the other packets of TCP are identified as priority packets.
In this case, the normal traffic flow (L flow) described in the background art is a priority packet (packet without a TCP Syn flag), and the suspect traffic flow (S flow) is a non-priority packet (TCP Syn flag Equivalent to standing packet).
This is because in the case of a syn-flood attack, all attack packets are packets with the TCP Syn flag set, but even regular packets have a packet with the TCP Syn flag set.
Further, when an attack traffic flow (M flow) can be detected, for example, when an attack packet source address is specified in the attack detection system, control is performed to block the attack packet at the control point in FIG. Since is not directly related, no further explanation will be given.

The packet identified by the packet type identification device 11 as a priority packet is transferred to the token remaining amount calculation device 13.
A packet identified as a non-priority packet is transferred to the non-priority packet transmission determination device 12 when the non-priority packet storage device 15 is not provided. When the non-priority packet storage device 15 is provided, if the non-priority packet storage device 15 is not empty, it is transferred to the non-priority packet storage device 15; It is transferred to the determination device 12.
The token issuing device 16 issues a token that permits packet transmission at a constant rate every unit time. For example, when the processing capacity is controlled as the total amount limit value Cbps of a control target that wants to control the total amount of traffic that flows, such as the attacked server 1, a token that permits C-bit packet transmission per second is set at a constant rate. Issue with
The token storage device 17 stores the token issued by the token issuing device 16.
The token remaining amount calculating device 13 consumes the token accumulated in the token accumulating device 17 by the amount of data of the priority packet or the non-priority packet and calculates the remaining amount of token. The result is stored in the token storage device 17.
Here, when the priority packet is transmitted, the priority packet is transmitted even if the token is insufficient, the remaining token amount is calculated as a negative value, and the calculation result is stored in the token storage device 17. After this processing, the priority packet is transferred to the packet transmission device 14.

The non-priority packet transmission determination device 12 compares the packet data amount that can be permitted to be transmitted with the remaining token amount stored in the token storage device 17 and the data amount of the non-priority packet to be transmitted. Allow sending of non-priority packets.
In this comparison, when a non-priority packet is received from the packet type identification device 11, the non-priority packet and the remaining token amount are compared. Alternatively, in the case where the non-priority packet storage device 15 is provided, when the token issuing device 16 issues a token, the non-priority packet storage device 15 transmits, for example, the packet that has passed the most time next. Compare the packet and the token remaining.
The non-priority packet permitted to be transmitted is transferred to the token remaining amount calculation device 13. If transmission cannot be permitted, the packet is stored in the non-priority packet storage device 15.
The packet transmission device 14 transmits the received packet from the bandwidth control device of this embodiment.

FIG. 5A is a flowchart illustrating a processing procedure in the case where the non-priority packet storage device 15 is provided as a processing procedure of the bandwidth control device of the present embodiment.
First, when the control device receives a packet by the packet receiving device (step S1), the packet type identifying device 11 identifies whether the packet is a priority packet or a non-priority packet (step S2).
If the packet identification result in step S2 is a priority packet, the token is consumed by the data amount of the priority packet. That is, the token remaining amount calculation device 13 calculates the token remaining amount and stores the remaining amount value in the token storage device 17 (step S3). At this time, a negative value is allowed as a calculation result. Thereafter, a priority packet is transmitted (step S4).
If the packet identification result in step S2 is a non-priority packet, it is determined whether or not the non-priority packet storage device 15 is empty (step S5). If the non-priority packet storage device 15 is not empty in step S5, The non-priority packet is put into the non-priority packet storage device 15 (step S9).
If the non-priority packet storage device 15 is empty in step S5, the data amount of the non-priority packet is compared with the remaining token amount stored in the token storage device 17 (step S6). The token is consumed by the data amount of the non-priority packet, that is, the token remaining amount calculation device 13 calculates the token remaining amount and stores the remaining amount value in the token storage device 17 (step S7). Thereafter, a non-priority packet is transmitted (step S8).

If the token remaining amount is less than the data amount of the non-priority packet in step S6, the non-priority packet is put into the non-priority packet storage device 15 (step S9).
Furthermore, a token is issued by the token issuing device 16 at regular time intervals in accordance with a desired transmission rate and stored in the token storage device 17, but when the token is issued (step S11), the issued token Is stored in the token storage device 17 (step S12), and then the non-priority packet transmission determination device 12 in the non-priority packet storage device 15 stores the data amount of the non-priority packet to be transmitted next and the token storage device 17 The token remaining amount is compared (step S13), and if the token remaining amount is equal or large, the token is consumed by the data amount of the non-priority packet, that is, the token remaining amount calculation device 13 calculates the token remaining amount and The quantity value is stored in the token storage device 17 (step S7). Thereafter, a non-priority packet is transmitted (step S8). If the token remaining amount is small in step S13, nothing is done.
FIG. 5B is a flowchart illustrating the processing procedure in the case where the non-priority packet storage device 15 is not provided as the processing procedure of the bandwidth control device of the present embodiment. The flowchart of FIG. 5-2 is different from the flowchart of FIG. 5A in that step S5, step S9, and step S13 are omitted, and step S9-1 is added instead of step S9.
In the case where the non-priority packet storage device 15 is not provided, there is no processing in step S5 of FIG. 5-1, and there is no subsequent processing in step S9. In step S6, if the data amount of the non-priority packet is larger than the token remaining amount, the non-priority packet is discarded (step S9-1). Further, when the token is issued (step S11), the process relating to the packet is not particularly performed, and the issued token is stored in the token storage device 17 (step S12).
As described above, the bandwidth control device according to the present exemplary embodiment does not provide a queue function and a function for giving priority to the queue function, and does not measure the traffic amount of the priority packet. Bandwidth control that allows the non-priority packet to make maximum use of the surplus bandwidth of the packet becomes possible.

[Example 2]
FIG. 6 is a diagram illustrating a network environment to which the bandwidth control apparatus according to the second embodiment of the present invention is applied.
In the case of FIG. 3 described above, a server 5 other than the attacked server 1 exists in the user network 3. Another server 5 may be singular or plural.
The network operator uses the bandwidth control device of this embodiment to control the DDoS attack countermeasure at the edge device 2 corresponding to the edge of the network. In the bandwidth control apparatus of this embodiment, it is necessary to handle the neutral packet so that it is not related to priority or non-priority control.
FIG. 7 is a block diagram showing a schematic configuration of the bandwidth control apparatus according to the second embodiment of the present invention.
In each device in the block diagram shown in FIG. 7, the packet type identification device 11 is different in function from each device in the block diagram shown in FIG. 4.

The packet type identification device 11 identifies whether the packet is a priority packet, a non-priority packet, or a neutral packet. Information for identification is not shown, but is received in advance from an attack detection system provided separately.
In this embodiment, the neutral packet is a packet directed to another server 5. The attack detection system detects the attacked server 1 and informs the packet type identification device 11 of the destination. Since the neutral packet corresponds to a packet that is not the destination, the packet type identification device 11 confirms the destination and identifies the neutral packet.
For packets addressed to the attacked server 1, for example, assuming a TCP step syn-flood attack, packets with the TCP step syn flag set are identified as non-priority packets, and other TCP packets are identified as priority packets. To do.
The packet identified by the packet type identification device 11 as a priority packet is transferred to the token remaining amount calculation device 13. The packet identified as the non-priority packet is transferred to the non-priority packet transmission determination device 12. The packet identified as the neutral packet is transferred to the packet transmission device 14. Devices other than the packet type identification device 11 have the same functions as the device shown in FIG.

FIG. 8 is a flowchart showing a processing procedure in the case where the non-priority packet storage device 15 is provided as the bandwidth control device according to the second embodiment of the present invention and there is a neutral packet passing.
The flowchart of FIG. 8 is obtained by adding processing when the packet type identification device 11 identifies a neutral packet in step S2 of FIG. 5-1, and the other parts are the same as FIG. 5-1.
In step S2, when the packet type identification device 11 identifies a neutral packet, the packet type identification device 11 transfers the neutral packet to the packet transmission device 14, and the packet transmission device 14 transmits the neutral packet (step S21). .
As described above, a neutral packet destined for another server 5 located in the same user network 3 as the attacked server 1 can be processed so as not to perform bandwidth control by a token, and the queue function and priority are given to this. Therefore, it is possible to perform bandwidth control that allows the non-priority packet to make maximum use of the surplus bandwidth of the priority packet in the control target without providing a function for causing the priority packet to be measured and without measuring the traffic amount of the priority packet.
Although illustration is omitted, when the packet type identification device 11 identifies a neutral packet in step S2 of the flowchart of FIG. 5-2 showing the processing procedure in the case where the non-priority packet storage device 15 is not provided, the packet The type identification device 11 may transfer the neutral packet to the packet transmission device 14, and the packet transmission device 14 may transmit the neutral packet.

As described above, according to the present embodiment, the priority packet of the control target can be controlled without providing the queue function and the function for giving priority to the queue function and without measuring the traffic amount of the priority packet. Bandwidth control that allows the non-priority packet to make maximum use of the surplus bandwidth is possible.
With the bandwidth control device of this embodiment, regular traffic can be communicated to the maximum without stopping the server under attack, which is the target of traffic during a DDoS attack, and the service can be maximized even during an attack. It becomes possible to continue providing.
Furthermore, it is possible to take a countermeasure that does not hinder the communication of the neutral packet that is required when the packet that does not go to the attacked server 1 passes through the bandwidth control device of this embodiment.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure for demonstrating the principal point of the 1st, 2nd zone | band control method of this invention. It is a figure for demonstrating the principal point of the 3rd zone | band control method of this invention. It is a figure which shows the network environment where the bandwidth control apparatus of Example 1 of this invention is applied. It is a block diagram which shows schematic structure of the zone | band control apparatus of Example 1 of this invention. 7 is a flowchart showing a processing procedure in a case where a non-priority packet storage device is provided as a processing procedure of the bandwidth control device according to the first embodiment of the present invention. It is a flowchart which shows the process sequence in the case where a nonpriority packet storage apparatus is not provided as a process sequence of the bandwidth control apparatus of Example 1 of this invention. It is a figure which shows the network environment where the bandwidth control apparatus of Example 2 of this invention is applied. It is a block diagram which shows schematic structure of the zone | band control apparatus of Example 2 of this invention. It is a flowchart which shows the process sequence in the case where a non-priority packet storage apparatus is provided as a bandwidth control apparatus of Example 2 of this invention, and there exists passage of a neutral packet.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Server under attack 2 Edge device 3 User network 4 Network provider network 5 Another server 10 Packet receiving device 11 Packet type identification device 12 Non-priority packet transmission judgment device 13 Token remaining amount calculation device 14 Packet transmission device 15 Non-priority packet accumulation Device 16 Token issuing device 17 Token storage device

Claims (6)

A bandwidth control method for controlling the bandwidth of a non-priority packet with respect to a plurality of types of supplied packets,
A token that is issued at a constant rate per unit time and permits a packet transmission of a predetermined amount of data is stored in the token storage device ,
Identify the packet types of the supplied packets as priority packets and non-priority packets,
Even if there are insufficient tokens when sending the priority packet, the priority packet is sent and the token remaining amount is allowed to be a negative value, and when the packet is sent, the amount of packet data is stored in the token storage device. To calculate the remaining token amount, and store the result of the calculation in the token storage device as the remaining token amount,
Compare the amount of packet data that can be permitted for transmission with the remaining amount of tokens stored in the token storage device and the amount of non-priority packets to be transmitted, and send the non-priority packets when they are equal or larger A bandwidth control method characterized by permitting. When not sending the non-priority packet, accumulate the non-priority packet in a non-priority packet storage device ,
Token is supplied to the token storage device, when the permit possible token transmission of the non-priority packets on the token storage device is accumulated, in claim 1, characterized in that sequentially sends the non-priority packet The bandwidth control method described. Define a neutral packet in addition to the priority packet and the non-priority packet,
Identifying the packet type of the supplied packet as the priority packet, the non-priority packet, or the neutral packet,
3. The bandwidth control method according to claim 1, wherein the neutral packet is transmitted without consuming a token. A bandwidth control device that controls the bandwidth of a non-priority packet with respect to a plurality of types of supplied packets,
A packet type identification device for identifying a packet type of a supplied packet into a priority packet and a non-priority packet;
A token issuing device that issues a token permitting packet transmission of a predetermined amount of data at a constant rate per unit time;
A token storage device for storing tokens issued by the token issuing device;
Even if there are insufficient tokens when sending the priority packet, the priority packet is sent and the token remaining amount is allowed to be a negative value, and when the packet is sent, the amount of packet data is stored in the token storage device. A token remaining amount calculating device for calculating the remaining amount of tokens by consuming the token being stored, and storing the result of the calculation in the token storage device as the remaining token amount;
Compare the amount of packet data that can be sent out with the remaining amount of tokens stored in the token storage device and the amount of data in the non-priority packet that you want to send, and allow sending of the non-priority packet when the former is equal or larger And a non-priority packet transmission judging device. Said accumulated non-priority packets when not sending a non-priority packet, the token is supplied to the token storage device, when the permit possible token transmission of the non-priority packets on the token storage device is accumulated, The bandwidth control device according to claim 4, further comprising a non-priority packet storage device for sequentially transmitting the non-priority packets. Define a neutral packet in addition to the priority packet and the non-priority packet,
The packet type identification device identifies the packet type of the supplied packet as the priority packet, the non-priority packet, and the neutral packet,
6. The bandwidth control apparatus according to claim 4, wherein the neutral packet is transmitted without consuming a token.

Images