JP4568751B2 - Name resolution device, name resolution method, and socket management method - Google Patents

Description

  The present invention relates to a name resolution device, a name resolution method, and a socket management method.

  A name resolution device called a DNS (Domain Name System) server searches for an address of a web server or the like from the name of a web server or the like in a name resolution request transmitted from a personal computer or the like, and performs name resolution including the address By sending a response to a personal computer or the like, the personal computer can access a web server or the like.

  FIG. 7 is a sequence diagram showing the operation of the conventional name resolution apparatus.

  The name resolution device 1a generates the socket SC1 (step S101). The other computer 2 transmits a name resolution request (step D101). If the name resolution device 1 a stores an address corresponding to the name in the name resolution request, the name resolution device 1 a generates a name resolution response including the address and transmits the name resolution response to the computer 2.

  On the other hand, if not stored, the name resolution device 1a generates a name resolution request including the randomly generated transaction ID, the name, and the port number indicating the socket SC1, and transmits it to the name resolution device 3 (step S103). ).

  In response to the name resolution request, the name resolution device 1a receives the name resolution response transmitted from the name resolution device 3 to the port number using the socket SC1 (step S105), and the transaction in the name resolution response. When the transaction IDs composed of the ID and the transaction ID in the name resolution request match, a name resolution response including the address in the name resolution response is generated, and the name resolution response is transmitted to the computer 2 (step S107). ). Thereby, the computer 2 can access a computer (such as a server) having the name by designating the address. Further, the name resolution device 1a stores the name and address in association with each other for the next time.

  The name resolution device 1a may be attacked by the malicious computer 4. This attack is made to allow the computer 2 to access a fake server and steal the credit card number entered by the user of the computer 2.

  For example, the computer 2 transmits a name resolution request again (step D103), and the malicious computer 4 transmits, for example, a fake name resolution response (step E101). Here, the malicious computer 4 sends a large number of fake name resolution responses including a randomly determined transaction ID and a fake server address to the name resolution device 1a addressed to the randomly determined port number. (Step E101).

  Since the malicious computer 4 randomly determines the port number, it is unlikely that this is the correct port number. That is, it is unlikely that the name resolution device 1a receives a fake name resolution response using the socket SC1. However, since the socket SC1 remains generated and the port number remains unchanged, it is not completely received (step S115). Moreover, before that, the name resolution device 1a has transmitted a name resolution request to the name resolution device 3 (step S113), and the transmission of the regular name resolution response is received from the reception of the fake name resolution response (S115). If the transaction IDs of the transaction IDs in the fake name resolution response and the transaction IDs in the name resolution request match with each other (step S117), the fake address in the name resolution response Is generated, and the name resolution response is transmitted to the computer 2 (step S114). Further, the name resolution device 1a stores the fake address.

  FIG. 8 is a sequence diagram showing the operation of another conventional name resolution apparatus.

  The name resolution device 1b is for solving such inconvenience. When the computer 2 transmits a name resolution request (step D201), the name resolution device 1b generates a socket SC1 (step S201).

  When the name resolution device 1b does not store an address corresponding to the name in the name resolution request, the name resolution device 1b generates a name resolution request including the transaction ID, the name, and the port number of the socket SC1, and transmits it to the name resolution device 3. (Step S203).

  The name resolution device 1b receives the name resolution response using the socket SC1 (step S207), discards the socket SC1 (step S209), and transmits the name resolution response to the computer 2 (step S211).

  When the next name resolution request is transmitted (step D211), the name resolution device 1b generates a socket SC2 that is different from the socket SC1 (step S211).

  If the address is not stored, the name resolution device 1b generates a name resolution request including the port number of the socket SC2 different from the port number of the socket SC1, and transmits it to the name resolution device 3 (step S213).

  For example, the malicious computer 4 transmits a fake name resolution response when the socket SC2 exists (step E201). Among them, there may be a name resolution response addressed to the port number of the socket SC1, and if the name resolution response is transmitted when the socket SC1 exists, the name resolution response is sent to the name resolution device 1b. However, since the socket SC2 is different from the socket SC1, it is not actually received.

  Therefore, according to the name resolution device 1b, before the name resolution response addressed to the port number of the socket SC2 is transmitted and the name resolution response is received, the regular name resolution response is received (step S215), and the socket is resolved. SC2 is discarded (step S217), a regular name resolution response is transmitted to the computer 2 (step S219), and the possibility that the regular address is stored in the name resolution device 1b itself can be increased.

The following Non-Patent Document 1 includes a description of reusing sockets (P.5) and a description of randomly generating sockets (P.7).
Joe Stewart GCIH, "DNS Cache Poisoning-The Next Generation", [online], Internet <URL: http: //www.lurhq.com/dnscache.pdf>

  However, since the name resolution device 1b performs socket generation and destruction for each name resolution, a great amount of processing capacity is used for socket generation and destruction.

  On the other hand, since the name resolution device 1a keeps generating the socket and does not discard the socket, there is a high possibility that a fake name resolution response is transmitted to the computer and the fake address is stored in itself.

  The present invention has been made in view of such a problem, and an object of the present invention is to reduce the processing capacity used for creating and destroying a socket and to transmit a fake name resolution response and fake it. An object of the present invention is to provide a name resolution device, a name resolution method, and a socket management method that can reduce the possibility of storing an address.

In order to solve the above-mentioned problem, the present invention of claim 1 includes a name resolution information database in which a computer name and a computer address are stored in association with each other, and a computer that has transmitted a name resolution request including a name. A name resolution request receiving unit that receives the name resolution request and a name resolution response that includes the address of the computer having the name, and transmits the name resolution response to the computer that transmitted the name resolution request. , An address search unit that attempts to search the name resolution information database for an address associated with the name in the name resolution request received by the name resolution request reception unit, and another name resolution device. Socket creation, which is the creation time of the socket created to be used to receive the name resolution response If the address cannot be retrieved and the socket generation time storage unit in which the time is stored, the socket generation time is read from the socket generation time storage unit, and the difference between the socket generation time and the time at which the address could not be retrieved A socket update unit that determines whether or not the difference exceeds a preset threshold, and a transaction ID that is randomly generated when the socket update unit determines that the difference does not exceed A name resolution request transmitting unit that generates a name resolution request including the name and a port number indicating a socket determined not to exceed the name, and transmits the name resolution request to the other name resolution device, and the name resolution In response to the request, the name resolution response sent from the name resolution device to the port number is received using the socket. It is determined whether or not the transaction IDs composed of the transaction ID in the name resolution response and the transaction ID in the name resolution request match. If it is determined that they match, the address in the name resolution response is set to the name resolution response. A name resolution apparatus including a name resolution response reception unit to be given to the transmission unit is used as a resolution means.
The present invention of claim 2 is a name resolution information database in which a name of a computer and an address of the computer are stored in association with each other, and a name that receives the name resolution request from a computer that has transmitted the name resolution request including the name. A resolution request receiving unit; a name resolution response including an address of a computer having the name; and a name resolution response transmitting unit that transmits the name resolution response to the computer that transmitted the name resolution request; and the name resolution request reception an address searching unit See attempt to search an address associated with the name in the received name resolution request by parts from the name resolution information database, to receive name resolution responses sent from other name resolution device socket raw socket generation time is the generation time of the socket to be generated for use is stored A time storage unit, if the previous SL address can not be retrieved, reading a socket generation time from the socket generation time storage unit, obtains the difference between the time at which the socket creation time and the address can not be retrieved, the difference determines whether exceeds a preset threshold, if it is determined that more than to discard a socket which is determined as exceeding the, produce different socket with the socket, the Instead of the socket generation time of the socket generation time storage unit, a socket update unit that stores the socket generation time of the socket in the socket generation time storage unit, and a transaction ID that is randomly generated when the address cannot be retrieved , names that contain a port number indicating the determined socket or the generated socket does not exceed pre-register before and the Solve generate a request, the name resolution request transmitting unit that transmits the name resolution request to the other name resolution device, the name resolution response with respect to the name resolution request sent from the name resolution device addressed to the port number Is received using the socket, and it is determined whether the transaction IDs of the transaction ID in the name resolution response and the transaction ID in the name resolution request match. and solutions with a name resolution device, characterized in that it comprises a name resolution response receiving unit giving the address name resolution in response to the name resolution response transmission unit.

According to a third aspect of the present invention , the name stored in the name resolution information database is associated with a name in the name resolution request received by the name resolution request receiving unit and an address given to the name resolution response transmitting unit. A resolution information database update unit is provided, and the name resolution device according to claim 1 or 2 is used as a resolution means.

The present invention of claim 4 includes a name resolution information database in which a computer name and an address of the computer are stored in association with each other, and a name that receives the name resolution request from the computer that has transmitted the name resolution request including the name. A resolution request receiving unit; an address search unit that attempts to search the name resolution information database for an address associated with a name in the name resolution request received by the name resolution request receiving unit; and another name resolution device A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated to be used for receiving a name resolution response transmitted from the socket, and if the address cannot be retrieved, the socket generation time The socket creation time can be read from the storage unit, and the socket creation time and address can be retrieved. Find the difference with the time taken, determine whether or not the difference exceeds a preset threshold, and if determined to exceed, discard the socket determined to exceed, A socket update unit that generates a socket different from the socket and stores the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time of the socket generation time storage unit, The name resolution device is used as the resolution means.

According to the present invention of claim 5 , when a socket is generated by the socket update unit, a name resolution request including a randomly generated transaction ID, the name, and a port number indicating the generated socket is generated. A name resolution request transmission unit for transmitting the name resolution request to the other name resolution device; and a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request through the socket. The name resolution response receiving unit that determines whether the transaction IDs of the transaction ID in the name resolution response and the transaction ID in the name resolution request match, and the transaction IDs are If it is determined that they do not match, the socket that exists when it is determined that they do not match is discarded, and A second socket updating unit that generates a socket different from the socket and stores the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time stored in the socket generation time storage unit; The name resolution apparatus according to claim 4 is used as a resolution means.

The present invention of claim 6 is a name resolution information database in which a computer name and an address of the computer are stored in association with each other, and a name that receives the name resolution request from the computer that has transmitted the name resolution request including the name. A resolution request receiving unit; an address search unit that attempts to search the name resolution information database for an address associated with a name in the name resolution request received by the name resolution request receiving unit; and another name resolution device A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated to be used for receiving a name resolution response transmitted from the socket, and if the address cannot be retrieved, the socket generation time The socket creation time can be read from the storage unit, and the socket creation time and address can be retrieved. A socket update unit that determines a difference from the taken time and determines whether or not the difference exceeds a preset threshold; and when the socket update unit determines that the difference does not exceed A name resolution request including the generated transaction ID, the name, and a port number indicating a socket determined not to exceed the name, and transmitting the name resolution request to the other name resolution device. And the name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket, and the transaction ID and the name resolution in the name resolution response are received. A name resolution response receiver for determining whether or not transaction IDs consisting of transaction IDs in the request match, and the transaction If it is determined that the application IDs do not match, the socket that exists when it is determined that the IDs do not match is discarded, and a socket different from the socket is generated and stored in the socket generation time storage unit. Instead of the socket generation time, the name resolution device includes a second socket update unit that stores the socket generation time of the socket in the socket generation time storage unit .

The present invention of claim 7 is a name resolution method performed by a name resolution device, wherein the name resolution device includes a name resolution information database in which a computer name and a computer address are stored in association with each other; A socket generation time storage unit that stores a socket generation time, which is a generation time of a socket generated for use in receiving a name resolution response transmitted from the name resolution device. The name resolution request receiving unit of the name resolution device receives the name resolution request from the computer that has transmitted the name resolution request including the name, and the address search unit of the name resolution device sets the name in the name resolution request. Attempting to retrieve the associated address from the name resolution information database; and a socket of the name resolution device When the new part cannot retrieve the address, the step of reading the socket generation time from the socket generation time storage unit, and the socket update unit, the socket generation time and the time when the address could not be searched A step of obtaining a difference; a step in which the socket update unit determines whether the difference exceeds a preset threshold; and a name resolution request transmission unit of the name resolution device includes the socket update unit When it is determined that the number does not exceed, a name resolution request including a randomly generated transaction ID, the name, and a port number indicating a socket determined not to exceed the name is generated, and the name resolution request is A step of transmitting to the other name resolution device, and a name resolution response receiving unit of the name resolution device Receiving a name resolution response transmitted from the other name resolution device to the port number in response to the request using the socket; and the name resolution response receiver receives a transaction ID in the name resolution response. And the transaction ID consisting of the transaction ID in the name resolution request, and the name resolution response receiving unit determines that they match, the address in the name resolution response is Providing to the name resolution response transmission unit of the name resolution device, and the name resolution response transmission unit generating a name resolution response including the address and transmitting the name resolution response to the computer. A feature name resolution method is used as a resolution means.

The present invention of claim 8 is a name resolution method performed by a name resolution device, wherein the name resolution device includes a name resolution information database in which a name of a computer and an address of the computer are stored in association with each other; A socket generation time storage unit that stores a socket generation time, which is a generation time of a socket generated for use in receiving a name resolution response transmitted from the name resolution device. The name resolution request receiving unit of the name resolution device receives the name resolution request from the computer that has transmitted the name resolution request including the name, and the address search unit of the name resolution device sets the name in the name resolution request. Attempting to retrieve the associated address from the name resolution information database; and a socket of the name resolution device When the new part cannot retrieve the address, the step of reading the socket generation time from the socket generation time storage unit, and the socket update unit, the socket generation time and the time when the address could not be searched A step of obtaining a difference, a step in which the socket updating unit determines whether or not the difference exceeds a preset threshold, and a socket that the socket updating unit has determined to be exceeded is discarded. A step in which the socket update unit generates a socket different from the socket, and the socket update unit sets the socket generation time of the socket in place of the socket generation time in the socket generation time storage unit. A step of storing in the generation time storage unit, and a name resolution request transmitting unit of the name resolution device, Generating a name resolution request including the transaction ID, the name, and the port number indicating the generated socket, and transmitting the name resolution request to the other name resolution device; Receiving a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket; and receiving the name resolution response Determining that the transaction IDs of the transaction ID in the name resolution response and the transaction ID in the name resolution request match, and the name resolution response receiving unit determines that they match And providing an address in the name resolution response to the name resolution response transmitter of the name resolution device. A name resolution response transmitting unit of the name resolution device generates a name resolution response including the address, and transmits the name resolution response to the computer. To do.
In the ninth aspect of the present invention, the name resolution information database update unit of the name resolution device uses the name in the name resolution request received by the name resolution request reception unit and the address given to the name resolution response transmission unit. 9. The name resolution method according to claim 7 or 8, comprising the step of storing the name resolution information database in association with each other.
The present invention of claim 10 is a socket management method performed by a name resolution device, wherein the name resolution device stores a name resolution information database in which a computer name and an address of the computer are stored in association with each other; A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated to be used for receiving a name resolution response transmitted from the name resolution device of the socket, and the socket management method includes: The name resolution request receiving unit of the name resolution device receives the name resolution request from the computer that has transmitted the name resolution request including the name, and the address search unit of the name resolution device sets the name in the name resolution request. Attempting to retrieve the associated address from the name resolution information database; and the name resolution device. When the socket update unit cannot find the address, the step of reading the socket generation time from the socket generation time storage unit, and the socket update unit, the socket generation time and the time when the address could not be searched, Determining the difference between the socket updating unit, determining whether the difference exceeds a preset threshold value, and discarding the socket determined by the socket updating unit to exceed And the socket updating unit generates a socket different from the socket, and the socket updating unit replaces the socket generation time of the socket generation time storage unit with the socket generation time of the socket. Socket management method comprising the step of storing in a socket generation time storage unit With a the resolution means.
In the eleventh aspect of the present invention, the name resolution request transmission unit of the name resolution device generates a name resolution request including a randomly generated transaction ID, the name, and a port number indicating the generated socket, and A step of transmitting a name resolution request to the other name resolution device; and a name resolution response receiving unit of the name resolution device is transmitted from the other name resolution device to the port number in response to the name resolution request. The step of receiving a name resolution response using the socket, and whether the name resolution response reception unit matches the transaction IDs of the transaction ID in the name resolution response and the transaction ID in the name resolution request The step of determining whether or not the second socket update unit of the name resolution device A step of discarding a socket existing when it is determined not to perform, a step of generating a socket different from the socket by the second socket update unit, and the second socket update unit of the socket 11. The method according to claim 10, further comprising: storing the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time stored in the generation time storage unit. Means.
The present invention of claim 12 is a socket management method performed by a name resolution device, wherein the name resolution device includes a name resolution information database in which a computer name and a computer address are stored in association with each other; A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated to be used for receiving a name resolution response transmitted from the name resolution device of the socket, and the socket management method includes: The name resolution request receiving unit of the name resolution device receives the name resolution request from the computer that has transmitted the name resolution request including the name, and the address search unit of the name resolution device sets the name in the name resolution request. Attempting to retrieve the associated address from the name resolution information database; and the name resolution device. When the socket update unit cannot find the address, the step of reading the socket generation time from the socket generation time storage unit, and the socket update unit, the socket generation time and the time when the address could not be searched, Determining the difference between the socket, the socket updating unit determining whether the difference exceeds a preset threshold value, and the name resolution request transmitting unit of the name resolution device is configured to update the socket. The name resolution request including the randomly generated transaction ID, the name, and the port number indicating the socket determined not to exceed the transaction ID. To the other name resolution device, and a name resolution response receiving unit of the name resolution device Receiving a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket; and the name resolution response reception unit includes the name resolution response in the name resolution response. The step of determining whether or not the transaction IDs consisting of the transaction ID and the transaction ID in the name resolution request match, and the second socket update unit of the name resolution device does not match the transaction IDs. If it is determined, the step of discarding sockets that exist when it is determined that they do not match, the step of generating a socket different from the socket by the second socket update unit, The socket update unit replaces the socket generation time stored in the socket generation time storage unit with the socket And storing the socket generation time in the socket generation time storage unit as a solution means.

The present invention of claim 13 is a computer program for configuring the name resolution device according to any one of claims 1 to 6 by a computer.

The fourteenth aspect of the present invention provides a computer-readable recording medium storing the computer program according to the thirteenth aspect as a solving means.

  According to the present invention, it is possible to reduce the processing capacity used for creating and destroying sockets, and to reduce the possibility of sending a fake name resolution response and storing a fake address.

  Hereinafter, a name resolution device, a name resolution method, and a socket management method according to embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing the configuration of the name resolution apparatus according to the first embodiment.

  The name resolution device 1 includes a name resolution information database 11 in which the name of another computer such as a web server and the address of the computer are stored in association with each other, and a computer such as a personal computer that has transmitted a name resolution request including the name Name resolution request receiving unit 12 that receives the name resolution request from the server, and generates a name resolution response including the address of the computer having the name, and transmits the name resolution response to the computer that transmitted the name resolution request When it is attempted to search the name resolution information database 11 for an address associated with the name in the name resolution request received by the response transmission unit 13 and the name resolution request reception unit 12, and the address can be retrieved, An address search unit 14 for giving an address to the name resolution response transmission unit 13; A socket generation time storage unit 15 for storing a socket generation time, which is a generation time of a socket used for receiving a name resolution response transmitted from a name resolution device (not shown), a first socket, and a socket of the socket If the socket generation unit 16 that stores the generation time in the socket generation time storage unit 15 and the address cannot be searched, the socket generation time is read from the socket generation time storage unit 15 and the socket generation time and the address cannot be searched. It is present when it is determined that the difference is exceeded, if it is determined that the difference exceeds the preset threshold Discard the socket, generate a socket different from the socket, and replace the socket generation time in the socket generation time storage unit 15 with The socket update unit 17 that stores the socket generation time of the socket in the socket generation time storage unit 15, and the name resolution received by the name resolution request reception unit 12 when the randomly generated transaction ID and address cannot be retrieved. A name resolution request including a name in the request and a port number indicating the generated socket, and transmitting the name resolution request to a name resolution device (not shown); On the other hand, a name resolution response transmitted from the name resolution device (not shown) to the port number is received using the socket, and a transaction consisting of the transaction ID in the name resolution response and the transaction ID in the name resolution request If it is determined whether or not the IDs match, A name resolution response receiving unit 19 that gives an address in the name resolution response to the name resolution response transmitting unit 13, and a name resolution request receiving unit when an address is given to the name resolution response transmitting unit 13 by the name resolution response receiving unit 19 12, the name resolution information database update unit 110 that stores the name in the name resolution request received in FIG. 12 and the address in the name resolution information database 11 in association with each other, the transaction ID storage unit 111 that stores the transaction ID, The timer 112 which measures time is provided with the threshold value memory | storage part 113 in which a threshold value is memorize | stored.

(Operation of the name resolution device 1 according to the first embodiment)
FIG. 2 is a flowchart showing the operation of the name resolution device 1. FIG. 3 is a sequence diagram showing the operation of the name resolution device 1.

  First, the socket generation unit 16 of the name resolution device 1 generates the socket SC1 (step S1), obtains the current time, that is, the socket generation time that is the time when the socket SC1 was generated from the timer 112, and generates the socket generation time as the socket generation. The time is stored in the time storage unit 15 (step S3).

  Next, the name resolution request receiving unit 12 waits for a name resolution request transmitted from another computer 2. If the name resolution request is transmitted (step D1) and the name resolution request receiving unit 12 receives the name resolution request (step S5: YES), the address search unit 14 addresses corresponding to the name in the name resolution request. Is searched from the name resolution information database 11 (step S7). If the address can be searched (step S9: YES), the address search unit 14 gives the address to the name resolution response transmission unit 13, and the name resolution response transmission unit 13 generates a name resolution response including the address. The name resolution response is transmitted to the computer 2 that transmitted the name resolution request (step S11), and the control returns to step S5.

  When the address cannot be searched, the socket updating unit 17 first acquires the current time, that is, the time when the address could not be searched from the timer 112 (step S13). The socket updating unit 17 also reads the socket generation time from the socket generation time storage unit 15 (step S15). Next, the socket updating unit 17 obtains a difference between the socket generation time and the time when the address could not be retrieved (step S17). The socket update unit 17 reads the threshold value from the threshold value storage unit 113 and determines whether or not the difference exceeds the threshold value (step S19). If it is determined that it does not exceed (NO at Step S17), the name resolution request transmission unit 18 randomly generates a transaction ID, stores the transaction ID in the transaction ID storage unit 111, and searches for the transaction ID and address. The name in the name resolution request received by the name resolution request receiving unit 12 when it could not be made and the socket existing at this time (here, the socket SC1 existing when it is determined that the name does not exceed the name) A name resolution request including a port number indicating () is generated, and the name resolution request is transmitted to another name resolution device 3 (step S21).

  The transaction ID is, for example, 16-bit information, and one of about 65000 values that can be expressed by 16 bits is randomly generated.

  The port number is also 16-bit information, for example, and one of about 65000 values that can be expressed by 16 bits is assigned to the socket.

  The name resolution device 3 is called, for example, a DNS authority server. The name resolution device 3 retrieves the address of the computer having the name from the name in the name resolution request transmitted from the name resolution device 1 and transmits the name resolution response including the address to the name resolution device 1 and the like It is.

  Next, the name resolution response receiver 19 receives the name resolution response transmitted from the name resolution device 3 to the port number in response to the name resolution request using the socket SC1 (step S23). Next, the name resolution response receiving unit 19 reads the transaction ID, that is, the same transaction ID in the name resolution request transmitted to the name resolution device 3 from the transaction ID storage unit 111, and the transaction ID in the name resolution response. It is determined whether or not the transaction IDs composed of the transaction IDs read from the transaction ID storage unit 111 match (step S25). When it is determined that they match (step S25: YES), the name resolution response receiver 19 gives the address in the name resolution response to the name resolution response transmitter 13, and the name resolution response transmitter 13 includes the name including the address. A resolution response is generated, and the name resolution response is transmitted to the computer 2 that has transmitted the name resolution request received by the name resolution request receiving unit 12 prior to the given address (step S27).

  Next, the name resolution response receiving unit 19 gives the address in the name resolution response to the name resolution information database update unit 110, and the name resolution information database update unit 110 gives a name resolution request in advance when the address is given. The name in the name resolution request received by the receiving unit 12 and the address are associated with each other and stored in the name resolution information database 11 (step S29). If it is determined that the transaction IDs do not match (step S25: NO), or after the name and address are stored in the name resolution information database 11, the control returns to step S5.

  The above operation is similarly performed even when a name resolution request is transmitted from a computer other than the computer 2. The above operation is performed in the same manner regardless of the timing at which the name resolution request is transmitted.

  For example, the next name resolution request is transmitted from the computer 2 (step D3), and then it is determined that the difference between the socket generation time and the time when the address could not be retrieved exceeds the threshold (step S19). : YES), the socket update unit 17 discards the socket, that is, the socket SC1 existing when it is determined that the socket is exceeded (step S31), and generates a socket SC2 different from the socket (step S33). The port number indicating the socket SC1 and the port number indicating the socket SC2 are different from each other.

  The socket update unit 17 also obtains the current time, that is, the socket generation time of the socket SC2 from the timer 112, and stores the socket generation time of the socket SC2 in place of the socket generation time of the socket generation time storage unit 15. The data is stored in the unit 15 (step S35).

  Next, the name resolution request transmission unit 18 randomly generates a transaction ID, stores the transaction ID in the transaction ID storage unit 111, and when the transaction ID and address cannot be retrieved, the name resolution request reception unit 12 generates a name resolution request including the name in the name resolution request received by the terminal 12 and the port number indicating the socket existing at this time (the generated socket SC2 in this case). To the name resolution device 3 (step S21). The description of the operation after step S23 is redundant and will be omitted.

For example, the malicious computer 4 transmits a fake name resolution response when the socket SC2 exists (step E51). Among them, there may be a name resolution response addressed to the port number of the socket SC1, and if the name resolution response is transmitted when the socket SC1 exists, the name resolution response is sent to the name resolution device 1. However, since the socket SC2 is different from the socket SC1, it is not actually received.
Therefore, before the name resolution response addressed to the port number of the socket SC2 is transmitted from the malicious computer 4 and the name resolution response is received, the regular name resolution response can be received (step S23). The response can be transmitted to the computer 2 (step S27), and the possibility that the regular address can be stored in the name resolution device 1 can be increased.

  That is, the name resolution device 1 does not keep generating sockets, but periodically generates and discards sockets, so a fake name resolution response is sent to the computer 2 and itself stores a fake address. The possibility can be reduced.

  Further, the name resolution device 1 performs the generation and destruction of the socket when it is determined that the difference between the socket generation time and the time when the address could not be retrieved exceeds the threshold value. The number of sockets created and destroyed per unit time can be reduced compared to the case where sockets are created and destroyed for each name resolution, and as a result, the processing capacity used for socket creation and destruction Can be reduced.

  For example, when the name resolution device 1 performs name resolution 15000 times per second, if the threshold is set to 500 [milliseconds], the name resolution response can be received 7500 times from the name resolution device 3 using the same socket. , The processing capacity used to create and destroy sockets can be reduced by a factor of 7500.

That is, according to the name resolution device 1, it is possible to reduce the processing capacity used for socket generation and destruction, and to reduce the possibility of sending a fake name resolution response and storing a fake address. [Second Embodiment]
FIG. 4 is a block diagram showing the configuration of the name resolution apparatus according to the second embodiment.

  Since the name resolution device 1A includes the same components as the name resolution device 1, they are denoted by the same reference numerals and will not be described in detail.

  In addition to the components of the name resolution device 1, the name resolution device 1 </ b> A, when the name resolution response reception unit 19 determines that the transaction IDs do not match, identifies the socket that exists when it is determined that the transaction IDs do not match A second socket that discards and generates a socket different from the socket, and stores the socket generation time of the socket in the socket generation time storage unit 15 instead of the socket generation time stored in the socket generation time storage unit 15 An update unit 114 is provided.

(Operation of the name resolution apparatus 1A according to the second embodiment)
FIG. 5 is a flowchart showing the operation of the name resolution device 1A. FIG. 6 is a sequence diagram showing the operation of the name resolution device 1A.

  Since the flowchart of the name resolution device 1A includes the same steps as those constituting the flowchart of the name resolution device 1, they are denoted by the same reference numerals and detailed description thereof is omitted.

  In the name resolution device 1A, when it is determined that the transaction IDs do not match (step S25: NO), the control does not return to step S5, but the second socket update unit 114 determines that they do not match Is discarded (step S41), and a socket different from the socket is generated (step S1). The socket update unit 17 also acquires the current time, that is, the socket generation time of a new socket from the timer 112, and stores the socket generation time of the socket in place of the socket generation time of the socket generation time storage unit 15. The data is stored in the unit 15 (step S3), and the control proceeds to step S5.

  For example, the malicious computer 4 transmits a fake name resolution response when the socket SC2 exists (step E51). If there is a name resolution response addressed to the port number of the socket SC2, the name resolution response is received by the name resolution device 1A (step E511).

  However, it is rare that the transaction IDs match, and in many cases, it is determined that they do not match, and the socket that exists at that time is discarded (step S41), and a new socket SC3 is generated ( Step S1).

For example, the computer 2 sends a name resolution request when the socket SC3 exists (step D5), and the malicious computer 4 sends a fake name resolution response when the socket SC3 exists, for example. (Step E53). Among them, there may be a name resolution response addressed to the port number of the socket SC2, and if the name resolution response is transmitted when the socket SC2 exists, the name resolution response is sent to the name resolution device 1A. However, since the socket SC3 is different from the socket SC2, it is not actually received.
Therefore, before the name resolution response addressed to the port number of the socket SC3 is transmitted from the malicious computer 4 and the name resolution response is received, the regular name resolution response can be received (step S23). The response can be transmitted to the computer 2 (step S27), and the possibility that the regular address can be stored in the name resolution device 1A can be increased.

  That is, since the name resolution device 1A periodically generates and discards the socket as in the name resolution device 1, a fake name resolution response is transmitted to the computer 2 compared to the case where the socket is left generated. , It is possible to reduce the possibility of storing a fake address.

  Similarly to the name resolution device 1, the name resolution device 1 </ b> A performs socket generation and destruction when it is determined that the difference between the socket generation time and the time when the address could not be retrieved exceeds a threshold value. Therefore, if the threshold value is appropriately determined, the processing capacity used for socket generation and destruction can be reduced as compared with the case where socket generation and destruction are performed for each name resolution.

That is, according to the name resolution device 1A, it is possible to reduce the processing capacity used for generating and destroying sockets, and to reduce the possibility of sending a fake name resolution response and storing a fake address. Further, since the name resolution device 1A generates and discards sockets when it is determined that the transaction IDs do not match each other, the transaction after the malicious computer 4 starts to transmit a fake name resolution response Since there are more cases where the IDs do not match each other, the number of sockets generated and discarded per unit time increases, making it difficult to receive a fake name resolution response. Therefore, after the malicious computer 4 starts to send a fake name resolution response, the possibility of sending a fake name resolution response and storing a fake address can be further reduced.

  On the other hand, before the malicious computer 4 starts to send a fake name resolution response, as described above, the socket is generated and destroyed periodically. Therefore, when the socket is generated and destroyed for each name resolution, In comparison, the processing capacity used to create and destroy sockets can be reduced.

  A computer program for configuring the name resolution device according to the present embodiment in a computer, or a computer for causing the name resolution device to execute the name resolution method or the socket management method performed by the name resolution device. The program is stored in a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, or a magnetic tape, and distributed as a display, or the computer program is transmitted via a communication network such as the Internet. You may let them.

It is a block diagram which shows the structure of the name resolution apparatus which concerns on 1st Embodiment. 3 is a flowchart showing the operation of the name resolution device 1. FIG. 4 is a sequence diagram showing an operation of the name resolution device 1. It is a block diagram which shows the structure of the name resolution apparatus which concerns on 2nd Embodiment. It is a flowchart which shows operation | movement of the name resolution apparatus 1A. It is a sequence diagram which shows operation | movement of the name resolution apparatus 1A. It is a sequence diagram which shows operation | movement of the conventional name resolution apparatus. It is a sequence diagram which shows operation | movement of the other conventional name resolution apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 1A, 3 ... Name resolution apparatus 2 ... Computer 4 ... Malicious computer 11 ... Name resolution information database 12 ... Name resolution request receiving part 13 ... Name resolution response transmission part 14 ... Address search part 15 ... Socket generation time memory | storage part 16 ... Socket generation unit 17 ... Socket update unit 18 ... Name resolution request transmission unit 19 ... Name resolution response reception unit 110 ... Name resolution information database update unit 111 ... Transaction ID storage unit 112 ... Timer 113 ... Threshold storage unit 114 ... No. 2 socket update unit

Claims (14)

A name resolution information database in which computer names and computer addresses are stored in association with each other;
A name resolution request receiving unit that receives the name resolution request from the computer that has transmitted the name resolution request including the name;
A name resolution response transmission unit that generates a name resolution response including the address of the computer having the name, and transmits the name resolution response to the computer that transmitted the name resolution request;
An address search unit that attempts to search the name resolution information database for an address associated with a name in the name resolution request received by the name resolution request reception unit;
A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated for use in receiving a name resolution response transmitted from another name resolution device;
If the address cannot be retrieved, the socket creation time is read from the socket creation time storage unit, the difference between the socket creation time and the time at which the address could not be retrieved is obtained, and the difference is set in advance. A socket updater that determines whether the value is exceeded;
When it is determined by the socket update unit that it does not exceed, a name resolution request including a randomly generated transaction ID, the name, and a port number indicating a socket determined not to exceed the name is generated, A name resolution request transmitter for transmitting a name resolution request to the other name resolution device;
In response to the name resolution request, the name resolution response transmitted from the name resolution device to the port number is received using the socket, and the transaction ID in the name resolution response and the transaction ID in the name resolution request are received. A name resolution response receiver that gives an address in the name resolution response to the name resolution response transmitter when it is determined that the transaction IDs match.
A name resolution device comprising: A name resolution information database in which computer names and computer addresses are stored in association with each other;
A name resolution request receiving unit that receives the name resolution request from the computer that has transmitted the name resolution request including the name;
A name resolution response transmission unit that generates a name resolution response including the address of the computer having the name, and transmits the name resolution response to the computer that transmitted the name resolution request;
An address searching unit See attempt to search an address associated with the name in the received name resolution request by the name resolution request receiving unit from the name resolution information database,
A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated for use in receiving a name resolution response transmitted from another name resolution device ;
If the previous SL address can not be retrieved, the read socket generation time from the socket generation time storage unit, obtains the difference between the time at which the socket creation time and the address can not be searched, to the difference preset determining whether more than a threshold, if it is determined that more than to discard a socket which is determined as exceeding the, produce different socket with the socket, the socket generation time storage unit Instead of the socket generation time, a socket update unit that stores the socket generation time of the socket in the socket generation time storage unit,
If the address can not be searched, generates a name resolution request including the port number indicating the determined socket or the generated socket does not exceed the the front and the front register transaction ID generated randomly, the A name resolution request transmitter for transmitting a name resolution request to the other name resolution device;
In response to the name resolution request, the name resolution response transmitted from the name resolution device to the port number is received using the socket, and the transaction ID in the name resolution response and the transaction ID in the name resolution request are received. transaction ID with each other to determine whether the match consisting of, if it is determined that they agree with each other, and name resolution response receiving unit giving the address of the name resolution in response to the name resolution response transmission unit
Name resolution device, characterized in that it comprises a. Name resolution information database updating unit for storing the name in the name resolution request received by the name resolution request receiving unit and the address given to the name resolution response transmitting unit in the name resolution information database in association with each other
The name resolution apparatus according to claim 1, further comprising: A name resolution information database in which computer names and computer addresses are stored in association with each other;
A name resolution request receiving unit that receives the name resolution request from the computer that has transmitted the name resolution request including the name;
An address search unit that attempts to search the name resolution information database for an address associated with a name in the name resolution request received by the name resolution request reception unit;
A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated for use in receiving a name resolution response transmitted from another name resolution device;
If the address cannot be retrieved, the socket creation time is read from the socket creation time storage unit, the difference between the socket creation time and the time at which the address could not be retrieved is obtained, and the difference is set in advance. If it is determined whether or not the value is exceeded, if it is determined that the value is exceeded, the socket determined to be exceeded is discarded, a socket different from the socket is generated, and the socket of the socket generation time storage unit A socket update unit that stores the socket generation time of the socket in the socket generation time storage unit instead of the generation time;
A name resolution device comprising: When a socket is generated by the socket update unit, a name resolution request including a randomly generated transaction ID, the name, and a port number indicating the generated socket is generated, and the name resolution request is transferred to the other A name resolution request transmission unit to be transmitted to the name resolution device;
In response to the name resolution request, the name resolution response transmitted from the other name resolution device to the port number is received using the socket, and the transaction ID in the name resolution response and the name resolution request A name resolution response receiving unit that determines whether or not transaction IDs including transaction IDs match;
If it is determined that the transaction IDs do not match, the socket that exists when it is determined that they do not match is discarded, a socket different from the socket is generated, and stored in the socket generation time storage unit A second socket update unit that stores the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time.
The name resolution apparatus according to claim 4, further comprising: A name resolution information database in which computer names and computer addresses are stored in association with each other;
A name resolution request receiving unit that receives the name resolution request from the computer that has transmitted the name resolution request including the name;
An address search unit that attempts to search the name resolution information database for an address associated with a name in the name resolution request received by the name resolution request reception unit;
A socket generation time storage unit that stores a socket generation time that is a generation time of a socket generated for use in receiving a name resolution response transmitted from another name resolution device;
If the address cannot be retrieved, the socket creation time is read from the socket creation time storage unit, the difference between the socket creation time and the time at which the address could not be retrieved is obtained, and the difference is set in advance. A socket updater that determines whether the value is exceeded;
When it is determined by the socket update unit that it does not exceed, a name resolution request including a randomly generated transaction ID, the name, and a port number indicating a socket determined not to exceed the name is generated, A name resolution request transmitter for transmitting a name resolution request to the other name resolution device;
In response to the name resolution request, the name resolution response transmitted from the other name resolution device to the port number is received using the socket, and the transaction ID in the name resolution response and the name resolution request A name resolution response receiving unit that determines whether or not transaction IDs including transaction IDs match;
If it is determined that the transaction IDs do not match, the socket that exists when it is determined that they do not match is discarded, a socket different from the socket is generated, and stored in the socket generation time storage unit A second socket update unit that stores the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time.
A name resolution device comprising: A name resolution method of name resolution device performs,
The name resolution device is generated for use in receiving a name resolution information database in which a computer name and an address of the computer are stored in association with each other and a name resolution response transmitted from another name resolution device. A socket generation time storage unit that stores a socket generation time that is a socket generation time.
The name resolution method is:
A name resolution request receiving unit of the name resolution device receives the name resolution request from a computer that has transmitted a name resolution request including a name ;
An address search unit of the name resolution device tries to search an address associated with a name in the name resolution request from the name resolution information database;
When the socket update unit of the name resolution device cannot retrieve the address, reading the socket generation time from the socket generation time storage unit;
The socket updater obtains a difference between the socket generation time and the time when the address could not be retrieved;
The socket updater determines whether the difference exceeds a preset threshold; and
Name resolution request transmitting unit of the name resolution device, by the socket updating unit, when it is determined not to exceed, showing a socket that is determined not to exceed the generated transaction ID and the name at random Generating a name resolution request including a port number and transmitting the name resolution request to the other name resolution device ;
A name resolution response reception unit of the name resolution device receives a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket;
The step of determining whether or not the name resolution response receiving unit matches a transaction ID composed of a transaction ID in the name resolution response and a transaction ID in the name resolution request;
The name resolution response receiving unit, when it is determined matching the the steps of Ru gives the address of the name resolution in response to the name resolution response transmission portion of the name resolution device,
The name resolution response transmission unit generates a name resolution response including the address, and transmits the name resolution response to the computer ;
A name resolution method characterized by including: A name resolution method of name resolution device performs,
The name resolution device is generated for use in receiving a name resolution information database in which a computer name and an address of the computer are stored in association with each other and a name resolution response transmitted from another name resolution device. A socket generation time storage unit that stores a socket generation time that is a socket generation time.
The name resolution method is:
A name resolution request receiving unit of the name resolution device receives the name resolution request from a computer that has transmitted a name resolution request including a name ;
An address search unit of the name resolution device tries to search an address associated with a name in the name resolution request from the name resolution information database;
When the socket update unit of the name resolution device cannot retrieve the address, reading the socket generation time from the socket generation time storage unit;
The socket updater obtains a difference between the socket generation time and the time when the address could not be retrieved;
The socket updater determines whether the difference exceeds a preset threshold; and
Said socket updating unit, and the discarding step the socket where it is determined as exceeding,
The socket updating unit generating a socket different from the socket;
The socket update unit stores the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time of the socket generation time storage unit;
The name resolution request transmitting unit of the name resolution device generates a name resolution request including a randomly generated transaction ID, the name, and a port number indicating the generated socket, and the name resolution request is transmitted to the other name. Sending to the resolution device ;
A name resolution response reception unit of the name resolution device receives a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket;
The step of determining whether or not the name resolution response receiving unit matches a transaction ID composed of a transaction ID in the name resolution response and a transaction ID in the name resolution request;
The name resolution response receiving unit, when it is determined matching the the steps of Ru gives the address of the name resolution in response to the name resolution response transmission portion of the name resolution device,
A name resolution response transmitter of the name resolution device generates a name resolution response including the address and transmits the name resolution response to the computer ;
A name resolution method characterized by including: The name resolution information database updating unit of the name resolution device associates the name in the name resolution request received by the name resolution request reception unit with the address given to the name resolution response transmission unit, and the name resolution information Step to store in database
9. The name resolution method according to claim 7 or 8, further comprising: A socket management method name resolution device performs,
The name resolution device is generated for use in receiving a name resolution information database in which a computer name and an address of the computer are stored in association with each other and a name resolution response transmitted from another name resolution device. A socket generation time storage unit that stores a socket generation time that is a socket generation time.
The socket management method includes:
A name resolution request receiving unit of the name resolution device receives the name resolution request from a computer that has transmitted a name resolution request including a name ;
An address search unit of the name resolution device tries to search an address associated with a name in the name resolution request from the name resolution information database;
When the socket update unit of the name resolution device cannot retrieve the address, reading the socket generation time from the socket generation time storage unit;
The socket updater obtains a difference between the socket generation time and the time when the address could not be retrieved;
The socket updater determines whether the difference exceeds a preset threshold; and
Said socket updating unit, and the discarding step the socket where it is determined as exceeding,
The socket updating unit generating a socket different from the socket;
The socket updating unit includes a step of storing the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time of the socket generation time storage unit. Name The name resolution request transmitting unit of the name resolution device generates a name resolution request including the port number indicating the transaction ID generated randomly the name and the generated socket, the name resolution request of the other Sending to the resolution device ;
A name resolution response reception unit of the name resolution device receives a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket;
The step of determining whether or not the name resolution response receiving unit matches a transaction ID composed of a transaction ID in the name resolution response and a transaction ID in the name resolution request;
The second socket update unit of the name resolution device discards a socket that exists when it is determined that the transaction IDs do not match;
The second socket update unit generates a socket different from the socket;
The second socket update unit includes a step of storing the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time stored in the socket generation time storage unit. The socket management method according to claim 10 . A socket management method name resolution device performs,
The name resolution device is generated for use in receiving a name resolution information database in which a computer name and an address of the computer are stored in association with each other and a name resolution response transmitted from another name resolution device. A socket generation time storage unit that stores a socket generation time that is a socket generation time.
The socket management method includes:
A name resolution request receiving unit of the name resolution device receives the name resolution request from a computer that has transmitted a name resolution request including a name ;
An address search unit of the name resolution device tries to search an address associated with a name in the name resolution request from the name resolution information database;
When the socket update unit of the name resolution device cannot retrieve the address, reading the socket generation time from the socket generation time storage unit;
The socket updater obtains a difference between the socket generation time and the time when the address could not be retrieved;
The socket updater determines whether the difference exceeds a preset threshold; and
Name resolution request transmitting unit of the name resolution device, by the socket updating unit, when it is determined not to exceed, showing a socket that is determined not to exceed the generated transaction ID and the name at random Generating a name resolution request including a port number and transmitting the name resolution request to the other name resolution device ;
A name resolution response reception unit of the name resolution device receives a name resolution response transmitted from the other name resolution device to the port number in response to the name resolution request using the socket;
The step of determining whether or not the name resolution response receiving unit matches a transaction ID composed of a transaction ID in the name resolution response and a transaction ID in the name resolution request;
The second socket update unit of the name resolution device discards a socket that exists when it is determined that the transaction IDs do not match;
The second socket update unit generates a socket different from the socket;
The second socket update unit includes a step of storing the socket generation time of the socket in the socket generation time storage unit instead of the socket generation time stored in the socket generation time storage unit. Socket management method to do. It claims 1 to computer program for configuring a computer name resolution device according to any one of 6. A computer-readable recording medium in which the computer program according to claim 13 is stored.

Images