JP4867949B2 - Packet transmission source identification system, packet transmission source identification method, and packet transmission source identification program - Google Patents

Description

  The present invention relates to a technique for specifying an unauthorized communication packet via a network and a source of communication access performed for a device connected to the network.

In the communication network (Internet), a large amount of communication traffic is sent to the server or communication terminal via the communication network, or malicious communication access is performed, so that the use of legitimate users is hindered, The server's operation has become a serious problem.
Further, when an attack performed through the communication network as described above is performed through a proxy server or a packet relay device that performs NAT (Network Address Translation) / NAPT (Network Address Port Translation), packet relay When the apparatus relays communication, the source address information in the packet information is rewritten.
For this reason, it is difficult to uniquely identify the attack source from the attacked side and control the communication. When an attack is performed via a plurality of packet relay devices, it is possible to identify the attack source. It was even more difficult.

On the other hand, by installing IDS (Intrusion Detection System) for each network, collecting the logs of each IDS in one place and performing correlation analysis, it is possible to identify the attacking fraudulent terminal.
However, in this case, a device for detecting an attack is required for each network, and the operational cost becomes enormous. Furthermore, when the management device that performs correlation analysis stops, the entire system does not function. .
In addition, in the case of a large-scale network where the above network is divided into multiple subnets, it is difficult to uniquely identify the attack source by log correlation analysis alone, and further, logs are collected in one place. There was a disadvantage that it would squeeze the disk.

In order to deal with the above problem, a method of identifying an unauthorized terminal by using a network system without using a proxy server and without performing address conversion can be considered.
However, in this case, since the IP addresses that can be assigned are limited, it becomes impossible to cope with an increase in the network scale.
In addition, the search range of the attack source is limited to a range where the network configuration can be grasped, and further, there are inconveniences that various merits of network operation by the proxy server cannot be obtained.

  As a related technique for this, the agent program unit preset in the network device in which the attack is detected transmits a copy (program) of the agent program unit itself that controls the attack packet to the network device closer to the attack source, Techniques for controlling attack packets going back to network devices closer to the attack source have been disclosed (Patent Documents 1 and 2).

JP 2002-164938 JP 2003-283571 A

However, both Patent Documents 1 and 2 do not consider the case where the attack is performed via a packet relay apparatus that performs address translation, and there is a disadvantage that it is difficult to specify the attack source.
In addition, by blocking all communication access via a specific packet relay device that rewrites the information of the transmission source, there may be a disadvantage that all communication from other legitimate terminals that use it is also blocked.

  Furthermore, since it is necessary to install a dedicated device for identifying the attack source on the communication network, there is a disadvantage that the operational cost increases.

[Object of invention]
The present invention improves the inconvenience of the related technology, and a packet transmission source identification system for identifying a transmission source of the packet communication when packet communication in which information indicating the transmission source is changed is performed. It is an object of the present invention to provide a method and a packet source specifying program.

  In order to achieve the above object, a packet source identification system according to the present invention performs relay transfer of a communication packet sent via a communication network and converts address information included in the communication packet during the relay transfer. And a plurality of communication terminals that communicate with each other via the relay device, wherein the relay device includes address information before and after the conversion, and each relay transfer performed by the relay device Means for storing communication specifying information for specifying the communication, means for mutually notifying the communication specifying information with another preset relay device, and when an attack packet is sent to the communication terminal And a means for specifying a source of the attack packet based on the communication specifying information.

  The packet source identification method according to the present invention includes a relay device that converts source address information of a communication packet communicated on a communication network and performs relay transfer, and a plurality of devices that communicate with each other via the relay device. A packet transmission source identification method for identifying an unauthorized terminal that is a transmission source of the attack packet when an attack packet is sent to the communication terminal, wherein each relay transfer is identified A communication identification information notification step for notifying other preset relay apparatus of communication identification information to be performed, and when the attack packet is sent from the unauthorized terminal to the communication terminal, An unauthorized terminal search requesting step for requesting a terminal search; and an unauthorized terminal specifying step for specifying the unauthorized terminal based on the communication specifying information and the search request. It is characterized in.

  Furthermore, the packet transmission source specifying program according to the present invention communicates with each other via a relay device that converts the transmission source address information of a communication packet communicated via a communication network and performs relay transfer. A packet transmission source identification program for identifying an unauthorized terminal that is a transmission source of the attack packet when an attack packet is sent to the communication terminal, When an attack packet is sent from the communication terminal to the communication terminal, an unauthorized terminal search function for searching for the unauthorized terminal and communication specifying information for specifying each relay transfer are notified to other preset relay devices. A communication identification information notifying function for performing an unauthorized terminal identification function for identifying the unauthorized terminal based on the search result and the communication identification information. It is characterized in that to execute.

  Since the present invention is configured and functions as described above, according to this, a relay apparatus that performs communication of communication packets transmits communication specific information indicating each packet communication performed via the relay apparatus to other relay apparatuses. A communication packet in which the source address information is changed is sent via the relay device. In this case, the transmission source (for example, unauthorized terminal) of the communication packet can be quickly identified.

[Embodiment]
Next, the basic configuration content of the embodiment of the present invention will be described.

As shown in FIG. 1, the packet source identification system of this embodiment includes a relay router (corresponding to a relay device) 11 and a management terminal (corresponding to a search request terminal) that are connected to each other via a communication line and set up a LAN. 12, a server (corresponding to a communication terminal) 13 for providing a service via a communication line, a proxy server 14 connected via a relay router 11 and constituting a LAN 2 different from the LAN 1, and a relay router 15 In this configuration, an unauthorized terminal 16 is connected via the relay router 15 and further connected to a different LAN 3.
Here, when the relay router 11 performs communication from the network (LAN 2) to which the proxy server 14 belongs to the network (LAN 1) to which the management terminal 12 belongs, the relay router 11 converts the information of the transmission source into its own address information (NAPT). ) Has a function.
In addition, the management terminal 12 monitors the server 13, and when an attack packet is sent to the server 13, investigates and takes countermeasures.

Further, the proxy server 14 relays access (unauthorized access) from the unauthorized terminal 16 to the server 13, and the relay router 15 connects the network (LAN 3) to which the unauthorized terminal 16 belongs to the network (LAN 2) to which the proxy server 14 belongs. It has a (NAPT) function for converting source information into its own address information when performing communication.
The unauthorized terminal 16 transmits an attack packet (or communication access) to the server 13.

Further, the packet transmission source specifying system shown in FIG. 1 can be represented as an overlay network as shown in FIG.
Here, similarly to the agent program unit 21 that controls the relay communication that is set in the relay router 11 and executed through the relay router 11, similarly, it is set in the proxy server 14 and executed through the proxy server 14. An agent program unit 22 that controls the relay communication, and an agent program unit 23 that is set in the relay router 15 and controls the relay communication that is executed via the relay router 15.

  As a result, even when an attack is performed via a proxy server that rewrites the packet transmission source (address) information or a device that performs address conversion, the attack source can be identified accurately and at high speed.

Further, FIGS. 1 and 2 show a case where an attack packet is sent from the unauthorized terminal 16 and the attack packet is sent to the server 13 via the relay router 15, the proxy server 14, and the relay router 11. 1 and 2 indicate a control request of the unauthorized terminal 16 to the relay router 15 by the management terminal 12 that has detected the attack packet sent to the server 13.
The management terminal 12 may transmit the control command and control command of the unauthorized terminal 16 to the relay router 15 via the relay router 11.

  Here, each agent program unit of the above embodiment will be described based on the block diagram of FIG.

The relay router 11 has a configuration of a general computer, such as at least a central processing unit (CPU) that performs preset arithmetic processing, a storage device that temporarily stores data and programs to be processed, and the like. An agent program unit 21 is provided that functions when the CPU executes a preset program.
Further, the relay router 11 stores, through the relay router 11, a session information management database (DB) 41 that stores and manages session information that specifies a communication session executed through the relay router 11 as a session information management table. The communication log storage unit 42 stores the communication log of the executed communication packet.

Further, the agent program unit 21 refers to the session information management table to search for and identify the unauthorized terminal 16 and the session information based on the unauthorized terminal search unit 32, the communication log of the packet relay device 11, and the session information management table. Session information collection unit 33 that transmits or updates the session information management table in the session information management DB and unauthorized terminal control request information (hereinafter referred to as “control request”) sent from another agent program unit (22, 23). And an unauthorized terminal control unit 34 for controlling communication from the unauthorized terminal 16 by controlling an adjacently connected network device (in this case, a relay router or a proxy server).
The agent program unit 21 receives session information or a control request sent from another agent program unit (22, 23), and receives the unauthorized terminal search unit 32, session information collection unit 33, and unauthorized terminal control unit. And an agent function control unit 31 that relays a control request to the agent program unit (23 in this case) of the network device closer to the attack source terminal (illegal terminal 16) as necessary. Yes.

  In the above description, the packet relay device 11 and the agent program unit 21 set in the packet relay device 11 have been described. However, the agent program unit 22 set in each of the proxy server 14 and the packet relay device 15, And 23 have the same configuration.

Here, the agent program unit may be installed not in the packet relay device (relay router or proxy server) but in another device connected to the communication network.
Further, the agent program unit may be set in the communication terminal as long as it can refer to the communication log on the other packet relay device and can control the other packet relay device.

Further, by linking the agent program unit, the attack source can be specified accurately and at high speed, and unauthorized communication can be controlled by the network device nearest to the attack source.
In addition, by relaying search requests and control requests for unauthorized terminals (attack sources) to the agent program on the packet relay device, communication from unauthorized terminals can be controlled pinpoint while maintaining network anonymity. .

Furthermore, by linking different agent program units to each other, it is possible to uniquely identify the source of the attack packet and control communication from an unauthorized terminal.
Further, the processing load on each packet relay device can be reduced by executing the processing in the agent program unit in a distributed manner in different communication terminals.

  This will be described in detail below.

  As described above, the agent program unit 21 refers to an unauthorized terminal search unit 32 that identifies an unauthorized terminal by referring to a session information management table provided in advance in the relay router 11, and a session information management database (DB) 41. A session information collection unit 33 that transmits session information to another agent program unit connected in the vicinity of the agent program unit 21 based on a session information collection rule provided in advance.

Here, in the session information management database (DB) 41, session information indicating relay communication executed by the relay router or proxy server (generally referred to as “packet relay device”) set in the session information DB 41 is stored in the session information. It is managed as a management table.
The session information management database (DB) 41 is a list of parameters (destination, protocol, etc.) specified in the communication when the agent program unit 21 communicates session information with other agent program units. The session information collection rule management table is stored.

  In addition, the session information collection unit 33 refers to the communication log storage unit 42 and the session information management DB 41, and as described above, the session information collection unit 33 stores the session information in the neighboring agent program unit set in advance based on the session information collection rule management table. And a function for updating the session information management table set in the session information management DB 41.

  Here, the communication log stored in the communication log storage unit 42 includes at least a transmission source IP address before relaying, a transmission source port number before relaying, and relaying as information for specifying an attack source terminal (illegal terminal). Source IP address after relay, source port number after relay, destination IP address before relay, destination port number before relay, destination IP address after relay, destination port number after relay, protocol number, session start time, And time information from the start to the end of the session.

Further, the agent program unit 21 has a fraudulent terminal control unit 34 that analyzes a control request sent from another agent program unit and controls an adjacent network device to restrict communication from the fraudulent terminal.
The agent program unit 21 receives session information or a control request sent from another agent program unit, and controls the unauthorized terminal search unit 32, session information collection unit 33, and unauthorized terminal control unit 34. In addition, an agent function control unit 31 is provided that transfers a control request to an agent program unit closer to the attack source as necessary.

  Further, the agent program unit 21 has a server function for receiving and processing session information and control requests, and has a standby port number designated when executing this server function as a setting parameter of the server function.

  Further, the agent program unit 21 has a downstream node list in which the IP addresses of other adjacent agent program units are registered, and when receiving the session information sent from the other agent program unit, this downstream node Session information is received only from IP addresses registered in advance in the list.

  Further, the agent program unit 21 performs a difference check between the session information holding period information indicating the period for holding the acquired session information in the session information management table and the communication log of the packet relay device adjacent to the session information collecting unit 33 Session update interval information indicating a time interval for acquiring information necessary for specifying a communication session is held.

Here, the agent function control unit 31 transmits the acquired session information to the agent program unit set in advance based on the session information collection rule set in the session information management DB 41, or It has a function of updating the session information management table in the information management DB 41.
Further, the agent function control unit 31 has a function of performing processing for discarding session information older than a preset period when the session information management table is confirmed.

As a result, the agent function control unit can mutually notify new session information within a preset period with the agent program unit connected in proximity.
For this reason, the agent program unit can perform session information distributed management by communicating and updating session information with other neighboring agent program units. Machine resources required for each packet relay apparatus can be suppressed.
The unauthorized terminal search unit 32 has a session information management table update function for updating the session information management table (FIG. 4) stored in the session information management DB 41 as necessary.

Here, each column of the session information management table shown in FIG. 4 will be described.
“Session ID” is an ID that is set for each communication session and uniquely identifies the communication session. Next, the “session key” is a source IP address after relaying the following five parameters of the session information acquired from the communication log or a nearby agent program, a source port number after relay, a destination IP address after relay, A hash value calculated by combining a destination port number after relay and a protocol number is shown.

The “session start time” indicates the start time of the communication session, and the time until the end of the session indicates the time from the start to the end of the session (in seconds).
Further, “nearest agent ID” indicates the ID of the agent program nearest to the communication source, and may be, for example, a standby IP address and a standby port number accessible from all agent program units in the LAN organization.
The “terminal node ID” is an ID indicating a communication source, and indicates an ID that can uniquely identify the communication source as seen from the latest agent program.

  In addition, the unauthorized terminal search unit 32 receives the unauthorized terminal search request information from the agent function control unit 31, and from the received request information, the IP address and port number of the victim terminal, the IP address and port number to be searched, A protocol number is acquired, and a hash value that combines the five parameters acquired here (IP address of the victim terminal, port number of the victim terminal, IP address of the search target, port number of the search target, and protocol number) It has a hash value calculation function to calculate.

  Further, the unauthorized terminal search unit 32 searches the session information management table in the session information management DB 41 using the calculated hash value and the time of the attack as a key, and determines whether there is matching session information. Has a session information determination function.

  Here, when the unauthorized terminal search unit 32 fails in the search or when the information necessary for controlling the unauthorized terminal cannot be obtained, the unauthorized terminal search unit 32 has failed to retrieve the unauthorized terminal as a search result. An error code notification function for notifying the agent function control unit 31 of an error code indicating

  In addition, the ID of the unauthorized terminal (information in the terminal node ID column of the session information management table) and the ID of the agent program nearest to the unauthorized terminal (information in the latest agent ID column of the session information management table) required for controlling the unauthorized terminal The unauthorized terminal search unit 32 notifies the agent function control unit 31 of the message indicating successful search, the ID of the unauthorized terminal, and the ID of the agent program nearest to the unauthorized terminal as a search result. It has a notification function.

  The session information collection unit 33 has a collection rule management table update function for updating the session information collection rule management table (FIG. 6) stored in the session information management DB as necessary.

Here, the meaning of each column of the session information collection rule management table shown in FIG. 6 is as follows.
“Rule ID” is an ID for uniquely identifying a session information collection rule.
“Source” indicates a source IP address after address conversion, “Destination” indicates a destination IP address after address conversion, and “Destination port number” indicates a destination port number after address conversion.
Next, “protocol number” indicates a protocol number in communication, and “transfer destination” indicates a transfer destination of session information.
The transfer destination shown here indicates a set of a standby IP address and a standby port number of the agent program unit of the transfer destination.
In addition, when the IP address and port number designated by the “forwarding destination” are the own IP address and port number, the session information collection unit 33 writes out the acquired session information as described above, Update the session information collection rule management table.
Finally, “Remarks” indicates comment information for the session information collection rule.

In addition, the session information collection unit 33 performs a difference check of communication logs in adjacent packet relay apparatuses at a preset period (session information update interval), and has a session information acquisition function for acquiring session information shown below. ing.
The contents of the session information include a source IP address before relay, a source IP address after relay, a source port number after relay, a destination IP address after relay, a destination port number after relay, a protocol number, It consists of session start time and time from session start to end.

  Here, the session information collection unit 33 normally acquires a plurality of session information and performs processing for each of the acquired session information. Here, the session information collection unit 33 applies to one specific session information. A case for processing will be described.

  In addition, after acquiring the session information, the session information collecting unit 33 compares the source IP address before relay included in the acquired session information with the downstream node list, and whether there is a matching source IP address. It has a source address determination function for determining whether or not.

  Here, when there is a matching source IP address, that is, when the source IP address is another adjacent packet relay device, the session information collection unit 33 aborts the process and performs the following process: Make it not exist.

  On the other hand, when there is no matching source IP address, the session information collection unit 33 sends the source IP address after relaying the acquired session information, the destination IP address after relay, the destination port number after relay, and the protocol The session information collection rule management table is searched using the number as a key, and it is determined whether or not the transfer destination column of the matched row specifies the relay router 11 (self) in which the session information collection unit 33 is provided. A table search determination function is provided.

Here, the session information collection unit 33, when the transfer destination column specifies the relay router 11 that is itself, the source IP address after relay, the source port number after relay, the destination IP after relay A hash value is calculated by combining the address, the destination port number after relaying, and the protocol number.
In addition, the session information collection unit 33 sets the hash value calculated here, the session start time, the time from the start to the end of the session, the ID of the agent program itself, and the ID of the host having the transmission source IP address before the relay. As a set, it has a session information additional registration function for additionally registering entries in its own session information management table.

On the other hand, the session information collection unit 33 has a session information transfer function for transmitting the acquired session information to the transfer destination agent program unit when the transfer destination column is other than the relay router 11 that is the transfer destination column. Yes.
Here, the transmitted session information includes at least a relay source IP address, a relay source port number, a relay destination IP address, a relay destination port number, a protocol number, a session start time, and a session start. To the end time, its own ID, and the ID of the host having the source IP address before relaying.

  Note that the agent function control unit 31 that has received the session information has a function of transmitting the session information to the session information collection unit 33.

  When receiving the data from the agent function control unit 31, the session information collection unit 33 transfers the session information to the neighboring agent program unit based on the session information collection rule management table as described above, A function for updating the information management table is provided.

  In addition, when transferring the received session information to a nearby agent program, the session information collection unit 33 refers to the communication log of the packet relay device before the transfer and determines whether there is corresponding session information. It has a communication log reference determination function.

At this time, if there is no corresponding session information in the communication log, the session information collecting unit 33 transfers the session information to the neighboring agent program unit as it is.
On the other hand, when the corresponding session information is found in the communication log, the session information collection unit 33, based on the found session information, the source IP address after relay, the source port number after relay, the destination IP after relay The address and the destination port number after relay are updated, and the updated session information is transferred to the neighboring agent program unit.

Here, the agent program unit does not update the received values for the latest agent ID and terminal node ID, and writes them directly into the session information management table.
As a result, the agent program unit can transfer the control request sent from the other agent program unit based on the latest agent ID and terminal node ID, and therefore, to the agent program unit on the unauthorized terminal side. Control requests can be transferred quickly.

The unauthorized terminal control unit 34 has a control rule management table update function for updating the control rule management table (FIG. 7) stored in the control rule DB as necessary.
Here, the meaning of each column of the control rule management table shown in FIG. 7 is as follows.
First, “rule ID” is an ID for uniquely specifying a control rule, “control source” indicates a network address for receiving a control request, and “control destination” indicates a network address of the control destination.

The “control type” is a value indicating which method is used to control communication. In the example of FIG. 7, 0 indicates warning, 1 indicates band control, 2 indicates quarantine, and 3 indicates blocking.
Further, “control command” indicates a command for controlling an adjacent network device, “control option” indicates information (control command specification) regarding the option of the control command, and remarks indicate comment information for the control rule. .

  Further, when the unauthorized terminal control unit 34 receives an unauthorized terminal control request from the agent function control unit 31, the unauthorized terminal control unit 34 refers to the session information collection rule management table shown in FIG. 6 and has the session information necessary for identifying the unauthorized terminal. It has a session information determination function that determines whether or not it exists. Here, the contents of the session information are the control request, the IP address of the control source, the IP address of the victim terminal, the port number of the victim terminal, the IP address of the search target, the port number of the search target, the protocol number, and the attack It shall include at least the time and control type.

  In addition, the unauthorized terminal control unit 34 searches the session information collection rule management table using the IP address of the damaged terminal, the port number of the damaged terminal, the IP address to be searched, and the protocol number as keys, and the specified row. It is determined whether or not the transfer destination column matches itself (the relay terminal provided with the unauthorized terminal control unit 34).

Here, when it matches with itself, it has a matching message notification function of notifying the agent function control unit 31 of a message indicating matching.
At this time, the agent function control unit 31 transmits a search request to the unauthorized terminal search unit 32 and forwards (relays) the control request to the agent program unit closest to the unauthorized terminal 16 based on the obtained search result.

On the other hand, when it does not coincide with itself, the agent function control unit 31 is notified of the value of the transfer destination column of the line specified to that effect.
At this time, the agent function control unit 31 transfers (relays) the control request to a neighboring agent program based on the acquired transfer destination information.

Further, when receiving an unauthorized terminal control request from the agent function control unit 31, the unauthorized terminal control unit 34 refers to the control rule table (FIG. 7) stored in the control rule DB 43 and uses the IP address of the control source as a key. A control rule reference specifying function for specifying a matching control rule is provided.
Here, the control rule table stored in the control rule DB 43 includes a control source IP address, a terminal node ID, a control type, a control command, and a control command option.

As a result of checking the control rule table, if the control source IP address does not match the control source address of any rule, the unauthorized terminal control unit 34 rejects the control request and returns an error as the control result.
Further, if the specified control rule does not match the control type specified in the control request, the unauthorized terminal control unit 34 rejects the control request and returns an error as a control result.

  When a control rule that matches the control source address and the control type is specified, the unauthorized terminal control unit 34 executes the corresponding control command set in advance based on the control option specified in the control request information, An adjacent relay device control function for controlling adjacent packet relay devices is provided. Further, it has a function of returning a control result by this control to the agent function control unit 31.

Thereby, after identifying the attack source (illegal terminal), unauthorized communication can be controlled by the network device nearest to the attack source.
In addition, an attack from an unauthorized terminal existing on a certain network can be flexibly controlled from a device on another network that does not know the network configuration.

The control rule DB 43 may be provided connected to the organization LAN organization, or may be provided in the agent program unit inside the packet relay device (relay router or proxy server).
Here, it is assumed that the control rule DB 43 is shared by all agent program units.
In addition, session information collection rules may be added to distribute session information management and unauthorized terminal search processing to communication terminals (servers, etc.) with sufficient resources.

When adding a rule to block communication from unauthorized terminals to the control rule management table, use a specific protocol or port number using control command options instead of blocking all communications from unauthorized terminals Only the communication to be performed may be blocked.
Thereby, control by protocol and port number can be applied not only to a blocking rule but also to a band control rule.

[Description of Operation of Embodiment]
Next, the overall operation of this embodiment will be described.

First, the agent program unit of each relay device (11, 14, 15) notifies the communication specifying information for specifying each relay transfer to other preset relay devices (communication specifying information notification step). Here, when an attack packet is sent from the unauthorized terminal 16 to the communication terminal 13, the search requesting terminal 12 requests the relay device 11 to search for the unauthorized terminal 16 (unauthorized terminal search request process). The relay device 11 specifies the unauthorized terminal 16 based on the communication specifying information and the search request (unauthorized terminal specifying step).
Next, the relay device 11 identifies the relay device 15 connected closer to the identified unauthorized terminal 16 (relay device identification step), and the search request from the search request terminal 12 (and control request: FIG. 4), the agent program unit of the relay device 15 performs control to suppress communication from the adjacent unauthorized terminal 16 based on a preset rule (transfer device control step).

  In addition, the execution contents of the unauthorized terminal search process, the communication identification information notification process, the unauthorized terminal identification process, the relay apparatus identification process, and the transfer apparatus control process are programmed and provided in each of the relay apparatus and the management terminal. It may be configured to be executed by a computer.

  Here, the operation of identifying the unauthorized terminal 16 via the relay routers 11 and 15 and the proxy server 14 of the present embodiment will be described in detail based on the sequence chart of FIG.

  First, the relay routers (corresponding to the relay devices) 11 and 15 and the agent program unit in the proxy server 14 regularly communicate session information with each other, and update the contents of the table stored in the session information management DB 41. It is assumed that the processing is always performed (communication specific information notification step).

  Here, the management terminal (corresponding to the search request terminal) 12 in the same network (LAN 1) as the server 13 detects that the attack packet has been sent to the server (corresponding to the communication terminal) 13. At this time, the management terminal 12 requests the agent program unit 21 of the relay router (with NAPT) 11 which is the relay location of the attack packet to request control of suppression of communication from the attack packet transmission source (illegal terminal). Information is transmitted (step S111: equivalent to an unauthorized terminal search request step).

  At this time, the control request information includes the IP address of the victim terminal, the port number of the victim terminal, the IP address to be searched, the port number to be searched, the protocol number, the time of attack, and the control type. And

  Next, the agent program unit 21 that has received the control request information refers to the session information collection rule management table (FIG. 6) and registers session information (corresponding to the specific information) necessary for specifying the unauthorized terminal 16. It is determined whether or not (step S112).

Specifically, the session information collection rule management table (FIG. 6) is stored using the IP address of the victim terminal (server 13), the port number of the victim terminal, the IP address to be searched, and the protocol number included in the control request information as keys. It is determined whether or not the transfer destination column of the identified row is the agent 21.
In the following description, it is assumed that the transfer destination column indicates the agent program unit 21.

Next, when it is determined that the transfer destination column is the agent program unit 21, the agent function control unit 31 of the agent program unit 21 makes a search request to the unauthorized terminal search unit 32.
Here, the unauthorized terminal search unit 32 identifies the unauthorized terminal 16 based on the session information (unauthorized terminal identifying step), and the agent program unit closest to the unauthorized terminal 16 is the agent program unit 23 of the relay router 15. (Step S112: relay device specifying step).

Next, based on the search result, a control request is relay-transmitted to the specified agent program unit 23 closest to the unauthorized terminal 16 (step S113).
Here, it is assumed that the control request (illegal terminal control request information) includes at least the control source IP address, the terminal node ID, and the control type.

  Next, the agent program unit 23 that has received the control request executes a control command specified by the control request based on a preset control rule (step S114: transfer device control step), and the unauthorized terminal 16 to the server 13 The control which suppresses the next attack sent to is performed.

Next, the agent program unit 23 notifies the execution result (control result 213) of the control command to the agent program unit 21 of the relay router 11 that is the control request source (step S115).
Further, the agent program unit 21 receives the control result 213 and notifies the control result 214 as an execution result of the control command to the management terminal 12 that is the request source (step S116).

The communication between the agent program parts is encrypted using a public key cryptosystem to maintain confidentiality and integrity.
The control of the adjacent packet relay device (agent program unit) is executed by SNMP (Simple Network Management Protocol), NETCONF configuration protocol, pre-registered command (device dedicated tool), or the like.

  With the above procedure, even when an attack packet is sent via a proxy server that rewrites the packet information source information or a device that performs address translation, the attack source can be accurately identified, and the communication operation of the attack source can be determined. It can be controlled via the latest packet relay device.

  In this embodiment, the unauthorized terminal 16 belonging to a network (LAN 3) of a certain organization is uniquely identified from a device (management terminal 12) belonging to the network (LAN 1) of another organization while maintaining the anonymity of the network. In addition, communication from the unauthorized terminal can be controlled via the network device (relay router 15) closest to the unauthorized terminal.

Furthermore, since the control request information can be directly transmitted to the packet relay apparatus (relay router 15) nearest to the attack source after the attacking unauthorized terminal 16 is identified, the communication from the attack source can be quickly suppressed and controlled. is there.
Even if the number of relays of the packet relay device up to the attack source increases, an agent program unit is provided in the communication terminal connected to the communication network, and the communication log on the other packet relay device is referenced and other packets By setting the relay device to be controllable, it is possible to suppress the machine resources of each relay device required for searching for an unauthorized terminal, and to identify the attack source more quickly.

  The present invention can be applied to a network business such as an ISP (Internet Service Provider), and the ISP business can provide a high-security network environment to the user and further reduce the operation cost. it can.

It is a schematic block diagram which shows the whole in one Embodiment of the packet transmission source identification system by this invention. It is a schematic block diagram which shows one structural example of the packet transmission source identification system disclosed in FIG. It is a block diagram which shows an example of the structure content of the relay router in the packet transmission source specific system disclosed in FIG. It is explanatory drawing which shows. It is the sequence diagram which showed roughly the process step of the communication control method of the unauthorized terminal in the packet transmission source specific system disclosed in FIG. It is explanatory drawing which shows an example of the session information management table in the packet transmission source specific system disclosed in FIG. It is explanatory drawing which shows an example of the session information collection rule table in the packet transmission source specific system disclosed in FIG. It is explanatory drawing which shows an example of the control rule management table in the packet transmission source specific system disclosed in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11,15 Relay router 12 Management terminal 13 Server 14 Proxy server 16 Unauthorized terminal 21, 22, 23 Agent program part 31 Agent function control part 32 Unauthorized terminal search part 33 Session information collection part 34 Unauthorized terminal control part 41 Session information management database 42 Communication log storage unit 43 Control rule database

Claims (11)

A relay device that relays and forwards communication packets sent via a communication network and converts address information included in the communication packet at the time of relay forwarding, and a plurality of communications that communicate with each other via the relay device A packet transmission source identification system comprising a terminal,
The relay apparatus stores means for storing communication specifying information for specifying each relay transfer performed by the relay apparatus, including address information before and after conversion, and another relay for which the communication specifying information is set in advance. Characterized in that it comprises means for mutual notification with an apparatus, and means for identifying the source of the attack packet based on the communication identification information when an attack packet is sent to the communication terminal. To identify the packet source. In the packet transmission source specifying system according to claim 1,
A packet transmission characterized in that a search request terminal that detects that the attack packet has been sent to the communication terminal and requests the relay device to search for the attack packet transmission source is provided in the communication terminal. Original identification system. In the packet source identification system according to claim 2,
The relay device determines whether or not it is possible to identify an unauthorized terminal that is a transmission source of the attack packet based on a search request sent from the search request terminal and the communication specifying information sent from another relay device. A packet comprising: terminal identification determining means; and communication identification information transferring means for transferring the search request and communication identification information to another preset relay device when the unauthorized terminal cannot be identified. Source identification system. In the packet transmission source specifying system according to claim 3,
When the unauthorized terminal is specified, the search requesting terminal includes control request means for transmitting a control request indicating a communication suppression rule of the unauthorized terminal to the relay terminal, and the relay device is closer to the unauthorized terminal A packet transmission source specifying system comprising: a relay device specifying means for specifying the connected relay device; and a control request notifying means for notifying the specified relay device of the control request. In the packet transmission source specifying system according to claim 3,
The relay device, when the unauthorized terminal is identified, relay device identifying means for identifying a relay device connected closer to the unauthorized terminal, and controls the identified relay device to control from the unauthorized terminal A packet transmission source specifying system comprising transfer device control means for suppressing communication packet relay transfer. In the packet source identification system according to claim 4,
The relay device updates communication specific information stored in advance in the relay device based on the communication specific information notified from the other relay device, and the communication specific information sent to the relay device. A packet transmission source identification system comprising: communication identification information update transfer means for updating and transferring to a relay device connected closer to the unauthorized terminal. In the packet transmission source specifying system according to claim 4 or 6,
The relay device is provided with a suppression control rule storage unit in which relay transfer rule information indicating a condition for relaying and transferring a communication packet from the unauthorized terminal is stored in advance, and the relay device performs the communication based on the relay transfer rule. A packet transmission source specifying system comprising transfer designation control means for controlling relay transfer of a packet. A relay device that converts source address information of a communication packet communicated on a communication network and performs relay transfer; and a plurality of communication terminals that communicate with each other via the relay device; A packet transmission source specifying method for specifying an unauthorized terminal that is a transmission source of the attack packet when an attack packet is sent,
A communication specifying information notifying step for notifying other preset relay device of communication specifying information for specifying each relay transfer, and when an attack packet is sent from the unauthorized terminal to the communication terminal, the relay A packet transmission comprising: an unauthorized terminal search requesting step for requesting the device to search for the unauthorized terminal; and an unauthorized terminal identifying step for identifying the unauthorized terminal based on the communication specifying information and the search request. Original identification method. The packet transmission source specifying method according to claim 8, wherein
Relay device specifying step for specifying a relay device connected closer to the specified unauthorized terminal, and a relay device for controlling the specified relay device to suppress communication packet relay transfer from the unauthorized terminal A packet transmission source identification method comprising a control step after the unauthorized terminal identification step. A relay device that converts source address information of a communication packet communicated via a communication network and performs relay transfer; and a plurality of communication terminals that communicate with each other via the relay device; A packet transmission source specifying program for specifying an unauthorized terminal that is a transmission source of the attack packet when an attack packet is sent,
When an attack packet is sent from the unauthorized terminal to the communication terminal, an unauthorized terminal search function for searching for the unauthorized terminal and other relays preset with communication specifying information for specifying each relay transfer A packet transmission source identification program for causing a computer to execute a communication identification information notification function for notifying an apparatus and an unauthorized terminal identification function for identifying the unauthorized terminal based on the search result and the communication identification information. The packet transmission source specifying method according to claim 10, wherein
A relay device specifying function for specifying a relay device connected closer to the specified unauthorized terminal, and a relay device for controlling the specified relay device to suppress communication packet relay transfer from the unauthorized terminal A packet transmission source specifying program for causing a computer to execute a control function.

Images