JP7376288B2 - Specific device and method - Google Patents

Description

TECHNICAL FIELD The present invention relates to a specifying device and a specifying method, and particularly to a technique for monitoring networks in an IPv6 environment.

In recent years, with the spread of IoT, various devices have become connected to the Internet. Along with this, the number of devices connected to the Internet has increased explosively, and the transition from IPv4, which has traditionally been used as an Internet protocol, to IPv6, which is a new protocol with an address length of 128 bits, is progressing. Furthermore, many network security products such as network monitoring devices are also rapidly required to be compatible with IPv6.

In an IPv6 environment, when automatically setting an IPv6 address, RA (Router Advertisement) packets are transmitted and received. The terminal device that receives the RA packet sets the source address of the RA packet as the default gateway.

For example, if a malicious RA packet is sent by a malicious party, the terminal device that received the RA packet will have the source address of the fraudulent RA packet set to a default gateway with a higher priority than the legitimate default gateway. It may be added as a gateway. Furthermore, it is also possible for a malicious party to set a default gateway different from the official default gateway on a legitimate terminal device, thereby allowing unauthorized access to the network.

For example, Patent Document 1 discloses a technique for preventing unauthorized connection to a network in an IPv6 environment. In the technology described in Patent Document 1, a monitoring device is installed in a network, monitors NS (Neighbor Solicitation) packets flowing within the network, and connects to the network based on the source address and MAC address of the NS packet. Determine whether the terminal device is authorized.

Japanese Patent Application Publication No. 2007-104396

However, in monitoring NS packets flowing within a network using the technology described in Patent Document 1, in order to detect fraud, the default gateway with the highest priority setting of the terminal device connected to the network is used. It was difficult to understand.

The present invention has been made in order to solve the above-mentioned problems, and is a novel technology that grasps information about the default gateway with the highest priority set in a terminal device connected to a network in an IPv6 environment. The purpose is to provide a reliable fraud detection technology.

In order to solve the above-mentioned problems, a specific device according to the present invention includes a generation unit configured to generate a transmission packet including a first control bit in the header indicating termination of a connection in TCP communication, a setting section configured to set a source address different from the IPv6 address set in the own device as the source address of the transmission packet generated by the section; a transmitter configured to transmit the configured transmission packet to a preset terminal device; and configured to capture a response packet whose header includes a second control bit indicating a response to the transmission packet. an extraction unit configured to extract information indicating a transmission destination of the response packet included in the response packet captured by the acquisition unit, and the transmission destination extracted by the extraction unit. and a specifying unit configured to specify a default gateway set in the terminal device based on information indicating the terminal device.

Further, in the specific device according to the present invention, a storage section configured to store information regarding a regular default gateway in a network to be monitored, and a default gateway set in the terminal device specified by the specifying section are provided. , and a determination unit configured to determine whether the gateway matches the authorized default gateway stored in the storage unit.

Further, in the specific device according to the present invention, when the determining unit determines that the default gateway does not match the regular default gateway, the default gateway set in the terminal device identified by the identifying unit is an unauthorized default gateway. It may be determined that it is a gateway.

Furthermore, in the specific device according to the present invention, the setting unit may set a unique local IPv6 unicast address having a different global identifier or subnet identifier within a link local as the source address.

Further, in the specific device according to the present invention, the first control bit includes a FIN flag;
The second control bits may include an RST flag and an ACK flag.

Moreover, in the specific device according to the present invention, the transmitter may transmit the transmit packet to a port that is not opened by the terminal device.

In order to solve the above problems, the identification method according to the present invention includes a first step of generating a transmission packet whose header includes a first control bit indicating termination of a connection in TCP communication, and the first step. a second step of setting a source address different from the IPv6 address set in the own device as the source address of the transmitted packet generated in the second step; a third step of transmitting a transmission packet to a preset terminal device; a fourth step of capturing a response packet whose header includes a second control bit indicating a response to the transmission packet; and a fourth step of capturing a response packet in the fourth step. a fifth step of extracting information indicating the destination of the response packet included in the response packet, and a step of extracting information indicating the destination of the response packet that is set in the terminal device based on the information indicating the destination extracted in the fifth step. and a sixth step of identifying a default gateway.

According to the present invention, a transmission packet including a first control bit in the header set with a source address different from the IPv6 address set in the own device is transmitted to a terminal device, and a second control bit indicating a response to the transmission packet is transmitted to the terminal device. The response packet containing the control bits is captured and information indicating the destination of the response packet is extracted. Therefore, in an IPv6 environment, it is possible to realize a new fraud detection technique that grasps information about the default gateway with the highest priority set in the terminal device.

FIG. 1 is a block diagram showing the configuration of a network system including a specific device according to an embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of the specific device according to the embodiment. FIG. 3 is a block diagram showing the hardware configuration of the specific device according to the embodiment. FIG. 4 is a flowchart for explaining the identification method according to the embodiment. FIG. 5 is a sequence diagram showing the operation of the network system according to the embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 5.
[Network system configuration]
First, an overview of a network system including a specific device 1 according to an embodiment of the present invention will be described.
The identification device 1 according to the embodiment of the present invention identifies information on the default gateway with the highest priority setting set in the terminal devices 3a, 3b connected to a network NW such as a LAN. The specific device 1 is provided, for example, in a network system as shown in FIG. Further, the network system is provided in, for example, a BA (Building Automation) system.

As shown in FIG. 1, the network system includes a specific device 1, routers 2a and 2b, and terminal devices 3a and 3b that are communicably connected to each other via a network NW.

The routers 2a and 2b are routers compatible with IPv6 and function as gateways. In this embodiment, it is assumed that the MAC address of the router 2a is "S" and the MAC address of the router 2b is "R". Further, in this embodiment, it is assumed that the authorized router in the network NW is the router 2a, and the router 2b is an unauthorized router.

The terminal devices 3a and 3b are terminals such as PCs that operate on IPv6. Among the plurality of terminal devices 3a and 3b shown in FIG. 1, the terminal device 3a has the regular router 2a set as a default gateway. On the other hand, in the terminal device 3b, a default gateway different from the regular default gateway is set as the default gateway with the highest priority.

The terminal device 3a receives a regular ICMPv6 router advertisement (RA) packet transmitted in advance from the router 2a, and sets the router 2a, which is the source of the RA packet, as the default gateway. For the terminal device 3a, a regular default gateway is set.

On the other hand, the router 2b has previously transmitted an invalid RA packet to the terminal device 3b. In the terminal device 3b that received the invalid RA packet, the router 2b that is the source of the RA packet is added as the default gateway with the highest priority. Therefore, in this embodiment, an invalid default gateway is set in the terminal device 3b.

In addition, in this embodiment, the specific device 1 uses the TCP protocol to set the FIN flag (first control bit) to the closed port of the terminal device 3a, 3b for which the default gateway is to be specified. Send the packet as an outgoing packet. In addition, when the specific device 1 transmits the transmission packet to the specific target terminal devices 3a and 3b, the specific device 1 sets a source address different from the IPv6 address "G" set in the specific device 1. . A unique local IPv6 unicast address, for example "H", which is different from any link local address existing in the link local, is set as the source address.

In the TCP protocol, a FIN packet indicates the end of a connection. Therefore, when receiving a transmission packet with the FIN flag set, the terminal devices 3a and 3b transmit the TCP packet with the RST flag and ACK flag (second control bit) set, which indicate connection reset, because the target port is closed. Send the packet back as a response packet. However, since the source address "H" of the transmitted packet is a global identifier or subnet identifier address different from link local, the default gateway with the highest priority setting set in the terminal devices 3a and 3b is used as the destination. As a result, the terminal devices 3a and 3b transmit response packets.

At this time, the specific device 1 captures a response packet including an RST packet and an ACK packet flowing through the network NW. Further, the specific device 1 specifies the default gateway set in the terminal devices 3a and 3b from information indicating the destination of each response packet included in the captured response packet.

[Functional block of specific device]
Next, the configuration of the specific device 1 according to this embodiment will be explained using the block diagram of FIG. 2.
As shown in FIG. 2, the identification device 1 includes a generation section 10, a setting section 11, a transmission section 12, an acquisition section 13, an extraction section 14, a specification section 15, a storage section 16, and a judgment section 17.

The generation unit 10 generates a transmission packet in which a FIN flag indicating termination of a connection in TCP communication is set. More specifically, the generation unit 10 sets a FIN flag in the header of the transmitted packet.

The setting unit 11 sets a source address different from the IPv6 address “G” set in the specific device 1 as the source address of the transmission packet generated by the generating unit 10. Specifically, the setting unit 11 sets, as the source address, a unique local IPv6 unicast address "H" that does not exist in the link local and has a different global identifier or subnet identifier.

The transmitter 12 transmits a transmission packet in which the source address "H" is set and the FIN flag is set to the terminal devices 3a and 3b. The transmitting unit 12 transmits a transmission packet to the terminal devices 3a and 3b to be scanned for which default gateway information is desired to be acquired.

The acquisition unit 13 captures a response packet whose header includes an RST flag and an ACK flag, which indicates a response to a transmitted packet flowing through the network NW and having a header in which a FIN flag is set.

The extraction unit 14 extracts information that is included in the captured response packet and indicates the destination of the response packet. Specifically, the extraction unit 14 extracts the MAC address of the destination included in the response packet. In this embodiment, the destination MAC address included in the response packet from the terminal device 3a is the MAC address "S" indicating the router 2a. On the other hand, the destination MAC address included in the response packet of the terminal device 3b is the MAC address "R" indicating the router 2b.

The identifying unit 15 identifies the default gateway set in the terminal devices 3a and 3b based on the information indicating the destination of the response packet extracted by the extracting unit 14. The MAC address indicating the destination address of the response packet transmitted by the terminal devices 3a, 3b is the default gateway set in each terminal device 3a, 3b. Therefore, the specifying unit 15 specifies that the router 2b having the MAC address "S" is set as the default gateway with the highest priority in the terminal device 3a. The identifying unit 15 also identifies that the router 2b indicated by the destination MAC address "R" of the response packet of the terminal device 3b is set as the default gateway with the highest priority setting in the terminal device 3b. .

The storage unit 16 stores information regarding the authorized default gateway in the monitored network NW. In this embodiment, the router 2a is a regular router, and the router 2a indicated by the MAC address "S" is registered in advance as a regular default gateway.

The determining unit 17 determines whether the default gateway with the highest priority set in the terminal devices 3a, 3b identified by the identifying unit 15 matches the authorized default gateway stored in the storage unit 16. to judge. In this embodiment, the determining unit 17 determines that the default gateway (MAC address "S") set in the terminal device 3a is a regular default gateway. On the other hand, the determining unit 17 determines that the default gateway (MAC address "R") set in the terminal device 3b is not a regular default gateway but an unauthorized default gateway.

[Hardware configuration of specific device]
Next, an example of the hardware configuration of the specific device 1 having the above-described functions will be described using FIG. 3.

As shown in FIG. 3, the specific device 1 includes, for example, a computer connected via a bus 101, including a processor 102, a main storage device 103, a communication interface 104, an auxiliary storage device 105, and an input/output I/O 106. This can be realized by a program that controls hardware resources.

The main storage device 103 stores in advance programs for the processor 102 to perform various controls and calculations. The processor 102 and the main storage device 103 realize each function of the specific device 1, such as the generation unit 10, the setting unit 11, the acquisition unit 13, the extraction unit 14, the identification unit 15, and the determination unit 17 shown in FIG. .

The communication interface 104 is an interface circuit for network connection between the specific device 1 and the routers 2a, 2b, terminal devices 3a, 3b, and various external electronic devices. The communication interface 104 implements the transmitter 12 and the acquirer 13 described in FIG.

The auxiliary storage device 105 includes a readable and writable storage medium and a drive device for reading and writing various information such as programs and data to and from the storage medium. For the auxiliary storage device 105, a semiconductor memory such as a hard disk or a flash memory can be used as a storage medium.

The auxiliary storage device 105 has a program storage area in which the specific device 1 stores a program for specifying the default gateway with the highest priority setting set in the terminal devices 3a and 3b. The auxiliary storage device 105 realizes the storage unit 16 described in FIG. Furthermore, for example, it may have a backup area for backing up the data, programs, etc. mentioned above.

The input/output I/O 106 is composed of I/O terminals that input signals from external devices and output signals to external devices.

The display device 107 is configured with a liquid crystal display or the like. The display device 107 can display the default gateway specified by the specifying unit 15 and the determination result by the determining unit 17 on a display screen.

[Identification method]
Next, the operation of the specific device 1 having the above-described configuration will be explained using the flowchart of FIG. 4. In the following, it is assumed that the storage unit 16 stores information regarding the authorized default gateway in advance.

First, the generation unit 10 generates a TCP packet with a FIN flag set as a transmission packet (step S1). Next, the setting unit 11 sets a unique local IPv6 unicast address of a global identifier or subnet identifier different from link local as the source address of the transmission packet (step S2).

Next, the transmitter 12 transmits the transmission packet with the FIN flag set to the terminal devices 3a and 3b to be scanned (step S3). At this time, the transmitter 12 transmits the transmission packet to the port that is not opened by the terminal devices 3a and 3b. Thereafter, the acquisition unit 13 captures a response packet whose header includes an RST flag and an ACK flag as a response to the packet transmitted by the terminal devices 3a and 3b (step S4).

Next, the extraction unit 14 extracts information indicating the destination of the response packet, which is included in the response packet captured in step S4 (step S5). More specifically, the extraction unit 14 extracts the destination MAC address of the response packet transmitted by the terminal devices 3a and 3b. Thereafter, the identifying unit 15 identifies the default gateway with the highest priority set in the terminal devices 3a, 3b based on the extracted information indicating the destination (step S6).

Next, based on the default gateway specified in step S6, the determining unit 17 determines whether the default gateway with the highest priority set in each terminal device 3a, 3b matches the authorized default gateway. (Step S7). Thereafter, the determination result by the determination unit 17 is displayed on the display device 107 (step S8). Alternatively, the determination result can be sent from the communication interface 104 to a specific terminal device (not shown) on the network NW.

[Network system operation sequence]
Next, the operation of the network system including the above-mentioned specific device 1 will be explained with reference to the sequence diagram of FIG. 5. In the following, it is assumed that the terminal device 3a is preset with a legitimate router 2a as a default gateway, and the terminal device 3b is preset with an unauthorized router 2b as a default gateway.

First, the specific device 1 generates a transmission packet in which the FIN flag is set (step S100). After that, the specific device 1 generates a transmission packet using a unique local IPv6 unicast address “H” that is different from its own device’s IPv6 address “G”, that is, has a different link-local global identifier or subnet identifier as the source address. is transmitted to the terminal devices 3a and 3b to be scanned (steps S101 and S102). More specifically, the specific device 1 transmits a transmission packet with the FIN flag set to a port that is not opened by the terminal devices 3a and 3b.

Next, the terminal device 3a that has received the transmission packet with the FIN flag set generates and transmits a response packet (step S103). More specifically, the terminal device 3a transmits a response packet in which the RST flag and the ACK flag are set to the router 2a (MAC address “S”) with the default gateway “S” set in the terminal device 3a as the destination. do.

On the other hand, the terminal device 3b that received the transmission packet with the FIN flag set sends the response packet with the RST flag and the ACK flag set to the default gateway "R" set in the terminal device 3b to the router 2b. (MAC address "R") (step S104).

Next, the specific device 1 captures the response packet in which the RST flag and the ACK flag are set, which flows through the network NW (step S105). Next, the specific device 1 extracts the MAC addresses "S" and "R" indicating the destination of the response packet, which are included in each of the captured response packets, and extracts the MAC addresses "S" and "R" from the MAC addresses "S" and "R" to the terminal. The default gateway set in the devices 3a and 3b with the highest priority is identified (step S106).

The specific device 1 specifies that the default gateway with the highest priority set in the terminal device 3a is the router 2a having the MAC address “S”. On the other hand, the default gateway set in the terminal device 3b with the highest priority is identified as the router 2b having the MAC address "R".

After that, the specific device 1 refers to the authorized default gateway stored in the storage unit 16, and determines whether the default gateway with the highest priority set in the terminal devices 3a, 3b matches the authorized default gateway. (Step S107). In this embodiment, it is determined that the default gateway with the highest priority set in the terminal device 3a is the authorized default gateway. On the other hand, it is determined that the default gateway with the highest priority set in the terminal device 3b is not a legitimate default gateway but an unauthorized default gateway.

The specific device 1 can further determine that the router 2b, which is an unauthorized default gateway, is an unauthorized router, and display the results of these determinations on the display device 107. Alternatively, the specific device 1 can transmit the determination result to a specific terminal device (not shown) on the network NW.

As explained above, according to the specific device 1 according to the present embodiment, a unique local IPv6 unicast address with a different link-local global identifier or subnet identifier is set as a source address, and a transmission with a FIN flag set is performed. The packet is transmitted to a port that is not opened by the specified target terminal devices 3a and 3b. Furthermore, the specific device 1 captures the response packets in which the RST flag and the ACK flag are set by the terminal devices 3a and 3b, and extracts the destination MAC address included in the response packets. Therefore, it is possible to specify the default gateway set in the terminal devices 3a, 3b with the highest priority.

Further, according to the specific device 1, since the default gateway of the terminal devices 3a, 3b to be scanned is specified using the TCP protocol, there is no need to install new software on the terminal devices 3a, 3b, etc. The default gateway with the highest priority set in the terminal devices 3a and 3b can be identified with a simple configuration.

Further, according to the identifying device 1, since an unauthorized default gateway can be identified, it is possible to detect an unauthorized terminal in the network NW.

In addition, although the described embodiment illustrated the case where the number of terminal devices 3a and 3b to be specified is two, the number of terminal devices 3a and 3b may be other than two.

Although the embodiments of the identification device and identification method of the present invention have been described above, the present invention is not limited to the described embodiments, and can be imagined by a person skilled in the art within the scope of the invention described in the claims. Various modifications are possible.

DESCRIPTION OF SYMBOLS 1... Specific device, 2a, 2b... Router, 3a, 3b... Terminal device, 10... Generation part, 11... Setting part, 12... Transmission part, 13... Obtaining part, 14... Extracting part, 15... Specification part, 16... Storage unit, 17... Judgment unit, 101... Bus, 102... Processor, 103... Main storage device, 104... Communication interface, 105... Auxiliary storage device, 106... Input/output I/O, 107... Display device, NW... Network.

Claims (6)

a generation unit configured to generate a transmission packet including a first control bit in the header indicating termination of a connection in TCP communication;
As the source address of the transmission packet generated by the generation unit , a unique local IPv6 unicast that is different from the IPv6 address set in the own device and different from any link local address existing in the link local. a setting section configured to set an address ;
a transmitting unit configured to transmit the transmission packet in which the source address is set by the setting unit to a preset unopened port of a terminal device;
an acquisition unit configured to capture a response packet whose header includes a second control bit including an RST flag and an ACK flag indicating a response to the transmitted packet;
an extraction unit configured to extract information indicating a destination of the response packet included in the response packet captured by the acquisition unit;
A specifying unit configured to specify a default gateway set in the terminal device based on information indicating the destination extracted by the extracting unit. The specific device according to claim 1,
a storage unit configured to store information regarding an authorized default gateway in a network to be monitored;
a determining unit configured to determine whether a default gateway set in the terminal device identified by the identifying unit matches the authorized default gateway stored in the storage unit; A specific device characterized by comprising: The specific device according to claim 2,
The determining unit determines that the default gateway set in the terminal device specified by the identifying unit is an unauthorized default gateway when determining that the default gateway does not match the authorized default gateway. specific equipment. The specific device according to any one of claims 1 to 3,
The specific device is characterized in that the setting unit sets, as the source address, a unique local IPv6 unicast address having a different global identifier or subnet identifier within link local. The specific device according to any one of claims 1 to 4,
The first control bit includes a FIN flag.
A specific device characterized by: a first step of generating a transmission packet whose header includes a first control bit indicating termination of a connection in TCP communication;
As the source address of the transmission packet generated in the first step , a unique local IPv6 address that is different from the IPv6 address set in the own device and different from any link local address existing in the link local. The second step is to set the cast address ,
a third step of transmitting the transmission packet with the source address set in the second step to a preset unopened port of a terminal device;
a fourth step of capturing a response packet whose header includes a second control bit including an RST flag and an ACK flag indicating a response to the transmitted packet;
a fifth step of extracting information indicating a destination of the response packet included in the response packet captured in the fourth step;
and a sixth step of identifying a default gateway set in the terminal device based on the information indicating the destination extracted in the fifth step.

Images