FI109165B - Procedure for monitoring traffic in computer networks - Google Patents

Abstract

The invention relates to a method for traffic control in a communications network, in which method the transmission of a data packet to its destination address is inhibited on the basis of the source or destination address of the data packet and in which method bindings defined between middleware-level and network-level information are utilized in traffic control at the network-level so that the traffic flow in the communications network can be controlled on the basis of barring lists at the middleware level. The invention is based on combining Internet middleware facilities with programmable active networks and/or routers. An automatic monitoring system is configured so that traffic outbound from a given subscriber connection and targeted to another given subscriber connection is passed via the traffic monitoring system. Herein, a precompiled middleware-level name list is utilized wherefrom the middleware-level names used by said given subscriber connection are selected (201) to form a barring list. On the basis of the thus formed middleware-level barring list, into the monitoring system by way of reading the response messages of a name server system is compiled (205) a network-level barring list, whose addresses are maintained valid not longer than the validity time indicated in the response message of the name server system, thus accomplishing the novel technique of traffic control on the basis of a subscriber-specific middleware-level barring list.

Description

! ): 109165

A method for controlling network traffic information

The invention relates to a method for controlling data traffic according to claim 1, wherein the data packet is denied access to its destination address based on the source or destination address of the data packet, and which combines middleware level and network level connections with network level traffic control.

Traffic on telecommunication networks is divided into hierarchical levels. Traffic at a particular hierarchical level is transparent to elements of other hierarchical levels. In this 10 application, the term middleware corresponds to layers 4-7 of the International Organization for Standardization (OSI) model of communication hierarchy levels, i.e. transport, session, presentation and application layers. Middleware is software that implements that software. layers functionality.

15

One middleware-level protocol is DNS, which assigns Internet resources a DNS name that does not contain the network-level location information for the resource. Referring to resources with DNS names is necessary because, for example, host resources, or the Internet. . ·. the IP addresses of connected computers are no longer static, but change eg.

: 20 due to dynamic IP address updates and changes to the network location of terminals.

: '' ': Additionally, according to Internet recommendations, terminal users are not allowed to directly use IP addresses, but always DNS names. Network resources to be named! : T: Middleware-level names can also be applications running on the network, or: their instances or documents stored on the network.

25 • «t v: In a known communication network, the incoming traffic to the network terminal, or v; access to traffic departing from the network terminal can be limited by: ': based on network-level information such as IP address, where necessary:' ': block traffic from or to certain network-level addresses, such as IP addresses, or allow traffic from certain network-level addresses only : or to certain network-level addresses. For example, firewalls do this. A firewall is a rigid system in which an internal network of an organization is 2,109,165 connected to an external network through a dedicated control element, whereby traffic from specific network-level addresses can be stopped by the firewall. Outgoing traffic can be monitored in a similar way.

5 A disadvantage of the prior art is that middleware (e.g., DNS) and network-level traffic controls operate separately, so that any middleware-level traffic restrictions, such as blocking lists that contain prohibited source or target names, do not restrict network-level traffic and thus easily access the unprotected network layer. unnecessary and unwanted traffic, such as spam or spam information sent to the recipient 10. There are no known solutions that efficiently and dynamically combine middleware and network-level traffic control.

Middleware-level closed user groups (VPNs) do not automatically reflect at the network level, so unwanted traffic 15 can easily be sent to networks or parts of the network at middleware closed user groups if, for example, the group's DNS names or IP addresses are known . In some cases this may cause damage due to the limited capacity of the data network. When unwanted traffic is blocked by the network, the arrival of the desired traffic slows down; or is blocked.

: 20 The location of network resources may change from one IP address to another: ": Blocking a particular IP address does not prevent traffic from another IP address.

There is also a need to restrict the availability of certain commonly available cyberspace resources based on DNS names by the interface, terminal or user, e.g.

for the sake of child protection and expediency. However, prior art does not •; , 25 possible for this.

It is an object of the present invention to provide a completely new type of method which enables the prior art problems described above to be solved. The invention; : based on combining Internet middleware and Internet router and / or ... active network technologies. Traffic to and from the local loop is controlled through '·, · 30 automated tracking systems. Such a monitoring system may be so-called.

an active node or a separate server containing a router capable of handling 3,109,165 headers and content of information packets, such as IP packets, through a tracking system, according to a dynamically changeable program. By dynamically interchangeable software is meant that the computer program controlling the monitoring system can be upgraded without interruption in the operation of the monitoring system 5. Dynamic upgradeability is used to modify the blocking list of forbidden middleware addresses and their network-level counterparts in the automated tracking system and / or elsewhere in the operator system. The solution of the invention uses a predefined middleware-level nomenclature which can be a particular namespace, e.g., all DNS names, for which a particular or certain nameserver systems are able to find network-level equivalents or namespace containing all syntaxically correct names of a given middleware-level namespace, but not all of which may have network-level equivalents.

The predefined namespace delimits the 15 subscriber interface-specific middleware-level nomenclatures that can be upgraded. The subscriber-specific middleware-level nomenclature contains middleware-level names for which to denote named network resources and / or denied traffic to named network resources and / or middleware-level names for denying traffic to or from certain nameservers: no incoming traffic: *: want to access a specific local loop.

Subscriber interface-specific middleware-level nomenclature is stored ... in an automated tracking system, elsewhere in the operator system, or available to the operator system. The invention stops traffic to an automatic tracking system coming from or targeted to such a network-level address ;; to an address where traffic to a cache resource named at a specific middleware level nickname at a given time is not accepted based on a subscriber interface specific middleware layer nomenclature. The link between a given middleware-level name and a network-level address is obtained by the -; - * out of 30 replies with a network address corresponding to the reply message 'up to the maximum validity period specified in the reply message to block traffic to network addresses with no valid middleware equivalent 4,109,165 and middleware level names from network resources or network resources traffic is not accepted.

More specifically, the method for controlling data communication 5 according to the invention is characterized by what is mentioned in the characterizing part of claim 1.

The invention provides considerable advantages. The invention provides for the reduction of unnecessary and unwanted network-level traffic. The invention enables blocking lists based on middleware-level names such as DNS names or Virtual Private Network (VPN) closed clusters in which the network-level group definition is dynamically updated according to the middleware-level group so that the group-level network definition remains valid for the group middleware-level names as matched.

15

The invention enables the operator and the network users to prevent the desired subscriber line from being named by such middleware-level names. ' · Traffic to cyber resources for which there are no corresponding network-level addresses: Requested by a name server request sent to the subscriber line at a specified time.

: '': 20 The method can also be implemented by specifying at least one network-level address or addresses to which traffic to or from is accepted, though. *: That network-level address has not been received from the nameserver at a particular time::.

::: 25 In this method, the network layer is automatically configured to support. · · Upper layer configuration. So if traffic is blocked for a DNS name or namespace, traffic for that DNS will also be blocked. is blocked without a separate IP address-based blocking list. . configuration to prevent traffic to or from certain web addresses. *. : 30 web addresses based on DNS names.

5,109,165

By means of the invention it is possible to restrict the availability of certain commonly available data network resources based on DNS names for the subscriber, the terminal or the user, e.g. for reasons of child protection or expediency.

The invention will now be described by way of example and with reference to the accompanying drawings.

I 5

The invention has two basic applications in a TCP / IP environment that can be used in parallel:

Figure 1 illustrates an outbound IP traffic blocking for addresses that are not known to the DNS-10 system and / or are not allowed.

The blocking of unwanted IP traffic as shown in Figure 2 due to the automatic and active migration to middle layer traffic control configurations.

15

When blocking outbound IP traffic as shown in Figure 1, addresses that are not known to the DNS system and / or are not allowed to be used e.g. following components and performing the following operations. In the example, certain or certain nameserver systems are capable of performing a resolution on a previously defined * ;; * 20 middleware level nomenclature, and with previously defined middleware level nomenclature; is the entire namespace that is syntaxed to the namespace for which a certain or certain

• * I

nameserver] operating systems are capable of performing a resolution but whose! .. t namespace single name may not have a network-level equivalent, and where * * · subscriber-specific middleware-level nomenclature is a namespace for which a given 25 nameserver system can find network-level equivalent. The example uses DNS for a given name server system and for a previously defined middleware-level namespace, syntax-correct DNS names.

•> ·! The subscriber interface-specific middleware-level nomenclature consists of the names for which the DNS-> * '·' system is able to execute the resolution of the DNS transmitted from the subscriber interface •; · * 30 based on inquiry.

• · 6 109165

The subscriber interface 10 is essentially a so-called subscriber interface. The Stub Internet, which merely connects the client network and the active node 11. The active node 11 is a network element containing software that tracks the header information of the IP packets coming to the active node 11 and controls the flow of the IP packets. The active node 11 is positioned such that all network traffic to the first subscriber line 10 passes through it.

The subscriber interface-specific middleware-level nomenclature may have been limited to those previously defined in the example application. In this case, a block list consisting of allowed and / or denied DNS names is stored in the active node 11, which can be dynamically updated, if necessary, by means of control from, for example, an operator ice system or a subscriber interface 1010. The DNS queries from the subscriber interface 10 are routed to the DNS server 12 and are routed to the DNS rigid system.

The method comprises the following steps. Steps 101 to 102 are performed to prevent requests from the subscriber interface 10 for the nameserver system 15 from being forwarded to the nameserver system for DNS names that do not wish to accept communications from the subscriber interface 10 to the designated network resources.

101) Receiving a request 20 from the subscriber interface 10 to the DNS server 12 for the requested DNS name 13 in the active node 11.

| 102) Sending (102a) a query about the requested DNS name 13 from the active node 11 to the DNS server 12 if the requested DNS name 13 is allowed or belongs to; ·. otherwise, a request for a specific DNS name I · 25 will not be forwarded nor will it be allowed to the allowed web addresses; ·. to complete the list. The client-host to the subscriber interface 10 is then sent (102b) a 'DNS response' at the source address of the DNS server 12, which indicates that a particular one. j. t There is no DNS name, or alternatively a more appropriate error message.

30 The following steps are performed if a request for a particular DNS name was sent to ·,: forward to the DNS server 12. Step 103 is performed to update the active node to accept traffic to a network resource named by a DNS name for which traffic is to be accepted. Step 103 is a necessary step for the success of step 104 Step 105 can be performed independently of the other steps.

103) Receiving, in the active node 11, a response message from the DNS server 12 to the inquiry sent in step 101. If the response message contains the requested DNS name 13 and the corresponding requested IP address 14, and the requested link validity period 15 between this and the DNS name 13 in the TTL field, the requested IP address 14 is defined as an accepted address in the network-level blocking list 10. The active node 11 is activated to allow traffic to the IP address 14 of the requested DNS name 13 for up to the requested binding period 15 The response message sent by the DNS server 12 is transmitted from the active node to the subscriber interface 10 to the client host.

Next, a first message is received from the client-host in the active node through the Stub Internet, i.e., the subscriber interface 10, to the IP address 14 requested, in step 104 and / or the second message directed to the prohibited IP address in step 105.

104) Receiving the first message from the subscriber interface 10 to the requested IP-address 14 from the active node 11, examining the active node:.:: Logic for possible blocking information associated with the requested IP-address 14 and passing the first message if the requested connection • · * ': 15 are still valid.

* I »25 105) Receiving another message 18 from the subscriber interface 10 to the forbidden IP address in the active node 11, examined by the logic of the active node

I

? · · Whether the forbidden address 17 is allowed, detects the absence and stops the message! »Progress.

t I

30

In order to prevent Active Node 11 from maintaining too many allowed addresses, the data mass can be replaced with TTL fields with shorter validity times obtained in the DNS response message, whereby allowed addresses can be removed from Active Node 11 8 109165 earlier than usual. DNS queries sent from the subscriber interface 10 may be routed through, e.g., the Token-Bucket Traffic Modifier, providing a limited number of DNS queries per customer over a specified period of time, resulting in extended network-level address retention times 5 for active node 11 and configuration time.

i (

Another exemplary embodiment of Figure 2, reducing unwanted IP traffic by automatically and actively migrating middleware-level traffic control configurations to the network layer.

10

The active node 11, programmed to read incoming messages from the DNS server 12, is positioned so that all network traffic to the first subscriber interface 10 passes through it. The information network resource 20, such as the client-host, is connected to the information network through a subscriber interface. A management system 23 refers to an operator system 15 by means of which it provides data network connections to its network resources communicating through its customers' local loops. DNS names 24 can be any DNS name. The IP addresses 25 are those IP addresses that are stored in the DNS system to match the DNS names 24. The user profile 22 is of the operator. a specification of the services provided to a particular network client or network resource, stored in a management system or a stand-alone sub-system 23 of the management system. The method performs the following ·: numbered operations. Step 201 is performed to delimit the DNS addresses i ,,, 1: i: from which traffic to and / or from the subscriber line is accepted::: transmitting data.

25 v: 201) Specify the DNS names allowed for at least one specific network resource, such as the client-host, in the management system 23. The determination may be made in whole or in part by the operator or the client, statically or dynamically during the communication link between the network resource 20 and the management system 30. The names can be physically stored anywhere, as long as the operator management system 23 is able to retrieve them. By network resource, a stored User Profile has been made available to the management system 23 9 109165, which allows the search of allowed DNS names.

Steps 202 through 205 are performed to target a particular user or terminal 5 to the first subscriber interface 10, and to determine traffic restrictions directed to a specific user or specific terminal to the active node 11 controlling a specific interface. a network-level equivalent of 10 names, IP addresses 25, that are validated by the name server] system response message, and each of these is defined as a prohibited and / or allowed address by defining the network-level equivalent of prohibited middleware-level names and / or allowed middleware-level names network-level equivalents are defined as allowed network-level 15 addresses in the tracking system, respectively.

202) Registering a network resource 20, such as a communication link established through a client-host subscriber interface 10, with a user profile 22 and transmitting the registration information to the management system 23.

:; ·; 20 »Il · 203) Sending request from management system 23 to DNS system, eg: ·. From the DNS server 12, which addresses the IP addresses': 25 corresponding to the DNS names 24 from which and / or to which traffic is accepted by a particular user profile 22, to: · the identified interface, in this case the subscriber interface 10.

25, * · 204) Receiving DNS names from the DNS system in the management system 23. * * as well as the corresponding IP address 25 and the validity period of the bind times between the DNS names 24 and the corresponding IP::: addresses 25 or t 11!

30 '·, j 205) Receiving 1 IP addresses 25 from the management system 23 obtained from the DNS system in the active node 11, and the validity periods of the IP addresses, and storing the IP-10 109165 addresses 25 with their validity periods into blocked list in the active node 11.

In the future, the management system will control the retrieval of the current 5 IP addresses and their expiry dates associated with the DNS names 23 and their transmission to the active node 11. The query IPs will use the expired or limited validity periods of the IP addresses 25 previously received from the name server system. A DNS inquiry is sent for each DNS name 23 before the 10 validity dates associated with each DNS name 23 expire. Removing IP addresses from the blocking list of allowed active addresses of 25 active nodes as a control excitation during their validity period, so that each IP address is removed from the blocking list at the latest upon expiration.

15 In steps 206-207 of the method, the active node receives the information packet and stops its propagation as needed. These steps can also be performed prior to steps 204-205, but in that case the message has no chance of transmission.

206) Receiving a third message from the subscriber interface 10 directed to the IP address to be checked 20 or arriving at the subscriber interface 10 from the IP address to be checked in the active node 11 and checking the active node 11; * *. logic whether the IP address to be checked 26 is a valid allowed IP | »· T t ·! ,, 'addresses in the block list on active node 11.

t · * t t * * * * 25 207) Sending (207a) a third message forward to the data network in the third; ·, The destination specified in the message, or the subscriber interface 10, if the IP address to be checked <t ·; belongs to the valid allowed addresses in the active node 11. Otherwise, · · ;, the third message is stopped in the active node 11.

»I

»· I t 1 '30 When using a large DNS nomenclature for a subscriber-specific middiewar layer I I ·; : In the blocking list, the traffic received from the subscriber interface 10 can be applied to the first embodiment of i * '·, whereby the active node 11 does not have to configure all the equivalent IP addresses of the middiewar level blocking list per subscriber interface 1111616 dynamically only those for which queries the nameserver response message sent in response to the queries is considered appropriate to be stored in the active node based on the subscriber interface specific middleware blocking list.

5

Extensive DNS lists of network resources coming from the data network through the active node 11 and targeted to the subscriber interface 10 can be monitored as shown in the following steps 208-210. In the same way, it is also possible to monitor the DNS names of the network resources that are subject to traffic to the data network 10 via the subscriber interface 10. In these steps, the tracking system receives a specific data packet addressed to the network resource 20 or from a subscriber interface, and retrieves the network level source and / or middleware level name that matches the middleware level, / or the destination address as an allowed or denied address to the tracking system in response to specifying or not specifying a specific middleware-level name in the subscriber-interface-specific middleware level nomenclature. Step 205 need not necessarily be performed when performing steps 208-210 and steps,. ·. 206-207 may be performed before and / or after steps 208-210.

. · · 208) Receiving in the active node 11 an information packet which has: undefined in the network-level blocking list stored in the active node 11: '·': 25 IP sources and / or destination addresses to be checked.

::: 209) In response to the received IP address to be verified, a so-called IP address is made. reverse- I * »v <DNS query, ie. is queryed by the logic of the active node 11 or by a query message to the DNS system established on the basis of the control of the active node, e.g. the DNS server 12, corresponding to the IP address corresponding to the IP address.

a (·> · »·» ·

• · I

• · 12 109165 210) Receiving a DNS response message on management system 23 and / or active node 11. Checking for a DNS name corresponding to the IP address being scanned in a list of allowed DNS names that can be located on management system 23, management system 23 or active node 11 . If the DNS name is found in the list of allowed DNS names, the active node 11 is directed to allow traffic to the IP address to be scanned for a maximum period of time according to the TTL field 1 referring to the IP address to be scanned in the DNS response message.

10

In step 210, the speed of the configuration update is important if packets are wanted to be allowed to the destination before the reverse query response arrives, that is, without checking. Specifically, this involves limiting the frequency of processing of DNS inquiries per subscriber interface by means of a traffic editor. However, getting a short burst of 15 to a subscriber line is not as dangerous as blocking a network in a denial of service attack, for example. In addition, the adverse effects of unverified addresses can be reduced by limiting the volume of traffic coming from unverified addresses or directed to unverified addresses. This can be accomplished by directing it to its own Token-Bucket queue, for example. The amendment,, *. 20 events. the traffic volume limit can then be changed.

; ' '': The invention may also be applied to maintain in the management system 23 and / or: '·,: in addition to the list of allowed DNS names in the active node 11, or as an alternative to its prohibited list:' Γ: list of DNS names and control traffic accordingly.

: T: 25

The invention may also be implemented by providing the active node 11 with a v: subscriber-interface-specific middleware-level block list, such as allowed DNS names and. · Enable logic of the active node 11 to query the validity periods between the IP addresses corresponding to the block list names and the block list names, in practice the TTL fields based on the control bound to the previously received validity periods from the DNS system 13 109165

The method of the invention can be applied by setting network-level block list definitions according to middleware-level block list definitions to certain combinations of network-level source and destination addresses of a data packet having at least one network-level source or destination address also in 5 cases where the received data packet .

This prevents the information packet from proceeding on the basis of the specified path.

Another possible embodiment of the invention is to route a message to be stopped based on a block list definition 10, such that the message in question is blocked from accessing its destination address, even if it is not stopped by the tracking system.

The method of the invention may utilize the capabilities provided by Secure-DNS to verify that requests sent to a DNS backend are indeed transmitted by a cyber resource that requests blocking list definitions to be made and that replies to the nameserver system are responses to these requests.

: 20 What follows is a description of some of the terms used in this application, and in particular in the claims:.

. . : The tracking system is the telecommunication network client interface operator interface ; equipment connected to the operator's side through which traffic in the communication network is controlled. A tracking system is a programmable active node, server, or other network element or system connected to a network that can read:: the network-level source and / or destination address information contained in the incoming data packets, and:: compare the incoming data packet address information stored in the tracking system. network-level address information, and by comparison send a received data packet from the tracking system, or stop the progress of the received '30 data packet to the tracking system. The monitoring system can also:. : denotes a system according to the above definition in which middleware-level names are stored Such a system is capable of sending a reverse DNS request for a specific network-level address information to a name server system or operator management system, and receiving specific middleware-level name information corresponding to a particular network-level address name information to the 5 subscriber line-specific nomenclature contained in the tracking system or available to the tracking system, which contains at least one middleware level name that is allowed and / or denied to the subscriber interface. In response to comparing a particular middleware-level name to a subscriber interface-specific address book, the tracking system can store a specific network-level address, and block traffic to or from a specific network-level source address or 10-address destination. The tracking system may also be implemented as a software component of an operator management system.

A user profile is a set of 15 specifications of services provided to a particular network client or network resource, stored in an operator management system or a stand-alone control system serving as a management subsystem. The user profile may include information on which of all the middleware level designated network resources designated traffic to a particular subscriber interface is directed to a particular subscriber interface and / or to all middleware level designated network resources designated from a particular subscriber interface. . ·. 20 should be blocked.

! · · · I: j: Name is a symbolic identifier used in communication systems, eg URN (Uniform: ': .: Resource Name), which does not have any location dependent part. The name also means here::: also the DNS host name, which is the name of the locale on the one hand, since the host is a karmic location of the abstract '4': 25 resources, but on the other hand is needed from the network level address,

From IP address to independent naming.

, * · The name server and name server system refer to a system that can, after being able to assign a name to a given middleware level, assign it to that middleware name; : 30 bound information. The bound information may, for example, relate to a network-level equivalent of a particular middleware-level name and to a particular middleware-level name and its network-level equivalent. '. : period of validity.

15 109165

Resource and data network resource means a subscriber interface connected to a data network, a host connected thereto, an application program running on the data network and / or its instance.

A network-level counter is a network-level address corresponding to a particular middleware-level name at a given time, that is, at a given time, a network-level resource designated by a particular middleware-level name can be found at the network-level address.

j 10 Unblocking means deactivating the target, followed by | it is no longer a blocking specification for restricting traffic.

j

Inquiry generation means the creation of an inquiry message or message content fields by the logic of the generating waste system.

15 A link between a network-level address and its middleware-level counterpart, and a midlevel-level name and its network-level counterpart address, is a definition stored in a name server system that associates a particular middleware-level name with a particular network-level address.

: 20

Claims (17)

A method for controlling data network traffic, whereby a data packet's access to its destination address is prevented on the basis of the data packet's sending or destination address, wherein 5. it is defined (205) at least one permissible and / or a prohibited sender and / or destination address at the network level which the network level blocking list, - the data packet directed to the subscriber connection (10) or from the subscriber connection (10) is controlled (206) via an automatic control system (11), which is part of an operator's system, and 10. the data packet is prevented (207) from advancing to its destination address in response to a comparison of at least one sender-level sender and / or destination address at the network level with at least one of the data packet's sender and / or destination addresses, characterized by - a predetermined middleware-level register is used, - it is delimited (201) from a predetermined register at middleware level an ab unconnected connection-specific register at middleware level, which contains at least one: allowed and / or a prohibited sender and / or destination name on middleware. 1 '·. 20 level and it is stored available for the operator's system at least to the portion it is:; is not already stored for the operating system of the operator, * »·, ·: ', - it is defined (205) on the basis of a defined subscriber connection-specific register at middleware level, at least one equivalent at network level for at least one subscriber-> connection-specific mediumware level register name as a forbidden or allowed address, such that at least one network level equivalent for each prohibited middleware level name is defined as a prohibited network level address and the respective allowed middleware level name at network level is defined in the same way as an allowed network level address in control system address blocking list, and Ml t »I · 22 109165 - the middleware level register names existing in the control system's network level counterparts on the subscriber connection-specific barring list are automatically removed from the control system's barring list at the latest validity date for the binding between ctive network level counterpart and its determined middleware level responsiveness. Method according to claim 1, characterized in that - it receives (208) in the control system a certain data packet directed to the subscriber connection or sent from the subscriber connection and it is retrieved from the name server system a specific middleware level correspondence name corresponding to the observed sender and / or destination address. for network level in a particular data packet, - it is checked (209) in the operator's system if a particular middleware level counter-responsiveness name belongs to a subscriber-specific middleware level register, and - the sender and / or destination address at network level to be observed (209) is defined as an allowed or prohibited address in the control system in response to a particular middleware level name's definition or lack of definition in the subscriber connection-specific middleware level register. Method according to any of claims 1-2, characterized in that on the basis of the defined subscriber connection-specific middleware level register 20 (203 - 204) a network level equivalent is obtained for at least one name in the subscriber-specific middleware level register, which corresponds to validity is obtained from •,; In the name server system from a name-specific response message in the name server system and '· ,,, · from these network level counterparts (205) each is defined as prohibited and / or »· in: allowed address, so that the prohibited middle level level names' network counterparts'. * '25 are defined as prohibited network level addresses and / or the allowed middleware level names' '' network level counterparts are defined in the same way as allowed network level addresses in the control system. Method according to any one of claims 1-3, characterized in that a network level equivalent (203 - 204) to be defined is retrieved from the name server system ... to the blocking list by sending a request addressed to the name server system concerning »109165 23 at least one subscriber connection-specific middleware level register name, generated by the operator system, and by storing the respective reconnected middleware level names in the relevant response messages. Method according to claim 4, characterized in that at least one request to be generated in the operator's system is generated in the control system. Method according to any of claims 1-5, characterized in that the predetermined middleware level register includes all middleware level names to which a particular or certain name server system exerts a resolution, and that the subscriber connection-specific middleware level register comprises permissible and / or 10 forbidden sender addresses for data packets to be conveyed to a particular subscriber connection, and / or permitted and / or prohibited destination addresses for data packets to be transmitted to a particular subscriber connection. Method according to any one of claims 1 to 5. characterized in that a particular or certain name server system can execute a resolution for a predetermined middleware level register, and where the predetermined middleware level register consists of the entire namespace belonging to its syntax. a namespace, to which a particular or certain nameserver system can execute a resolution, but whose namespace's individual addresses do not necessarily have any network level correspondence, and where the subscriber connection j, specific middleware level register is a namespace, to which a particular name j :, . 20 server systems can find network-level equivalents. ) · * I »» * ·, · '; Method according to any of the preceding claims 1 - 7. characterized in that - a name server sent to the subscriber connection (10) is received in the control system. system response message describing the network level response to the name of a particular subscriber connection-specific middleware level register space, and - in response to the response message, a network level response is defined in accordance with the "" response message that allowed the address on the control system's bar list. Method according to any of claims 1 - 8. characterized in that a particular · name server system consists of a DNS system or part thereof and that network level addresses and network level equivalents are IP addresses and middleware level addresses of DNS -name. Method according to any of claims 1 to 9. characterized in that a programmable active node (11) is used as a control system. 5 Method according to any one of claims 1 - 10. characterized in that from the subscriber connection is directed to the name server system, messages are sent to a traffic scrambler, which controls the messages to the name server so that the number of messages from the subscriber connection directed to the name server does not exceed a specified limit value within a designated time. 10 Method according to any of claims 1 to 11. characterized in that the subscriber connection-specific middleware level register is determined (201) on the basis of a user profile tied to the subscriber connection (10). A method according to claims 1 - 12. characterized in that traffic to a specific network level address is authorized, where a specific network level address is allowed and / or that traffic to a certain network level address is prevented, where a certain network level address is prohibited for the maximum validity of the binding. between the network level address expressed in the name server system response message and its fixed equivalent name at middleware level, unless a new name server system response message is received: ': which touches a new specified network level address and contains information about a longer valid- «*» “' : 20 hot time for a specific network level address. Method according to claim 13. characterized in that a maximum validity time is determined for the time that the DNS system response message in the TTL field binds the specified network level address and its determined middleware level correspondence name. Method according to any of claims 1 to 14, characterized in that as the impulse 25, the residual time is used for the validity of the bond between a particular middleware. · ·, Level name and a specific network level counter to send a query regarding a particular midlevel level name to the name server system. 25 109165 Method according to any one of claims 1-15, characterized in that - it receives (101) in the control system a request from a subscriber connection (10) to send a request for a specific intermediate-level name addressed to the name server system (12), and - in response to the request. a specific middleware level name with the subscriber connection-specific middleware level register stored in the control system and it prevents (102) that the request advances to the name server system. Method according to any of claims 1-16, characterized in that at least one data packet's access to its destination address is prevented by stopping the packet in the control system in response to at least one of its sending and / or destination addresses. · l