JP2003324460A - Error message display method during access control and gateway device - Google Patents

Abstract

(57) [Summary] [PROBLEMS] At the time of access control, an error message having information sufficient to identify the cause of a communication failure is returned to a client terminal that transmitted a request. Kind Code: A1 A gateway device is designated to reply to a request transmitted from a client terminal to a communication destination server without transmitting a packet to the communication destination server in a predetermined communication policy. In this case, the destination of the packet of the request is replaced with the error message server 13. The error message server 13 replaces the communication destination server 12 with
An error message is issued as a response to the request from the client terminal 10. Gateway device 11
Replaces the source information of the reply packet from the error message server 13 with information indicating the communication destination server 12,
Deliver to client terminal 10.

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to an HTTP (Hyper Text Transfer Protocol) transmitted from a client terminal.
l) It relates to a method of returning an error message to a client terminal when a request or the like is prohibited by access control.

[0002]

2. Description of the Related Art As a conventional method for performing access control by packet filtering, there is a method of simply discarding a packet in an access control device. In this case, the client sending the packet kept waiting for the reply and confirmed the communication failure due to the waiting time timeout. Therefore, it takes time to confirm the failure, and it is inconvenient because information for identifying the cause of the failure cannot be obtained.

In addition, the access control device uses an ICMP (Inter
Sometimes a Net Control Message Protocol packet is sent in reply, but even then the client has the inconvenience of not getting enough information to determine the cause of the failure.

[0004]

SUMMARY OF THE INVENTION According to the present invention, during access control, an error message having sufficient information to identify the cause of communication failure is sent to a client terminal that has transmitted an HTTP request or the like. The task is to reply.

[0005]

In order to solve the above problems, the present invention is provided with a gateway device and an error message server having the following functions. -"Gateway device": When the gateway device receives a packet, the access control policy (communication policy) is set in advance.
, Pass or discard without error message,
Alternatively, processing for transfer to the error message server is performed. In order to transfer the packet to the error message server, the destination information is replaced with the one indicating the communication destination server from the one indicating the error message server, and the source is indicated so that the reply packet passes through the gateway device. Replace the address with the address of the gateway device. Reverse conversion is performed on the reply packet. "Error message server": The error message server is a Web server that issues an error message upon receiving an HTTP request from a client terminal.

When the packet transmitted from the client terminal arrives at the gateway device and returns an error message in accordance with the communication policy, the destination address of the packet is converted to that indicating the error message server. Further, it is converted into different destination information or the destination information is embedded according to the type of error message to be returned. Also, when there is no gateway device on the delivery route of the reply packet from the error message server to the user, the transmission source information in the packet is replaced from that indicating the client terminal to that indicating the gateway device. This allows the reply packet to pass through the gateway device when the reply packet is delivered. The correspondence between the session information before and after conversion is stored in the gateway device.

A packet transmitted from the gateway device as a packet addressed to the error message server is delivered to the error message server. Therefore, the error message server generates an error message as a response to the HTTP request. At this time, a different error message is generated according to the destination information. The error message generated here is transmitted as a reply packet.

When the reply packet arrives at the gateway device, the transmission source information is converted from the one indicating the error message server to the one indicating the communication destination server which is the original communication partner of the client terminal. If the destination information indicates the gateway device so that the reply packet from the error message server passes through the gateway device, the destination information is used as the client terminal which is the original destination. Replace with.

The packet leaving the gateway device is transmitted to the client terminal. The client terminal receives the packet as if it was sent from the destination server and checks the error message contained in the packet.

The operation of the present invention will be described in comparison with the prior art. DoS (denial of ser) on the Internet etc.
vice) As a countermeasure against attacks, gateway devices with a packet filtering mechanism that does not allow packets under certain conditions to pass through are known. However, since the conventional gateway device merely cuts off the packet, there is a problem that the user communicating with the upper protocol takes a long time to detect the error and does not know the detailed error content. The present invention provides a response of a higher-layer protocol to a packet that is not passed by a communication policy,
By having a means to perform instead of the communication destination device, the conventional problems have been solved.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION Here, a configuration of one mode of a system for realizing the present invention will be described with reference to FIG. In FIG. 1, 10 is a client terminal, 11 is a gateway device, 12 is a communication destination server, 13 is an error message server, and 14 is a communication network. In the mode described here, the gateway device 11 and the error message server 1
3 is installed as a device different from that of the gateway device 3, and the gateway device 11 includes a client terminal 10 and a communication destination server 1
It is assumed that the gateway device 11 is installed between the error message server 13 and the client terminal 10 and that the gateway device 11 is not installed on the direct delivery route of the packet.

Below, the HTTP request transmitted from the client terminal 10 via the communication network 14 is transferred to the error message server 13, and the client terminal 1
0 receives an error message from the error message server 13, and the gateway device 11
And how the error message server 13 works.

First, the client terminal 10 sends an HTTP request to the destination server 12 (see FIG. 1).
of). The HTTP request is transmitted as one or a plurality of packets. The packet is the destination server 12
First arrives at the gateway device 11 on the route to be delivered to.

The gateway device 11 determines what kind of processing should be performed on the received packet according to a preset communication policy. The communication policy usually describes rules relating to passing or discarding communication on a firewall device according to a set of a source address and a destination address of a packet, a protocol type, and the like. is there. In this embodiment, in addition to passing and discarding, an item "error message response (do not transfer packet to communication destination server)" can be set on this communication policy.

If the packet is passed in accordance with the communication policy, the packet is delivered to the communication destination server 12 as it is (in FIG. 1), and if it is discarded, the packet is discarded.

If an error message is to be sent, the destination of the packet is set to the error message server 13
Replace with. At this time, the error message server 13
The source address of the packet is replaced with the address of the gateway device 11 so that the reply packet from the device returns to the gateway device 11 again. Then, the session information before conversion is stored in association with the session information after conversion. As is well known, a session in communication is identified by a source address, a destination address, a protocol type, a source port number, a destination port number and the like. These pieces of information are session information. When the above address conversion processing is completed, the packet is transmitted to the error message server 13 (in FIG. 1).

Upon receiving the packet, the error message server 13 generates an error message as a reply to the HTTP request. This error message is sent to the gateway device 11 (in FIG. 1).

The gateway device 11 receives the packet carrying the error message. Then, based on the correspondence relationship between the source and destination addresses of the packet, which is stored in advance, and the session information before and after the conversion, the client server 10 of the communication destination server 12 originally attempted to communicate. The address and the address of the client terminal 10 are replaced. After that, the packet is transmitted to the client terminal 10 (in FIG. 1).

The client terminal 10 receives the packet from the error message server 13 and confirms the error message.

In the communication policy used by the gateway device 11 of the present embodiment, the purpose of enabling the setting of "error message reply" in addition to passing and discarding of packets is as follows. For example, if there are multiple types of addresses used by a certain user, and that address is used differently depending on the security level of the user (whether the route is encrypted, how much authentication was performed, etc.), It is assumed that only one of the addresses is allowed and the rest is discarded. At this time, if communication is attempted using the discarded address, it is difficult for the user to determine whether communication is not possible due to a trouble on the network or communication is not possible according to the communication policy. .

If an "error message reply" is specified for an address used by the user other than the passed address, the user will
It can be understood that communication is not possible in the communication policy. Thus, the purpose of supporting "error message response" in the communication policy is to
It is to improve the convenience of the user by notifying the user of the reason why the communication is prohibited.

In the above processing, the gateway device 11
The reason for saving the session information in is as follows. When the source address is replaced with the address of the gateway device 11 by the address conversion, a reply packet is sent from the error message server 13 to the gateway device 1.
When it returns to 1, the address needs to be retranslated. Therefore, the session information is saved so that the address can be re-converted based on the correspondence between the session information before and after the conversion.

FIG. 2 shows a processing flow of the gateway device 11. The gateway device 11 receives the HT from the client terminal 10 to the destination server 12 via the communication network 14.
The TP request packet (or the reply packet from the communication destination server 12 or the error message server 13) is received (step 201). When the packet is received, the preset communication policy is referred to, and it is determined whether or not the received packet is to be discarded on the set communication policy (step 202). If the packet is to be discarded, the packet is discarded (step 20
3), go to step 212.

If the packet is not discarded, it is determined on the communication policy whether the received packet is allowed to pass (step 204). If the packet is allowed to pass, the process proceeds to step 211 and the packet is delivered to the communication destination server 12.

If the packet is not passed, it is judged whether or not the received packet is "reply error message" on the communication policy (step 205). If there is "reply error message", the process proceeds to step 206, and if not, the process proceeds to step 209.

If there is a reply to the error message, the destination address is first set to the error message server 13
(Step 206). Further, the source address is changed to the address of the gateway device 11 (step 207). Next, the session information of the converted packet is stored in association with the session information before conversion (step 208). Then, the process proceeds to step 211, and the packet is delivered.

In step 209, it is determined whether or not the received packet is a reply from the error message server 13 to the converted packet. If the reply is not for the converted packet, the process proceeds to step 212. If the reply is for the post-translation packet, the source and destination addresses of the packet are restored to the pre-translation addresses based on the correspondence between the session information before and after the conversion stored in step 208 (step 210). The packet is delivered to the client terminal 10 (step 21)
1).

In step 212, if there is a correspondence relationship between the session information of the post-translation packet and the session information of the pre-translation packet that have timed out, those correspondences are deleted and the process is terminated. The above processing is repeated each time a packet is received.

FIG. 3 shows a processing flow of the error message server 13. When the error message server 13 receives the HTTP request packet from the gateway device 11 (step 301), it returns an HTTP response including an error message (step 30).
2). This process is repeated each time a packet is received.

The processes performed by the gateway device 11 and the error message server 13 described above can be realized by a computer and a software program.
The program can be stored in an appropriate recording medium such as a computer-readable portable medium memory, a semiconductor memory, or a hard disk, and can be read out from the recording medium to be executed by the computer.

[Other Embodiments] In the example of FIG. 1, the gateway device 11 and the error message server 13 are implemented as different devices, but the error message server 13 is built in the gateway device 11. May be.

An error message server 13 having a different address depending on the error message to be returned may be prepared. In this way, the error message notified to the client terminal 10 can be changed by changing the address.

The gateway device 11 may write different destination information (such as the URL in the HTTP request) in the packet in accordance with the returned error message. In that case, the error message server 13 looks at the destination information and returns a different error message.

If the error message server 13 is installed in the same direction as the communication destination server 12 when viewed from the gateway device 11, the gateway device 1
1 is installed on the route between the client terminal 10 and the communication destination server 12, the reply address from the error message server 13 is the gateway device 11
Via. In that case, the address of the client terminal 10 in the packet does not have to be replaced with the gateway device 11.

[0035]

The present invention relates to a method of returning an error message during access control such as packet filtering. Since access control at the network layer such as packet filtering is capable of high-speed processing, it is highly resistant to resource-consuming attacks due to denial of service attacks, but error messages with sufficient information can be returned. There was a problem such as not being able to do it. According to the present invention, an error message can be returned even in access control in the network layer, and user convenience is improved.

For example, suppose that the client terminal refuses communication when a specific user authentication is used in the communication policy in an environment where different addresses are used depending on the user authentication means. If the user is using an unauthorized user authentication method and there is no error message, it is difficult to distinguish whether another user authentication method should be used or whether there is a network problem. . If the error message instructs the user to receive another authentication method, the user can easily change the authentication method and try to access, thus improving the convenience.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of the present system.

FIG. 2 is a diagram showing a processing flow of a gateway device.

FIG. 3 is a diagram showing a flow of processing of an error message server.

[Explanation of symbols]

10 client terminal 11 Gateway device 12 Communication destination server 13 Error message server 14 Communication network

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B085 AC16 BA06 BG02 BG07 CA02                       CA04 CA07                 5B089 GA11 GA31 JA32 JB17 KA12                       KH03 MC08 MD08                 5K030 GA16 GA18 HD03 HD07 JA07                       MB18

Claims (5)

[Claims] 1. A method of displaying an error message during access control in a system having a gateway device between a client terminal and a communication destination server, wherein the gateway device is transmitted from the client terminal to the communication destination server. If the request specifies that an error message is to be returned without forwarding the packet to the destination server in the preset communication policy, the destination address of the request packet sent from the client terminal is set to the error message. The error message server replaces the server address, receives the request from the client terminal instead of the communication destination server, issues an error message in response to the request, and the gateway device causes the error message to be transmitted. In the access control, the sender information of the reply packet from the message server is replaced with the one indicating the communication destination server and delivered to the client terminal, and the client terminal receives an error message by the reply packet. How to display error messages. 2. When the request transmitted from the client terminal to the communication destination server is designated as an access denial in a preset communication policy, the gateway device allows the client terminal to communicate with the communication destination. By storing the source information of the packet sent to the server and replacing the source information of the packet with the one indicating the gateway device, the reply packet from the error message server can reach the gateway device. 2. The reply packet is delivered to the client terminal by replacing the destination information of the reply packet with information indicating the client terminal stored in advance. Error message display method during access control . 3. The gateway device transfers a request from the client terminal to an error message server having a different address according to the content of the error message to be returned. Alternatively, the error message display method during access control according to claim 2. 4. The gateway device embeds information specifying an error message in the destination information of a packet sent from the client terminal to the communication destination server according to the content of the error message to be returned. An error message display method during access control according to claim 1 or 2. 5. A gateway device between a client terminal and a communication destination server, wherein a request packet transmitted from the client terminal to the communication destination server is designated as an access denial in a preset communication policy. In the case where the packet is transmitted, a means for replacing the transmission destination of the packet transmitted from the client terminal with an error message server provided inside or outside the gateway device, and the error message server receiving instead of the communication destination server. A means for receiving a reply packet of an error message issued by the error message server as a reply to the request from the client terminal, and replacing the sender information of the reply packet from the error message server with one indicating the destination server. hand And a means for delivering the reply packet to the client terminal.