JP2008028720A - IP network device capable of controlling source IP address spoofed IP packet and source IP address spoofed IP packet control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network security technology which flexibly controls an IP packet having the possibility of send side arrogation while ensuring the effective transfer function of an IP network apparatus. <P>SOLUTION: The send side sends a message to an adjacent IP network apparatus for exchanging routing information between IP network apparatuses with new additional information which describes an authenticated IP address of a subordinated terminal and a dealing process against the arrogation of its IP address. The receive side holds the authenticated IP address and the dealing process against the arrogation in addition to a network address and an interface. Upon receipt of an IP packet, it extracts the send side IP address to collate with a set of the held interface and the authenticated IP address and decides the validity. If being doubtful of the arrogation, it executes the process against the arrogation held in relation to its IP address. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a network security technique. In particular, the present invention relates to a technique for preventing a DoS (Denial of Service Attack) attack and a DDoS (Distributed Dosage) attack on network resources and network devices caused by traffic spoofing a source IP (Internet Protocol) address. .

  Communication using the communication protocol TCP / IP as performed on the Internet is performed by transmitting and receiving IP packets. The IP packet stores destination IP address information and source IP address information, and an IP network device such as a router that relays the IP packet in a network such as the Internet uses the IP packet information based on the destination IP address information. A transfer is in progress.

  In general, an IP network device such as a router transfers an IP packet without confirming the validity of the source IP address of the IP packet. When a malicious user connected to the Internet performs a DoS attack or a DDoS attack, the source IP address is often misrepresented by using such IP packet transfer characteristics in the Internet.

  In recent years, uRPF (Unicast Reverse Path Forwarding) has attracted attention as a control technique for traffic in which a source IP address is spoofed (source IP address spoofed traffic). This realizes blocking of the source IP address spoofed traffic by a filtering process in an input interface such as a router using route information called ingress filtering.

  Several schemes have been proposed for uRPF. For example, the following 1) to 5). 1) Ingress Access List, 2) Loose Reverse Path Forwarding, 3) Loose Reverse Path Forwarding, Patenting Default Route, Non-patented, Non-patented, Non-patented, Non-patented, Non-patented, Non-patented, Non-patented (See Patent Document 2).

JP-A-2005-229614 IETF RFC 3704 IETF RFC2267

  As described above, ingress filtering by uRPF uses route information (routing table or forwarding table) held by an IP network device such as a router. The determination of whether the received IP packet is an IP packet sent from an official subscriber or an IP packet spoofing the source IP address is based on the route held by the source IP address of the received IP packet This is done depending on whether it is registered in the information. For example, when only two routes, 192.168.8.0/24 and 192.168.1 / 24, are held in the route information, the source IP address of the received IP packet is 192.168.0.1 or 192 If it is .1688.1.100, it is determined that the packet is an IP packet sent from an official subscriber, and the source IP address of the received IP packet is 192.168.3.1 or 172.1.8.1.1. If so, it is determined that the source IP address is spoofed traffic and discarded.

  By the way, generally, when an IP network device receives an IP packet having a destination IP address not held as route information, the IP network device discards the IP packet. However, on the Internet, there are innumerable paths that can be transferred, and it is impossible to hold all of them as path information. For this reason, IP network devices often hold a default route (expressed as 0.0.0.0/0), which is a special route that covers all route information, as route information. However, in this case, since ingress filtering matches all source IP addresses with the registered route information, it is determined that all IP packets are IP packets sent from official subscribers. The spoofed traffic cannot be properly blocked.

  In addition, ingress filtering by the uRPF described above has only control for unconditionally discarding in the IP network device when the source IP address of the received IP packet is not registered in the route information of the IP network device such as a router. Can't respond flexibly.

  The present invention has been made in view of the above circumstances, and network security that enables flexible control over an IP packet that may have spoofed a transmission source while ensuring an efficient transfer function of an IP network device. The purpose is to provide technology.

  New additional information is added to a message for exchanging routing information between IP network devices, and the IP address (authentication IP address) of the subordinate terminal and the processing when the IP address is spoofed (spoofing) (Time processing) is described and transmitted to the adjacent IP network device. On the receiving side, in addition to the network address and interface, the authentication IP address and the spoofing process are retained. When an IP packet is received, the source IP address is extracted and compared with a set of the interface to be held and the authenticated IP address to determine the validity. If it cannot be determined to be legitimate, a spoofing process held in association with the IP address is performed.

  Specifically, it is an IP network device that accommodates a plurality of terminals via a transmission line and transfers a received IP packet according to routing information held in advance, and is provided for each other adjacent IP network device, Interfaces that receive IP packets from other adjacent IP network devices, IP address extraction means for extracting a source IP address of IP packets received at the interfaces, and terminals accommodated by the other adjacent IP network devices Is associated with the information for identifying the interface that receives the IP packet from the other IP network device and the spoofing process that is a process when the IP address is spoofed as the source IP address. Authentication information storage means for holding the IP packet, If the received interface and the source IP address of the IP packet extracted by the IP address extracting unit are held in association with the authentication information storage unit, the source IP address spoofing is determined as a legitimate IP packet. When the monitoring processing unit and the transmission source IP address spoofing monitoring processing unit determine that the packet is a legitimate IP packet, routing processing is performed. When the packet is not determined to be a legitimate IP packet, the transmission extracted by the IP address extraction unit There is provided an IP network device comprising: routing processing means for performing the spoofing process held in the authentication information storage means in association with an original IP address.

  ADVANTAGE OF THE INVENTION According to this invention, the network security technique which enables flexible control with respect to the IP packet which may spoof the transmission source can be provided, ensuring the efficient transfer function of IP network equipment.

  Embodiments to which the present invention is applied will be described below.

  FIG. 1 is a system configuration diagram of an IP network system according to the present embodiment. As shown in this figure, the IP network system of the present embodiment includes an external network 100, a plurality of routers and IP network devices 200a, 200b, and 200c connected to the external network 100, and an IP network device 200a. , 200b, and 200c connected to the terminals 400a1, 400a2, 400b1, 400c1, and 400c2, the unauthorized intrusion detection device 500, and the network devices 200a, 200b, and 200c and the terminals 400a1, 400a2, 400b1, 400c1, and 400c2, respectively. It consists of paths 600a, 600b, 600c.

  Hereinafter, when there is no need to distinguish between them, the IP network device 200, the terminal 400, and the transmission path 600 are representative. Further, the number of IP network devices 200, terminals 400, and unauthorized intrusion detection devices 500 is not limited.

  The outline of the operation of the IP network device 200 of this embodiment is as follows. When the terminal 400a1 is connected under the control of the own device or when the terminal 400a1 to be explicitly accommodated is defined, the IP network device 200a has the IP subnetwork address under the control of the own device in the adjacent IP network devices 200c and 200b. The route information about is advertised by sending an UPDATE message of BGP (Border Gateway Protocol). At that time, the host address information (IP address) [192.168.0.250] and the source IP address of the terminal 400a1 authenticated as an official subscriber under its own device and the source IP address [192.168.0.250] The processing method in the case of receiving a spoofed IP packet is added to the route information and transmitted (1a).

  The IP network device 200c that has received the route information registers an IP packet with a source IP address 192.168.0.250 from another adjacent IP network device 200b as a port that receives the IP packet from the IP network device 200b. If the packet is received via the I / F = B (1b), it is determined that the IP packet is a suspicious source address spoofing, and the processing method described in the additional information of the route information received from the IP network device 200a The IP packet is processed according to (1c).

  Next, the IP network device 200 of the present embodiment that realizes the above control will be described. FIG. 2 is a functional configuration diagram of the IP network device 200 of the present embodiment.

  As shown in the figure, the IP network device 200 according to the present embodiment includes an interface module unit 201A, an interface module unit 201B, an IP address extraction unit 202, a source IP address spoofing monitoring processing unit 203, and an authentication information storage unit. 204, a routing processing unit 205, a forwarding table storage unit 206, a routing table storage unit 207, and a configuration definition processing unit 208. The number of interface module units is not limited to this. Further, when there is no need to distinguish between them, the interface module unit 201A and the interface module unit 201B are represented by the interface module unit 201.

  The interface module unit 201 is an interface between the IP network device 200 and the external network 100 or the transmission line 600.

  The IP address extraction unit 202 extracts the source IP address and the destination IP address from the IP packet received via the interface module unit 201. Of the extracted IP addresses, the source IP address is transferred to the source IP address spoofing monitoring processing unit 203. At this time, information specifying the interface module unit 201 that has received the IP packet is also transferred. The destination IP address is transferred to the routing processing unit 205 and the forwarding table storage unit 206.

  The source IP address spoofing monitoring processing unit 203 determines whether or not the source IP address received from the IP address extraction unit 202 is spoofed, and determines the processing of the IP packet received by the IP network device 200 To do. The determination is made based on information registered in an authentication information storage unit 204 described later. Details will be described later.

  The routing processing unit 205 performs processing such as forwarding the received IP packet to the next hop according to the determination of the source IP address spoofing processing unit 203. The next hop is performed with reference to the routing table or the forwarding table stored in the routing table storage unit 207 or the forwarding table storage unit 206.

  The routing table storage unit 207 and the forwarding table storage unit 206 each store a routing table and a forwarding table held by a conventional IP network device.

  The configuration definition processing unit 208 collects information on the terminals 400 subordinate to the own device, updates the configuration definition information, generates an UPDATE message, and calls the IP address of the terminal 400 subordinate to the own device (hereinafter referred to as an authentication IP address). )) And a processing method when the IP address is suspected of being spoofed (hereinafter referred to as “spoofing process”) are transmitted to the adjacent IP network device 200. In addition, when an UPDATE message is received from the adjacent IP network device 200, the received interface, the authentication IP address included in the UPDATE message, and the processing for spoofing are registered in the authentication information storage unit 204.

  In the present embodiment, the configuration definition processing unit 208 acquires the IP address of the subordinate terminal 400 by receiving registration from an administrator or the like. This may be configured to automatically collect. The misrepresentation process is acquired by accepting registration from an administrator or the like.

  The authentication information storage unit 204 includes an authentication IP address table 2040 that stores information for authenticating the validity of the received IP packet. The authentication IP address table 2040 is generated by the configuration definition processing unit 208 described above. FIG. 3 is an example of the authentication IP address table 2040 of this embodiment.

  As shown in this figure, the authentication IP address table 2040 of the present embodiment is the IP subnetwork address information described in the NLRI (Network Layer Reachability Information) field of the UPDATE message of the route information BGP to be advertised). A certain Source Network 7a, an Ingress I / F 7b that is an interface that has received the UPDATE message, an authentication IP address 7c, and a spoofing process 7d are registered.

  The above IP network device 200 includes, for example, a CPU, a ROM, a flash memory, a RAM, and the like, and the CPU implements each function described above by developing and executing a program stored in the ROM on the RAM. The authentication IP address table 2040, the routing table, and the forwarding table are stored on the RAM.

  Next, a method in which the configuration definition processing unit 208 transmits the authentication IP address and the spoofing process will be described.

  The BGP adopted by the IP network system of the present embodiment is a route control protocol used for exchanging route information between different service providers on the Internet. In this BGP, an UPDATE message is used when advertising route information to the adjacent IP network device 200. Additional information can be attached to the UPDATE message using a field called Path Attribute. In the present embodiment, using this Path Attribute field, the authentication IP address and the spoofing process are transmitted to the adjacent IP network device 200.

  First, the format of the Path Attribute field will be described. FIG. 4 is a diagram for explaining a format of a general Path Attribute field.

  As shown in the figure, the Path Attribute field includes a Path Attribute Type 4a, a Path Attribute Length 4d, and a plurality of Path Attribute Value 4e.

  The Path Attribute Type 4a is provided with Attribute Flags 4b and Attribute Type Code 4c. Each bit of Attribute Flags 4b is information indicating the attribute (Well Known or Optional) of the Path Attribute and the transferability with other IP network device 200 (always transfer, transfer if necessary). It is. The Attribute Type Code 4c is information that clearly indicates the type of the Path Attribute.

  In the present embodiment, a new Attribute Type Code 4c and a Path Attribute Value 4e are defined in the Path Attribute field, and are used for notification of the authentication IP address and the spoofing process.

  Next, in the present embodiment, the Path Attribute field used when the configuration definition processing unit 208 notifies the authentication IP address to the adjacent IP network device 200 will be described. In this embodiment, this Path Attribute for notifying the authentication IP address is called an Authentication Attribute.

  FIG. 5 is a diagram for explaining an authentication Attribute field according to this embodiment.

  In Authentication Attribute, “1 = Optional” (5a) is set in bit 0 of Attribute Flags 4b, “1 = Transitive” (5b) in bit 1, “0 = Partial” (5c) in bit 2, and “0 = Attribute” in bit 3. Length is 1 octet "(5d). Then, a new Code = 128 is assigned as the Attribute Type Code 4c (5e).

  That is, when generating the authentication Attribute, the configuration definition processing unit 208 describes 128 in Attribute Type Code 4c. On the other hand, when a Path Attribute described as 128 in the Attribute Type Code 4c is received, it is determined as an authentication Attribute.

  Four octets (32 bits) necessary for storing the IP host address (authentication IP address) are described in Path Attribute Length 4d (5f), and the authentication IP address is described in Path Attribute Value 4e (5g).

  Next, the Path Attribute field used when the configuration definition processing unit 208 notifies the adjacent IP network device 200 of the spoofing process will be described. In the present embodiment, the Path Attribute for notifying the misrepresentation process is called a control Attribute.

  FIG. 6 is a diagram for explaining a control attribute field according to the present embodiment.

  In the control Attribute, “1 = Optional” (6a) is set to bit 0 of Attribute Flags, “1 = Transitive” (6b) is set to bit 1, “0 = Partial” (6c) is set to bit 2, and “0 = Attribute” is set to bit 3. Length is 1 octet "(6d). Then, a new Code = 192 is assigned as the Attribute Type Code (6e).

  That is, the configuration definition processing unit 208 describes 192 as an Attribute Type Code when generating a control Attribute. On the other hand, when a Path Attribute described as 192 in the Attribute Type Code is received, it is determined as a control Attribute.

  Write one octet (8 bits) required to store the control pattern indicating the processing method of the misrepresentation in Path Attribute Length 4d (6f), and describe the control pattern in Path Attribute Value (6g, 6h, 6i) .

  The control patterns to be described include “To IDS” transferred to the unauthorized intrusion detection device 500 such as IDS (Intrusion Detection System), “Drop” to be discarded, and “Forward” to be transmitted as it is. In this embodiment, for example, “To IDS” is a code 0000, “Drop” is a code 1111, “Forward” is a code 1000, and a predetermined code for each process is described.

  The unauthorized entry detection device 500 can analyze the received IP packet and take measures such as blocking a specific port according to the analysis result.

  Using the above authentication Attribute and control Attribute, the configuration definition processing unit 208, when the terminal 400 is newly connected under its own device, the IP address (authentication IP address) and the spoofing process are adjacent to each other. Advertisement is made to the network device 200 by an UPDATE message. When the authentication IP address and the spoofing process are received from the adjacent IP network device 200, they are registered in the authentication IP address table 2040. FIG. 7 is a processing sequence of an authentication information generation process in which the configuration definition processing unit 208 advertises and registers authentication information and generates an authentication IP address table 2040. Here, a case where an UPDATE message is sent from the IP network device 200a to the IP network device 200c will be described as an example. Hereinafter, the configuration definition processing unit of the IP network device 200a is referred to as a configuration definition processing unit 208a, and the configuration definition processing unit of the IP network device 200c is referred to as a configuration definition processing unit 208c.

  As shown in this figure, when the terminal 400 is newly connected under its own device, the configuration definition processing unit 208a newly performs an IP address (authentication IP address) of the terminal 400 and a process for spoofing from the administrator or the like. When an input is received (step 901), an authentication Attribute and a control Attribute are generated using the received authentication IP address and spoofing processing, respectively, and an UPDATE message with these added is generated (Step 902). Then, the generated UPDATE message is advertised (step 903).

  The configuration definition processing unit 208c of the IP network device 200c receives the UPDATE message from the IP network device 200a.

  The configuration definition processing unit 208c registers the IP subnetwork address information described in the NLRI field of the UPDATE message as the source network 7a of the authentication IP address table 2040 and the interface that has received the UPDATE message as the Ingress I / F 7b ( Step 904).

  Then, the configuration definition processing unit 208c determines the type of additional information (Path Attribute) attached to the UPDATE message based on the information described in the Attribute Type Code 4c. The authentication IP address 5g is extracted from the Path Attribute Value 4e of the Path Attribute determined to be an Authentication Attribute, and the Path Attribute Value 6g of the Path Attribute 6G extracted from the Path Attribute 6e determined as the Control Attribute is a fraud. Then, the extracted authentication IP address 5g and spoofing process 6 are registered as the authentication IP address 7c and spoofing process 7d of the authentication IP address table 2040, respectively (step 905).

  Through the above procedure, the configuration information processing unit 208 of this embodiment generates the authentication IP address table 2040 in the authentication information storage unit 204.

  Next, transfer processing when an IP packet is received via the interface module 201 in the IP network device 200 will be described. FIG. 8 is a processing flow of the transfer processing of this embodiment.

  The IP address extraction unit 202 extracts a transmission source IP address from an IP packet received via the interface module unit 201 and passes it to the transmission source IP address spoofing monitoring processing unit 203 together with information specifying the received interface module unit 201. (Step 801).

  The source IP address spoofing monitoring processing unit 203 determines the validity of the source IP address (step 802). Here, the source IP address spoofing monitoring processing unit 203 refers to the authentication IP address table 2040 of the authentication information storage unit 204, and the interface that has received the received IP packet has an authentication IP address 7c that matches the source IP address. It is determined whether or not it matches the Ingress I / F 7b registered in association with. If they match, the source IP address visa monitoring processing unit 203 determines that the IP packet is from an authorized subscriber (it is valid), and notifies the IP address extraction unit 202 of it.

  Upon receiving the notification, the IP address extraction unit 202 extracts a destination IP address from the received IP packet, refers to the forwarding table storage unit 206, and searches for an output interface (step 803). Then, the routing processing unit 205 transfers the IP packet from the output interface searched by the IP address extraction unit 202 (step 804).

  On the other hand, if they do not match, the source IP address spoofing monitoring processing unit 203 determines that there is a suspicion of spoofing, together with the spoofing process 7d registered in association with the authentication IP address 7c that matches the source IP address, This is notified to the IP address extraction unit 202, and the IP address extraction unit 202 that has received the notification notifies the routing processing unit 205 of the control method (step 805). The routing processing unit 205 processes the received IP packet according to the received control method (step 806).

  Next, the state of processing such as transmission / reception of IP packets in the IP network system of the present embodiment will be described using the network of FIG. In the network of FIG. 1, a terminal 400a1 having an authentication IP address [192.168.0.250] is connected to the IP network apparatus 200a, and an IP address [192.168.1. .250] The terminal 400b1 is connected, and the terminal 400c1 having the IP address [192.168.2.250] is connected to the IP network device 200c.

  FIG. 9 is a processing sequence in the IP network system of this embodiment. Here, the processing in the IP network device 200c will be described as a representative. It is assumed that the authentication IP address of the terminal 400a1 is registered in the authentication IP address table 2040 of the IP network device 200c. In the IP network device 200c, an IP packet from the IP network device 200a is received by the interface module unit 201A, and an IP packet from the IP network device 200b is received by the interface module unit 201B.

  When the terminal 400a1 under the control of the IP network device 200a sends out an IP packet A having a source IP address of 192.168.0.250 and a destination IP address of 192.168.2.250 (step 311 in FIG. 1). 1a) The IP network device 200c receives the IP packet A from the interface module unit 201A via the IP network device 200a.

  The IP network device 200c determines the legitimacy of the transmission source by the method of Step 802 in FIG. 8 (Step 312). Here, it is determined that the packet is valid, and the received IP packet is transferred to the terminal 400c1 having the destination address (step 313, 1c in FIG. 1).

  On the other hand, when the terminal 400b1 under the control of the IP network device 200b sends out an IP packet B in which the source IP address is spoofed as 192.168.0.250 (step 321; 1b in FIG. 1), the IP network device 200c The IP packet B is received from the interface module unit 201B via the network device 200b.

  The IP network device 200c determines the legitimacy of the transmission source by the method of Step 802 in FIG. 8 (Step 322). Here, it is determined that there is a suspicion of misrepresentation, and for the IP packet B, a process of spoofing 7d registered in the authentication IP address table in association with the IP address 192.168.0.250 spoofed as the source IP address. (Step 323).

  Next, an example will be described in which the IP network device 200 of the present embodiment can appropriately block the source IP address spoofing traffic even when the default route is held as the route information.

  Here, it is assumed that the terminal 400 under the IP network device 200 is given [192.168.0.250/0] as a regular IP address. The IP network device 200 advertises the default route [0.0.0.0/0] to the adjacent IP network device 200.

  First, the control in the prior art will be described. FIG. 10 is a diagram for explaining control by the conventional IP network device 1200. The conventional IP network devices are referred to as an IP network device 1200a and an IP network device 1200c, respectively.

  When the terminal 400 is connected under the control, the IP network device 1200a advertises a route to the adjacent IP network device 1200c using the UPDATE message. Here, C is advertised as the default route [0.0.0.0/0] as the route information and as the next hop (Next Hop) (1001).

  In the IP network device 1200c that receives the advertisement of the default route via the interface module unit A, the default route is registered in the Destination of the routing table, and the interface A that is the received interface is registered in the output I / F (1002). .

  Here, when the terminal 400 spoofs the IP address as [192.168.1.250/0] and sends an IP packet, the IP network device 1200c uses [192.168.1. .250 / 0] is extracted, and it is determined whether or not the IP address exists in the routing table. Here, since the default route is registered, it is determined that it exists.

  As described above, in the IP network device 1200c according to the prior art, even a source IP address spoofed traffic is processed as a legitimate IP packet.

  Next, an example in the case of the IP network device 200 of the present embodiment will be described. FIG. 11 is a diagram for explaining control by the IP network device 200 according to the present embodiment.

  When the terminal 400 is connected to the subordinate, the IP network device 200 according to the present embodiment uses the UPDATE message and its additional information to the adjacent IP network device 200c to transmit route information (default route), next hop (C ), A normal IP address assigned to the terminal 400a and a process (not shown) when the IP address is spoofed are notified (1111).

  The IP network device 200c that has received the above information via the interface module unit 201B specifies information that identifies the received interface module unit 201B in the source network 7a, the default route, and the ingress I / F 7b in the authentication IP address table. B is the authentication IP address 7c, and the received IP address [192.168.0.250/0] of the received terminal 400 is the spoofing process 7d. , Respectively (1112).

  Here, when the terminal 400 spoofs the IP address as [192.168.1.250/0] and sends an IP packet, the IP network device 200c that has received the IP packet via the interface module unit 201B Whether the data of the combination of the source IP address [192.168.1.250/0] and the interface module unit 201B exists in the authentication IP address 7c and the Ingress I / F 7b of the authentication IP address table 2040. Is determined. Here, since it does not exist, it is determined that the received IP packet is a source IP address spoofed traffic. Then, the IP network device 200c performs a spoofing process 7d registered in association with the spoofed IP address [192.168.1.250/0].

  As described above, according to the control technique of the source IP address spoofing traffic by the IP network device 200 of this embodiment, there is a suspicious packet spoofing the source IP address that could not be determined by the conventional ingress filtering. It is possible to determine up to (sender IP address spoofed traffic). Furthermore, the process (falsification process) registered in advance in the authentication information storage unit 204 can be performed on the determined source IP address spoofed traffic. And this process at the time of misrepresentation can set a desired process by the administrator. Therefore, flexible control is possible for the source IP address spoofed traffic.

  As described above, in the present embodiment, not only discarding but also processing such as forwarding a source IP address spoofed suspicious packet to an unauthorized intrusion detection device can be performed. Can also be performed. Accordingly, it is possible to effectively prevent a Dos attack and a DDoS attack caused by a suspicious source IP address spoofing packet while maintaining an efficient transfer function of the IP network device.

  In addition, since the authentication IP address and the spoofing process are advertised in accordance with the existing BGP generally used on the Internet, the source IP address spoofing of this embodiment is performed between various IP networks. The traffic control technology can be realized with a simple configuration.

1 is a system configuration diagram of an IP network system according to an embodiment. It is a functional block diagram of the IP network apparatus of this embodiment. It is a figure which shows an example of the authentication IP address table 2040 of this embodiment. It is a figure for demonstrating the format of a Path Attribute field. It is a figure for demonstrating the authentication Attribute field of this embodiment. It is a figure for demonstrating the control Attribute field of this embodiment. It is a processing sequence of the authentication information generation process of this embodiment. It is a processing flow of the transfer process of this embodiment. It is a processing sequence in the IP network system of this embodiment. It is a figure for demonstrating the control by the conventional IP network apparatus. It is a figure for demonstrating the control by the IP network apparatus of this embodiment.

Explanation of symbols

100: external network, 200a: IP network device, 200b: IP network device, 200c: IP network device, 400a1: terminal, 400a2: terminal, 400b1: terminal, 400c1: terminal, 400c2: terminal, 500: unauthorized intrusion detection device, 600a: transmission path, 600b: transmission path, 600c: transmission path, 200: IP network device, 201A: interface module section, 201B: interface module section, 202: IP address extraction section, 203: source IP spoofing monitoring processing section, 204: Authentication information storage unit, 205: Routing processing unit, 206: Forwarding table storage unit, 207: Routing table storage unit, 208: Configuration definition processing unit

Claims (7)

An IP network device that accommodates a plurality of terminals via a transmission path and transfers received IP packets according to routing information held in advance,
An interface that is provided for each other adjacent IP network device and receives IP packets from other adjacent IP network devices;
IP address extracting means for extracting a source IP address of an IP packet received at the interface;
The IP address of the terminal accommodated by the other adjacent IP network device, the information specifying the interface that receives the IP packet from the other IP network device, and the IP address were spoofed as the source IP address An authentication information storage means that associates and holds a fraud processing that is a process in a case,
When the interface that has received the IP packet and the source IP address of the IP packet extracted by the IP address extracting unit are held in association with the authentication information storage unit, the transmission is determined to be a legitimate IP packet. Former IP address spoofing monitoring processing means,
If the source IP address spoofing monitoring processing unit determines that the packet is a legitimate IP packet, routing processing is performed. If the IP address is not determined to be a legitimate IP packet, the IP address extraction unit corresponds to the source IP address extracted. An IP network device comprising: routing processing means for performing the spoofing process held in the authentication information storage means. The IP network device according to claim 1,
The IP address of the terminal accommodated by itself and the above-described processing for spoofing when the IP address is spoofed are generated as additional information of the message, transmitted to other adjacent IP network devices, and other adjacent IP networks When the additional information is received from a device, the information processing apparatus further comprises a configuration definition processing unit that holds the IP address included in the additional information and the processing for fraud in the authentication information storage unit in association with the received interface. IP network device. The IP network device according to claim 2, wherein
The IP network device, wherein the additional information is generated for each of the IP address and the spoofing process using a Path Attribute field of an UPDATE message. The IP network device according to any one of claims 1 to 3,
The IP network device characterized in that the spoofing process includes processing of discarding the IP packet, transferring the IP packet, and analyzing the IP packet. An IP network system having a plurality of IP network devices for accommodating a plurality of terminals via a transmission line and transferring received IP packets according to routing information held in advance,
Each of the IP network devices
An interface that is provided for each of the other adjacent IP network devices and receives IP packets from the other adjacent IP network devices;
IP address extracting means for extracting a source IP address of an IP packet received at the interface;
This is processing when an IP address of a terminal accommodated in the other adjacent IP network device, information specifying the interface that receives an IP packet from the other IP network device, and the IP address are spoofed. An authentication information storage means that holds and associates fraud processing;
When the interface that has received the IP packet and the source IP address of the IP packet extracted by the IP address extracting unit are held in association with the authentication information storage unit, the transmission is determined to be a legitimate IP packet. Former IP address spoofing monitoring processing means,
If the source IP address spoofing monitoring processing unit determines that the packet is a legitimate IP packet, routing processing is performed. If the IP address is not determined to be a legitimate IP packet, the IP address extraction unit corresponds to the source IP address extracted. An IP network system comprising: routing processing means for performing the spoofing process held in the authentication information storage means. A source IP address spoofing IP packet control method by an IP network device that accommodates a plurality of terminals via a transmission line and transfers a received IP packet according to routing information held in advance,
An IP packet receiving step of receiving an IP packet from the other adjacent IP network device via an interface set in advance for each other adjacent IP network device;
An IP address extracting step of extracting a source IP address from the received IP packet;
A legitimacy determining step of determining the legitimacy of the source IP address of the received IP packet;
The IP packet whose source IP address is determined to be valid in the legitimacy determination step is forwarded, and predetermined processing is performed when the source IP address is spoofed for an IP packet that is not determined to be valid. A transfer step for performing the processing,
The legitimacy determining step includes
If the interface that received the IP packet and the extracted source IP address are registered in association with the authentication information held in advance, it is determined that the source IP address of the received IP packet is valid A source IP address spoofing IP packet control method characterized by the above. Computer
An interface that is provided for each other adjacent IP network device and receives IP packets from other adjacent IP network devices;
IP address extracting means for extracting a source IP address of an IP packet received at the interface;
The IP address of the terminal accommodated by the other adjacent IP network device, the information specifying the interface that receives the IP packet from the other IP network device, and the IP address were spoofed as the source IP address An authentication information storage means that associates and holds a fraud processing that is a process in a case,
When the interface that has received the IP packet and the source IP address of the IP packet extracted by the IP address extracting unit are held in association with the authentication information storage unit, the transmission is determined to be a legitimate IP packet. Former IP address spoofing monitoring processing means,
If the source IP address spoofing monitoring processing unit determines that the packet is a legitimate IP packet, routing processing is performed. If the IP address is not determined to be a legitimate IP packet, the IP address extraction unit corresponds to the source IP address extracted. A program for functioning as routing processing means for performing the spoofing process held in the authentication information storage means.

Images