JP2008141398A - RELAY DEVICE AND RELAY DEVICE CONTROL METHOD - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a relay device which can block transmission of a connection request suspected to have been transmitted from a worm. <P>SOLUTION: The relay device includes: a packet extraction part 11a which extracts a connection request packet and a connection response packet; a response waiting database 21 where destinations of transmitted connection request packets are stored till corresponding connection response packets are received or a certain time passes; a number of destination calculation part 11b which calculates the numbers of destinations from which responses are waited for, per transmission source address with respect to destinations stored in the response waiting database 21; and a transmission suppression part 11c which discards a connection request packet without transmitting it when the number of destinations from which responses are waited for, for a transmission source address of this connection request packet has reached a preliminarily set threshold. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The invention can identify a terminal suspected of being infected with a worm in a network and can prevent a connection connection request suspected of being transmitted by the worm from being transmitted. It is about.

  A worm, which is a type of computer virus, often performs operations such as specifying a terminal existing on a network by scanning for connection requests to an unspecified number of terminals, and attacking the terminals. Therefore, in order to suppress the spread of worm infection, identify the terminal suspected of being infected with the worm from the connection connection operation of the terminal, isolate the terminal, filter the communication data, and connect the worm It is effective to obstruct.

  For example, the conventional connection connection limitation is such that an ARP (Address Resolution Protocol) Request packet broadcast to the network is received by the server, and an ARP Request packet to the same destination is also transmitted from the server to send an ARP Reply packet. The number of ARP Request packets transmitted for which no ARP Reply packet has been returned or a relay device has received an ICMP (Internet Control Message Protocol) Destination Unreachable packet from the terminal. A terminal that reaches a certain number is determined to be a worm-infected terminal, and the communication packet of the corresponding terminal is discarded. It was instructed to relay device in the network (e.g., see Patent Document 1).

  As another method, the terminal confirms the number of TCP (Transmission Control Protocol) connections waiting for connection completion in a certain period, and determines that the worm is infected when the number of connections exceeds a threshold. There has also been proposed a method of deleting a database making a connection request for a TCP connection (for example, see Patent Document 2).

JP-A-2005-228230 (page 8-10, FIG. 1) Japanese Unexamined Patent Publication No. 2004-302656 (page 6-7, FIG. 4)

  In the conventional connection connection restriction, an abnormality is detected by monitoring a TCP connection connection request at a terminal. However, it is expensive to perform connection restriction on all of a large number of terminals in a corporate network. For this reason, a method for detecting anomalies by installing a dedicated server in the network has been proposed. In this case, since it is difficult to monitor a connection connection request with a TCP packet transmitted by unicast, an ARP Request packet and An abnormality was detected using an ARP Reply packet and an ICMP Destination Unreachable packet.

  However, in the case of a destination via a router, a TCP packet (hereinafter referred to as a TCP SYN packet) that is used for a connection connection request by TCP and whose SYN flag is ON and ACK flag is OFF (hereinafter referred to as TCP SYN packet) is relayed after being transmitted to the router. Therefore, address resolution by ARP is not required. Furthermore, in recent years, for security reasons, there are many routers and terminals that do not transmit ICMP Destination Unreachable packets. Therefore, it is difficult for ICMP Destination Unreachable packets to detect connection failure.

  In addition, with the advancement of L2 switching technology, a network of a scale that previously required application of a router can be operated only by an L2 switch. If the router divides the network into many broadcast domains, the majority of unspecified connection connection request packets sent by the worm go through the router, so there is no need for ARP address resolution. Therefore, most connection connection failures could be detected by monitoring the TCP SYN packet.

  However, in a network composed of large-scale broadcast domains, a considerable amount of connection connection request packets sent by the worm fail to resolve addresses by ARP. Therefore, if only TCP SYN packets are monitored, connection connection failure may occur. There was a problem that it was difficult to detect effectively. In particular, in the case of a worm that preferentially attacks from the broadcast domain to which the infected terminal belongs, when a worm infection is detected due to a connection failure due to a TCP SYN packet, the infection of the worm has spread within a large broadcast domain. It is possible.

  The present invention has been made to solve the above-described problems, and by monitoring a connection connection failure, a terminal suspected of being infected with a worm is identified, and a connection connection suspected to be originated by the worm. It is an object of the present invention to provide a relay apparatus and a relay apparatus control method capable of preventing a request from being transmitted.

  In order to solve the above problems, a relay apparatus according to the present invention includes a packet extraction unit that extracts a connection request packet and a connection response packet from relayed packets in a relay apparatus that accommodates a terminal in a network and relays a packet. The destination information of the transmitted connection request packet is stored for each connection request packet until the corresponding connection response packet is received or until a predetermined time elapses, and the destination database stores the destination information. Response destination number calculating unit that calculates the number of response waiting destinations for each source address, and the number of response waiting destinations of the source address of the connection request packet has reached a preset threshold, And a transmission suppressing unit that discards the connection request packet without transmitting it.

  Also, the relay device control method according to the present invention provides a packet extraction step of extracting a connection request packet and a connection response packet from the relayed packets in the relay device control method of accommodating a terminal in a network and relaying a packet. A storage step of storing destination information of the transmitted connection request packet in a response waiting destination database for each connection request packet until a corresponding connection response packet is received or until a predetermined time elapses, and a destination database Calculation process for calculating the number of response-waiting destinations for each source address, and when the number of response-waiting destinations of the source address of the connection request packet has reached a preset threshold value, A transmission suppressing step of discarding the request packet without transmitting it.

  According to the present invention, in a relay apparatus that accommodates a terminal in a network and relays a packet, a connection request packet and a connection response packet are extracted from the relayed packets, and the destination information of the transmitted connection request packet is associated with Until the connection response packet is received or until a predetermined time elapses, it is stored in the destination database, and for the destination information stored in the destination database, the number of response waiting destinations is calculated for each source address, When the number of response waiting destinations of the source address of the connection request packet has reached a preset threshold value, the connection request packet is discarded without being transmitted. By monitoring the connection failure of the terminal in this way, it is possible to identify the terminal suspected of being infected with the worm, and the connection connection request suspected of being transmitted by the worm is transmitted from this terminal. Can be prevented.

  Embodiments of a relay device and a relay device control method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a network configuration diagram of a network using the relay device according to the first embodiment of the present invention. In FIG. 1, relay devices 11 to 1N are relay devices according to the present invention. The response waiting databases 21 to 2N are provided in the relay apparatuses 11 to 1N, respectively, and are databases in which connection requests expected to transmit connection responses are recorded. Terminals 31 to 3M are terminals that provide network services to users by IP communication. The internal server 4 is a server that is installed in the internal network 7 and provides network services to the terminals 31 to 3M. The external server 5 is a server that is installed in the external network 8 and provides network services to the terminals 31 to 3M. The router 6 is a relay device that connects the internal network 7 and the external network 8 at layer 3. The internal network 7 is a layer 2 network constituting one broadcast domain connected by a bridge or an L2 switch. The external network 8 is a large-scale layer 3 network configured using a plurality of routers such as the Internet and an intranet.

  FIG. 2 is a functional block diagram of the relay device 11 of FIG. 1 for explaining the functional configuration of the relay device. In addition to the destination database 21, the relay device 11 has a functionally divided packet extraction unit 11a, a response waiting destination number calculation unit 11b, and a transmission suppression unit 11c. The packet extraction unit 11a extracts a connection request packet and a connection response packet from a large number of packets to be relayed (packet extraction step). The destination database 21 stores information (connection request source IP address, connection request destination IP address, reception time) of the transmitted connection request packet (storage process), and a corresponding connection response packet is received or is constant. This information is deleted after a lapse of time. The response waiting address number calculating unit 11b calculates the response waiting address number for each transmission source address for the addresses stored in the destination database 21 (calculation step). When the number of response waiting destinations of the source address of the connection request packet has reached a preset threshold, the transmission suppression unit 11 discards the connection request packet without transmitting it (transmission suppression step).

  FIG. 3 is a data structure diagram of the destination databases 21 to 2N according to the first embodiment. In FIG. 2, the connection request source IP address 211 describes the IP address of the transmission source terminal of the connection request packet. The connection request destination IP address 212 describes the IP address of the destination terminal of the connection request packet. The reception time 213 describes the reception time (also the transmission time) of the connection request packet.

  Next, the operation will be described. First, the communication operation in the internal network will be described in the case where the terminal 31 makes a connection request to the internal server 4. The terminal 31 broadcasts an ARP Request packet to resolve the address of the internal server 4. The ARP Request packet is received by the relay device 11 and is determined to be a connection request packet.

  The relay device 11 uses the IP address of the terminal 31 obtained from the ARP Request packet as the connection request source IP address 211, and similarly uses the IP address of the internal server 4 obtained from the ARP Request packet as the connection request destination IP address 212. 21 is searched. If there is matching information, the ARP Request packet is a retransmission packet, so only the reception time 213 of the corresponding information is corrected and relayed to the internal network 7.

  On the other hand, if there is no corresponding information as a result of the search, the relay device 11 checks the number of registered information whose IP address of the terminal 31 obtained from the ARP Request packet is the connection request source IP address 211 in the response waiting database 21. To do. If the number of registrations has reached the specified value, the ARP Request packet is discarded. Otherwise, the information of the ARP Request packet is newly registered in the response waiting database 21 and the ARP Request packet is relayed to the internal network 7.

  When receiving the ARP Request packet, the internal server 4 transmits an ARP Reply packet to the terminal 31. This packet is received by the relay device 11 and is determined to be a connection response packet. The relay apparatus 11 waits for a response with the IP address of the terminal 31 obtained from the ARP Reply packet as the connection request source IP address 211, and the IP address of the internal server 4 obtained from the ARP Reply packet as the narrative request destination IP address 212. When the database 21 is searched and matching information is registered, the information is deleted. Then, the ARP reply packet is relayed to the terminal 31 regardless of the presence or absence of registration.

  Since the terminal 31 has successfully resolved the address by receiving the ARP Reply packet, it next transmits a TCP SYN packet to the internal server 4. The TCP SYN packet is received by the relay device 11, is determined to be a connection request packet, the same processing as that of the ARP request packet is performed, and is relayed to the internal network 7.

  The internal server 4 that has received the TCP SYN packet transmits to the terminal 31 a TCP packet (hereinafter referred to as a TCP SYN + ACK packet) in which the SYN flag is ON and the ACK flag is ON. The TCP SYN + ACK packet is received by the relay device 11, is determined to be a connection response packet, is subjected to the same processing as the ARP Reply packet, and is relayed to the terminal 31.

  The terminal 31 that has received the TCP SYN + ACK packet continues communication with the internal server 4 thereafter. Communication packets after the continuation also pass through the relay device 11, but since these packets are not determined as connection request packets or connection response packets, they are relayed without being registered in the response waiting database 21.

  Next, communication operation with an external network will be described in the case where the terminal 31 makes a connection request to the external server 5. When the terminal 31 communicates with the external server 5, the terminal 31 transmits an IP packet addressed to the MAC address of the router 6. Therefore, the terminal 31 does not transmit the ARP request packet, but starts the connection process from the transmission of the TCP SYN packet. Subsequent communication is processed in the same manner as in the case of the terminal 31 and the internal server 4.

  Next, the maintenance operation of the response waiting database 21 due to timeout will be described. When the network is abnormal or the server is down, the connection request packet is not received by the relay device 11, and the information registered in the response waiting database 21 is not deleted. Therefore, the relay device 11 periodically checks the reception time 213 of the information in the response waiting database 21 and deletes information that has passed a specified time.

  Next, an operation when the terminal 31 is infected with a worm and transmits a connection request packet to an unspecified number of destinations will be described. When the terminal 31 makes a connection request to a server that does not actually exist in the internal network 7, first, an ARP Request packet is transmitted. This ARP Request packet is processed in the relay device 11 in exactly the same manner as the ARP Request packet addressed to the internal server 4, and is registered in the response waiting database 21. The ARP reply packet corresponding to the ARP request packet is not deleted until a maintenance operation due to a timeout is performed in the relay device 11 because there is no connection destination server.

  Further, when the terminal 31 makes a connection request to a server that does not actually exist in the external network 8, a TCP SYN packet is transmitted. This TCP SYN packet is processed in exactly the same manner as the TCP SYN packet addressed to the external server 5 and registered in the response waiting database 21. The TCP SYN + ACK packet corresponding to the TCP SYN packet is not deleted until a maintenance operation due to timeout is performed in the relay device 11 because there is no connection destination server.

  As described above, when transmission of connection request packets addressed to terminals that do not actually exist is repeated in a short time, the number of registrations using the terminal 31 in the response waiting database 21 as the connection request source IP address increases, and finally specified. Reach value. Thereafter, the connection request packet, that is, the ARP Request packet and the TCP SYN packet are discarded in the relay device 11 until the information with the terminal 31 as the connection request source IP address is deleted by maintenance of the response waiting database 21 due to timeout. The

  As described above, connection requests waiting for a response are recorded as a response waiting database, and when the number of registrations for each terminal reaches a specified value, subsequent connection request packets are discarded. It is possible to immediately suppress relay of connection request packets transmitted to an unspecified number of destinations transmitted by the terminal.

  Further, since the ARP request packet and the TCP SYN packet are used as the connection request packet, it is possible to monitor both the connection request not passing through the router and the connection request passing through the router.

  In addition, because the information that exceeds the specified time has been deleted during the maintenance of the database waiting for a response due to timeout, the terminal whose connection request is no longer relayed due to infection with the worm has returned to normal status due to the removal of the worm In this case, the relay of the connection request can be automatically resumed as time elapses without any setting for the relay device 11.

  In the above example, the ARP Request packet TCP SYN packet is used as the connection request packet, and the ARP Reply packet and TCP SYN + ACK packet are used as the connection response packet. However, the ICMP Echo Request packet is further used as the connection request packet, and the ICMP Echo packet is used as the connection response packet. By adding a Reply packet, it is possible to cope with a worm that uses ICMP Echo for scanning.

  In the first embodiment described above, the connection response packet corresponding to the connection request packet is determined only by the IP address. Next, when the connection request packet is a TCP SYN packet, the TCP port number is used to specify the TCP. An embodiment for discriminating a TCP SYN + ACK packet corresponding to a SYN packet will be described.

Embodiment 2. FIG.
FIG. 4 is a data structure diagram of the destination database of the relay device according to the second embodiment of the present invention. In FIG. 4, the connection request source IP address 211 describes the IP address of the transmission source terminal of the connection request packet. The connection request destination IP address 212 describes the IP address of the destination terminal of the connection request packet. The reception time 213 describes the transmission time of the connection request packet. Protocol number 14 describes the protocol number of the IP header of the connection request packet. The connection request destination port number 215 describes the destination TCP port number of the TCP SYN packet.

  Next, the operation will be described. In the present embodiment, the same operation as in the first embodiment is performed, but only the search and registration operations for the response waiting databases 21 to 2N are different.

  First, in the same information search processing performed when receiving an ARP Request packet and an ARP Reply packet, the first embodiment searches for a connection request source IP address 211 and a connection request source IP address 212 that match. In the second form, a search is further made for a protocol number 214 that matches.

  Next, in the registration of the ARP request packet, the protocol number 215 is registered in addition to the connection request source IP address 211 and the connection request source IP address 212. Next, in the same information search process performed when the TCP SYN packet and the TCP SYN + ACK packet are received, the connection request source IP address 211 and the connection request source IP address 212 are searched in the first embodiment. In the second embodiment, a search is further made for a protocol number 214 that matches the connection request destination port number 215. In the TCP SYN packet, a TCP destination port number is used as the connection request destination port number 215. In the TCP SYN + ACK packet, a TCP transmission source port number is used as the connection request destination port number 215. Except for the other processes, the second embodiment performs exactly the same process as the first embodiment.

  As described above, since the TCP port number is recorded in the response waiting database in addition to the IP address, relaying of the worm connection request packet for performing the port scanning operation to the same server can be immediately suppressed.

  In the above example, the ARP Request packet TCP SYN packet is used as the connection request packet, and the ARP Reply packet and TCP SYN + ACK packet are used as the connection response packet. However, the ICMP Echo Request packet is further used as the connection request packet, and the ICMP Echo packet is used as the connection response packet. By adding a Reply packet, it is possible to cope with a worm that uses ICMP Echo for scanning.

Embodiment 3 FIG.
In the above embodiment, worm scanning using an ARP packet, TCP packet, and ICMP packet is supported. Next, worm scanning using a UDP (User Datagram Protocol) packet may be supported. Possible embodiments are shown.

  FIG. 5 is a data structure diagram of the destination database of the relay device according to the third embodiment of the present invention. In FIG. 3, the connection request source IP address 211 describes the IP address of the transmission source terminal of the connection request packet. The connection request destination IP address 212 describes the IP address of the destination terminal of the connection request packet. The reception time 213 describes the transmission time of the connection request packet. Protocol number 14 describes the protocol number of the IP header of the connection request packet. In the connection request destination port number 215, the destination TCP port number or UDP port number of the TCP SYN packet is described. The response flag 216 records the presence or absence of a response when the protocol number 214 is UDP.

  Next, the operation will be described. Since the ARP packet, TCP packet, and ICMP packet are processed in the same manner as in the first embodiment, the UDP packet processing will be described by taking communication between the terminal 31 and the external server 5 as an example.

  First, when the terminal 31 transmits a UDP packet, it is received by the relay device 11. In the case of a UDP packet, the UDP header information cannot determine whether the packet is a connection request packet, a connection response packet, or any other packet, so the IP address of the terminal 31 is the connection request source IP address 211, the external server 5 And the connection request destination IP address 212 and the UDP destination port number as the connection request destination port number 215, it is searched whether or not information with the protocol number 214 being UDP is registered in the response waiting database 21. When a corresponding entry is found, the UDP packet is determined as a retransmission packet of the connection request packet or a packet after connection completion, and only the reception time 213 is corrected and relayed to the internal network 7.

  If there is no corresponding information, the relay apparatus 11 checks the number of registered information in which the transmission source IP address of the UDP packet is the connection request source IP address 211 and the response flag is OFF in the response waiting database 21. If the number of registrations has reached the specified value, the UDP packet is discarded. Otherwise, a new UDP packet is registered in the response waiting database 21 with the response flag 216 turned OFF and relayed to the internal network 7.

  When the relay apparatus 11 receives the UDP packet addressed to the terminal 31 from the external server 5 via the internal network 7, the connection request source IP address 211 is set to the IP address of the terminal 31, and the connection request destination IP address 212 is set to the external server 5. The response waiting database 21 is searched for the information that the protocol number 214 is UDP, with the IP address of the server and the connection request destination port number 215 as the UDP transmission source port number.

  When the corresponding entry is found, the response flag 216 of the information is turned on, and the UDP packet is relayed to the terminal 31. At this time, information is not deleted. Then, the terminal 31 that has received the UDP packet continues to communicate with the external server 5 thereafter, but since the response flag 216 of the corresponding information in the response waiting database 216 is ON for these packets, It is not regarded as a connection request packet and is relayed as it is.

  As described above, the connection request source IP address, the connection request destination IP address, and the connection request destination port number of the UDP communication that has been connected to the response waiting database are recorded, and the connection request packet is recorded in the destination database. A new UDP packet and an ARP Request packet that are not present are extracted, and a UDP packet and an ARP Reply packet that have a record in which destination information and transmission source information are switched are extracted as connection response packets. In this way, the packet without a record is a connection request packet, and the packet with a record is other than that, and the connection request packet by UDP is judged without examining the upper layer protocol, and the number of connection requests is confirmed and transmitted. Since it can be controlled, it is possible to immediately suppress the relay of the connection request packet of the worm that performs the scanning operation using UDP.

  The present invention is suitable when applied to a relay device used in a network, and is particularly suitable when applied to a relay device of a network composed of a large-scale broadcast domain.

It is a network block diagram of the network using the relay apparatus of Embodiment 1 which concerns on this invention. FIG. 2 is a functional block diagram of the relay device of FIG. 1 for describing a functional configuration of the relay device. It is a data structure figure of the destination database of the relay apparatus of Embodiment 1 which concerns on this invention. It is a data structure figure of the destination database of the relay apparatus of Embodiment 2 which concerns on this invention. It is a data structure figure of the destination database of the relay apparatus of Embodiment 3 which concerns on this invention.

Explanation of symbols

11 to 1N relay apparatus 11a packet extraction unit 11b response waiting destination number calculation unit 11c transmission suppression unit 21 to 2N destination database 31 to 3N terminal 4 internal server 5 external server 6 router 7 internal network 8 external network 211 connection request source IP address 212 Connection request destination IP address 213 Reception time 214 Protocol number 215 Connection request destination port number 216 Response flag

Claims (8)

In a relay device that accommodates terminals in a network and relays packets,
A packet extractor for extracting a connection request packet and a connection response packet from the relayed packets;
A destination database that stores destination information of the transmitted connection request packet for each connection request packet until a corresponding connection response packet is received or until a predetermined time elapses;
With respect to the destination information stored in the destination database, a response waiting destination number calculating unit that calculates the number of response waiting destinations for each source address;
A relay apparatus, comprising: a transmission suppressing unit that discards a connection request packet without transmitting the connection request packet when the number of response-waiting destination addresses of the connection request packet reaches a preset threshold value. The packet extraction unit extracts, as the connection request packet, an ARP Request packet and a TCP packet in which the SYN flag is ON and the ACK flag is OFF,
The relay apparatus according to claim 1, wherein an ARP reply packet and a TCP packet in which a SYN flag is ON and an ACK flag is ON are extracted as the connection response packet. The packet extraction unit extracts an ARP Request packet and an ICMP Echo Request packet as the connection request packet,
The relay apparatus according to claim 1, wherein an ARP Reply packet and an ICMP Echo Reply packet are extracted as the connection response packet. When the packet to be relayed is a UDP packet, the destination information and the source information are recorded in the destination database,
The packet extraction unit extracts a new UDP packet and an ARP Request packet that are not recorded in the destination database as the connection request packet, and destination information and transmission source information are switched as the connection response packet. The relay apparatus according to claim 1, wherein a UDP packet and an ARP Reply packet having a record are extracted. In the control method of the relay device that accommodates the terminal in the network and relays the packet,
A packet extraction step for extracting a connection request packet and a connection response packet from the relayed packets;
A storage step of storing destination information of the transmitted connection request packet in a response waiting destination database for each connection request packet until a corresponding connection response packet is received or until a predetermined time elapses;
With respect to the destination information stored in the destination database, a calculation step of calculating the number of response waiting destinations for each source address;
A transmission control step comprising: a transmission suppression step of discarding the connection request packet without transmitting the connection request packet when the number of response waiting destinations of the source address of the connection request packet has reached a preset threshold value Method. The packet extraction step extracts an ARP Request packet and a TCP packet in which the SYN flag is ON and the ACK flag is OFF as the connection request packet,
6. The relay apparatus control method according to claim 5, wherein an ARP reply packet and a TCP packet in which a SYN flag is ON and an ACK flag is ON are extracted as the connection response packet. The packet extraction step extracts an ARP Request packet and an ICMP Echo Request packet as the connection request packet,
6. The relay apparatus control method according to claim 5, wherein an ARP Reply packet and an ICMP Echo Reply packet are extracted as the connection response packet. When the packet to be relayed is a UDP packet, the destination information and the source information are recorded in the destination database,
The packet extraction step extracts a new UDP packet and an ARP Request packet that are not recorded in the destination database as the connection request packet, and the destination information and the source information are switched as the connection response packet. 6. The method of controlling a relay apparatus according to claim 5, wherein a UDP packet and an ARP reply packet having a record are extracted.

Images