JP3758482B2 - Medium and apparatus for recording inter-network communication security program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a medium and apparatus for recording an inter-network communication security program for realizing security in inter-network communication by domain name request resolution.
[0002]
[Prior art]
Conventionally, a method for determining whether or not communication is possible based on an address of a transmission source terminal has been performed.
[0003]
For example, in the network as shown in FIG. 2, when only communication between the terminal M-11 and the terminal N-11 is to be performed, the firewall M-14 allows the transmission source IP address N-11 to pass through the network M, In the firewall N-14, the transmission source IP address M-11 is allowed to pass through the network N, and the security can be ensured by disabling communication of other terminals in the respective firewalls.
[0004]
When either one or both of the network M and the network N are private addresses, the source IP address is converted into a global address at the gateway and then reaches the destination network.
[0005]
In such an environment, when only communication between the terminal M-11 and the terminal N-11 is to be performed, the firewall M-14 converts the IP address of N-11 after being converted into a global address as a transmission source address to the network M. Permit the passage, and allow the network N to pass the IP address of M-11 after being converted to the global address as the source address in the firewall N-14, and prohibit the communication of other terminals in the respective firewalls. Thus, security can be ensured.
[0006]
In such a network configuration that performs conversion from a private address to a global address, in order to ensure security by the source IP address, the private IP address of the source terminal and the terminal communicate with the global network. It is necessary to have a fixed relationship with the global address to be translated.
[0007]
This is the same in the case of using dynamic global address assignment as a method for converting a private address to a global address, and it is necessary to fix the address correspondence for the terminal.
[0008]
[Problems to be solved by the invention]
If the correspondence between global addresses and private addresses is fixedly associated with each other in order to ensure security, global addresses are required for the number of terminals connected to the global network, and the number of terminals that use the global network is limited. .
[0009]
Even when dynamic allocation of global addresses is performed, it is necessary to associate addresses with each other for the number of terminals for which security is ensured, which is the same problem in terms of restrictions on terminals using the global network.
[0010]
In order to ensure security when connecting a terminal with a private address to the global network in this way, the global address that is statically or dynamically supported must be fixed when viewed from the communication partner. There is a problem that the number of limited global addresses is insufficient, and a solution has been demanded.
[0011]
In view of the above, an object of the present invention is to provide means for ensuring security when a terminal having a private address is connected to a global network for communication.
[0012]
[Means for Solving the Problems]
The above-described problem is solved by a medium and an apparatus that are configured as follows and record an inter-network communication security program for determining whether or not communication with an external network terminal is possible.
[0013]
FIG. 1 is a block diagram of the present invention.
[0014]
In the figure, reference numeral 1 is a terminal domain name storage means for storing a domain name for identifying a terminal for which communication is determined, and 2 is a DNS (Domain Names) based on the source IP (Internet Protocol) address of the received packet. System) Domain name inquiry means for inquiring the domain name of the transmission source terminal to the server, and 3 is used to search the domain name stored in the terminal domain name storage means based on the domain name obtained from the inquiry to determine whether communication is possible. It is a communication availability determination means.
[0015]
That is, in addition to the conventional technique for confirming whether or not communication is possible by comparing the transmission source IP address of a communication packet arriving at a gateway as a firewall at the entrance of the network with an IP address that is set in advance and stored, Even when it is not possible to determine whether communication is possible using the IP address, the domain name inquiry means 2 inquires the DNS of the transmission source network about the domain name of the transmission source terminal, recognizes the transmission source terminal based on the domain name, and determines whether communication is possible. The means 3 judges whether or not communication is possible by comparing with the domain name stored in the terminal domain name storage means 1 in advance.
[0016]
In particular, even if the source terminal is a network terminal managed with a private address and a global address, which is a unique address on the Internet, is dynamically allocated and transmitted, the above mechanism is used. Since the transmission source terminal is confirmed, it is possible to determine whether communication is possible.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 2 shows a configuration diagram of an embodiment of the present invention.
[0018]
In the present embodiment, a form realized by a computer program executed on a computer used for general purposes such as a personal computer or a workstation is shown.
[0019]
The inter-network communication security device of the present invention is realized by executing a computer program on a computer including a processing device, a main storage device, an auxiliary storage device, an input / output device, and the like. The computer program is stored and provided in a portable medium such as a floppy disk or CD-ROM, or in a main storage device or auxiliary storage device of another computer connected to the network. The recording medium of the present invention corresponds to the portable medium, the main storage device, and the auxiliary storage device.
[0020]
The provided computer program is loaded directly from the portable medium into the main storage device of the computer, or once copied or installed from the portable medium to the auxiliary storage device, then loaded into the main storage device and executed. In addition, when the data is stored and provided in another device connected to the network, it is copied to the auxiliary storage device after being received from the other device via the network, and loaded into the main storage device for execution.
[0021]
Embodiments of the present invention relate to firewalls. In the firewall that controls whether communication from the external network to the internal network is possible, the terminal domain name is held as a criterion for determining whether communication is possible. When there is a communication request from the outside, the domain name of the source terminal is requested, and The domain name of the transmission source terminal is identified from the answer, and whether or not communication is possible is determined.
[0022]
In particular, in this embodiment, a terminal that manages its own network with its own private address communicates with a terminal of a network that is managed with another unique private address via the Internet that is managed with a global address. 1 shows a firewall that is a constituent network and determines whether communication with the local network is possible or not at an entrance of a terminating network.
[0023]
The network managed by each firewall shown here has a function of responding to a DNS request from the outside. Each terminal in the network is given a host name unique to the entire global network, that is, a domain name composed of a network domain name and a host name according to the DNS format.
[0024]
The configuration of FIG. 2 will be described. Network M and network N are networks to which private addresses are assigned, and are connected via networks to which global addresses are assigned. M-11, M-12 and N-11, N-12 are terminals to which private addresses of the respective networks are assigned. M-13, N-13 are inner DNS servers that perform name resolution inside the network, M -14 and N-14 are gateways having both a firewall and an address translation function for ensuring network security, and M-15 and N-15 return the global address of the internal terminal in response to an address resolution request from outside the network. And an external DNS server that resolves external global addresses for internal requests.
[0025]
In the embodiment of the present invention, in M-14 and N-14 which are firewalls for ensuring security, a domain name of a transmission source terminal is requested in response to a communication request to the own network, and an answer is given. An item that identifies and determines whether communication is possible or not is shown.
[0026]
The global network connection ports of the firewalls M-14 and N-14 and the so-called demilitarized zone (DMZ) connection ports are assigned a fixed global address, and the internal network connection ports are private addresses. Is granted.
[0027]
Global addresses are assigned to the outer DNS servers M-15 and N-15. Private addresses are assigned to the inner DNS servers M-13 and N-13, terminals M-11 and M-12, and N-11 and N-12.
[0028]
Each terminal M-11, M-12 and N-11, N-12 is registered with the address of the DNS server of the network to which they belong.
[0029]
In the inner DNS servers M-13 and N-13, the domain name of the own network and the global address of the outer DNS server are registered.
[0030]
The address translation unit of the gateways M-14 and N-14 translates the IP address in the same way as the configuration in the prior art, and further gives a global address corresponding to the internal private address to the external transmission request The firewall unit of the gateway has a function of checking a source domain name in addition to a conventional check function using a source IP address as a source terminal identification function.
[0031]
When communicating from the terminal N-11 managed by the private address of the network N shown in FIG. 2 to the terminal M-11 of the network M also managed by the private address via the Internet managed by the global address. The operation of ensuring communication security will be described together with the movement of the packet and the movement of the data in the table provided in the reception side firewall M-14.
[0032]
FIG. 3 is a block diagram of the table, where (a) shows a communication availability determination table (hereinafter referred to as table A) and (b) shows a domain name inquiry management table (hereinafter referred to as table B) both received. It is provided as a firewall function of the gateway M-14 of the side network M. A similar table is provided in each firewall, and is similarly used for managing communication and ensuring security.
[0033]
The table A is added to the implementation of the present invention separately from the table of the IP address of the partner terminal that enables the communication at the entrance of the network to which the packet is transmitted to prepare for securing security according to the prior art. The table is a table in which the domain name of the partner terminal that is allowed to communicate is stored in advance. When the IP address of the source terminal is found corresponding to each domain name, it is configured to store it. For example, as shown in FIG. 3A, the source terminal domain name “no.pqr.st” is in a communicable state, and the IP address of the source terminal is “130.1.1.1”. Is shown.
[0034]
Table B is used to confirm that a packet having an IP address of a transmitted packet is a reply packet when a packet that answers the inquiry is transmitted. The IP address being inquired is temporarily stored. As an example, “130.1.2.1”, “133.5.1.2”, etc. shown in FIG. 3B are currently inquiring the DNS server of the partner network for their respective domain names. It shows that it is in a state.
[0035]
The operation when starting communication from the terminal N-11 to the terminal M-11 will be described along the flow of the operation start flowchart shown in FIGS. The destination terminal is also managed by a private address, and the process starts by inputting the domain name of M-11. Steps S41 to S48 are processing normally performed, and show processing for obtaining the IP address of the counterpart terminal specified by the domain name.
[0036]
In step S41, based on the input domain name, the data transmission terminal N-11 inquires of the internal DNS server N-13 about the address of the transmission destination terminal M-11.
[0037]
In step S42, N-13 inquires of the external DNS server N-15 about the address of the destination terminal M-11.
[0038]
In step S43, N-15 transmits an address request packet to DNS server M-15 in the transmission destination domain.
[0039]
In step S44, M-14 determines that communication is possible with the IP address of N-15. In other words, as a security function of the gateway, security is also secured for an address request packet coming from an external network. Here, according to the conventional technique, the IP address of N-15 is separately held and confirmed based on it. . This can also be confirmed by the domain name in order to ensure security even when the IP address is not registered in advance, as will be described later.
[0040]
In step S45, the DNS server M-15 that has received the packet that has passed through instructs the gateway M-14 to assign a global address of M-11.
[0041]
In step S46, M-14 assigns a global address to M-11 and returns the address to M-15.
[0042]
In step S47, M-15 answers the address of M-11 to N-15, and in step S48, N-15 answers the address of M-11 to N-13.
[0043]
In this way, the source terminal N-11 can know the IP address of the destination partner terminal M-11. Thereafter, N-11 can send a packet to M-11 using this address. However, since each network ensures security for packets transmitted from the outside, the firewall must be checked even if the IP address is known and communication is started. The operation of the embodiment of the present invention in the firewall M-14 will be described with reference to the flowcharts of FIGS.
[0044]
In step S51, the data transmission terminal N-11 transmits a communication packet to M-11 using the address of the determined transmission destination terminal M-11.
[0045]
In step S52, first, the firewall M-14 of the network M determines whether or not communication with the address of the transmission source N-11 is possible using the conventional technique. If OK, the communication packet is immediately passed as shown in step S64 and subsequent steps.
[0046]
When the IP address for determining whether communication according to the prior art is not set, the process proceeds to step S53, and it is checked whether the IP address has been registered in Table A. That is, as will be described later, when the source IP address corresponding to the source domain name is found, it is stored in the table A. When this IP address is registered, the process goes to step S64. The forward firewall passes the communication packet.
[0047]
When the IP address is not registered in the table A, it is determined in step S54 by examining the address information stored in the table B whether or not the transmission source address of this packet is being investigated.
[0048]
If it is not the sender address under investigation, that is, if it is determined that the sender needs to be confirmed by examining the domain name, the fact that the sender address is under investigation is stored in table B in step S55. In step S56, a reverse lookup of the domain name is requested based on the source address, and the domain name of the source address is asked to wait for the answer in step S51.
[0049]
If the packet has the address under investigation in step S54, it is checked in step S57 whether the content is a reverse DNS resolution reply packet. If not, the packet is discarded as an error, and in step S51, the next packet is discarded. Wait for the packet.
[0050]
If it is a reverse DNS resolution reply packet, the corresponding transmission source address stored in the table B is cleared in step S61 to cancel the state under investigation.
[0051]
In step S62, since the domain name of the transmission source is known, it is checked whether it matches the domain name indicating the communicable terminal set and stored in the table A in advance. If there is no match, the packet is discarded in step S67 and the process ends.
[0052]
If a match is confirmed, the address of the source packet is stored in correspondence with the corresponding domain name in Table A in step S63. In this way, it is possible to perform a security check as to whether or not communication is possible by comparing the IP address stored in the table A with the source IP address of a packet received from another network.
[0053]
In step S64, if the security can be confirmed, the communication packet is passed and delivered to the destination terminal.
[0054]
Thereafter, each received packet is delivered to the destination terminal after ensuring security by the same processing as described above. Step S65 indicates that the communication is repeated until no communication is detected and communication is terminated.
[0055]
When the end of communication is confirmed, in step S66, the IP address of the partner terminal of the communication end stored in Table A is cleared. Further, although not shown in the flowchart, the firewall M-14 detects the end of communication, releases the assigned global address, and notifies the external domain name server M-15 of this.
[0056]
In the above description, the IP address set in the table when determining whether communication is possible or the domain name of the partner terminal is stored so that communication is permitted. You may determine whether it is possible.
[0057]
In addition, as for the packet of the address resolution request from the outward DNS server provided in the other network, the communication was confirmed by checking the registered IP address according to the prior art. Confirmation may be used.
[0058]
Furthermore, although the above description is based on the assumption that both the local network and the partner network are managed using private addresses, both of them function in the same way even if they are network terminals with global addresses. It is.
[0059]
By using the mechanism as described above, free connection between companies can be realized while securing each secure network operation. For example, if a company that conducts monitoring services for multiple corporate networks communicates with a terminal belonging to another company's network, such as remote maintenance, if a firewall restricts communications from external networks, the domain name Terminals that are allowed to communicate by registering the password must pass through the firewall equipped with the function of the present invention even if they communicate with the global address assigned from the monitoring service company network managed by the private address from time to time. Can do. Similarly, even when each company's own network is constructed, it is effective as a means by which various business transactions between companies can be freely constructed while ensuring security.
[0060]
【The invention's effect】
As is clear from the above description, according to the present invention, by recognizing the source terminal by its domain name, the terminal managed by the private address is dynamically changed at the start of communication in order to solve the shortage of global addresses. Even when a global address is assigned, security can be ensured by determining whether communication is possible. Therefore, it is possible to configure a free network by connecting each network constructed by each company via the Internet, and a safe and convenient network society. Industrial and economic effects can be obtained.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of the present invention. FIG. 2 is a configuration diagram of an embodiment of the present invention. FIG. 3 is a table configuration diagram. FIG.
FIG. 5 is an operation flowchart for communication start (part 2).
FIG. 6 is an operation flowchart of communication start (part 3).
[Explanation of symbols]
1 Terminal domain name storage means 2 Domain name inquiry means 3 Communication availability determination means

Claims (3)

A medium in which an inter-network communication security program for determining whether or not communication with an external network terminal is possible, comprising:
A terminal domain name storage means for storing a domain name for identifying a target terminal for judging whether communication is possible and a corresponding IP address ;
Domain name inquiry means for querying the DNS server for the domain name of the transmission source terminal when a search is made for the transmission source IP address stored in the terminal domain name storage means based on the transmission source IP address of the received packet. ,
When the domain name stored in the terminal domain name storage means is searched by the domain name obtained by the inquiry and a match is found, the inquired source IP address is stored in correspondence with the terminal domain name, Communication enable / disable determining means for determining whether or not communication is possible based on whether or not a terminal IP address or a domain name of the sender terminal is found in the terminal domain name storage means;
A computer-readable recording medium in which an inter-network communication security program for functioning as a computer is recorded.   2. The inter-network communication security program according to claim 1, wherein the received packet is a packet transmitted from a terminal of a network managed by a private address using a global address dynamically assigned as a source IP address. A computer-readable recording medium on which is recorded. An inter-network communication security device that determines whether communication with an external network terminal is possible,
A terminal domain name storage means for storing a domain name for identifying a target terminal for judging whether communication is possible and a corresponding IP address ;
Domain name inquiry means for querying the DNS server for the domain name of the transmission source terminal when a search is made for the transmission source IP address stored in the terminal domain name storage means based on the transmission source IP address of the received packet. When,
When the domain name stored in the terminal domain name storage means is searched by the domain name obtained by the inquiry and a match is found, the inquired source IP address is stored in correspondence with the terminal domain name, Communication enable / disable determining means for determining whether or not communication is possible based on whether or not a terminal IP address or a domain name of the sender terminal is found in the terminal domain name storage means ;
An inter-network communication security device comprising:

Images