WO2014181452A1

WO2014181452A1 - Packet filter device and communication control system

Info

Publication number: WO2014181452A1
Application number: PCT/JP2013/063105
Authority: WO
Inventors: 大倉　敬規; 祥慈柚木; 山田　勉; 良藤田
Original assignee: 株式会社日立製作所
Priority date: 2013-05-10
Filing date: 2013-05-10
Publication date: 2014-11-13
Also published as: JPWO2014181452A1

Abstract

The purpose of the present invention is to provide a packet filter device and a communication control system capable of filtering illegal packets while reducing a loss of normal packets for even a rapid increase in illegal packets. To this end, the present invention is characterized by having, in a packet filter device connected to a plurality of terminal devices via a transmission path and used for receiving a packet transmitted via the transmission path and performing a filtering process for limiting the passage of the packet according to a specific rule, a storage unit for storing the specific rule, and a control unit for changing, while performing the filtering process, the specific rule stored in the storage unit when a processing load imposed on packet processing reaches a prescribed value.

Description

Packet filter device and communication control system

The present invention relates to a packet filter device and a communication control system for transmitting data used in an industrial plant or the like.

In recent years, in an industrial system such as a plant or factory automation system, a control device such as a programmable logic controller (PLC) is connected and transmitted by an attacker who has entered the system for the purpose of stopping or destroying the system. It has been pointed out that the threat of implementing cyber attacks by injecting fake control data into communication networks is increasing, and various methods and devices have been developed to protect communication networks from cyber attacks. ing.

In the following description, the names “illegal packet” and “regular packet” are used.

In other words, “illegal packet” means a packet that transmits fake control data injected by the attacker into the communication network, or a packet that is not designed to be transmitted to the communication network due to a failure of the connected device. A packet including data that is not allowed to be transmitted is indicated, and a “regular packet” indicates a packet that excludes the illegal packet from packets flowing through the communication network.

As a technique for protecting a communication network from cyber attacks, for example, a packet filter distribution method and a distributed packet filter system described in Patent Document 1 are known.

In the distributed packet filter system described in Patent Document 1, the filter management server manages the filter load of each packet filter to distribute the processing load in the filter, and the filter rule with a heavy processing load is a filter with a small amount of traffic. It had the characteristic of being in charge.

JP 2003-244247 A

In the technology described in Patent Document 1, since the filter management server manages the filter rules of each packet filter and instructs the change, the filter rule change cannot immediately cope with the rapid increase of illegal packets, and the regular packet can be lost. There is a problem that there is.

Also, since packets received by the packet filter are always relayed through the filtering process, if the number of illegal packets increases and the amount of received packets exceeds the processing speed of the filtering process, the reception buffer of the packet filter overflows, and illegal packets In addition, there is a problem that regular packets are lost.

Therefore, an object of the present invention is to provide a packet filter device and a communication control system that can filter out illegal packets by reducing the loss of regular packets even when the number of illegal packets increases rapidly.

In order to solve the above-described problems, the present invention provides a filtering process for receiving a packet transmitted through the transmission path, connected to a plurality of terminal apparatuses, and restricting the passage of the packet according to a specific rule. In the packet filter device to be performed, when the processing load for processing the packet reaches a specified value, the storage unit that stores the specific rule changes the specific rule stored in the storage unit and performs the filtering process And a control unit.

According to the present invention, it is possible to provide a packet filter device and a communication control system that filter illegal packets by reducing the loss of regular packets even with a sudden increase in illegal packets.

It is a figure which shows the structure of the communication control system which concerns on one Embodiment of this invention. It is a figure which shows the structure of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows operation | movement of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows operation | movement of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows the processing flow of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows the structure of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows operation | movement of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows operation | movement of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows the processing flow of the packet filter apparatus which concerns on one Embodiment of this invention. It is a figure which shows the structure of the communication control system which concerns on one Embodiment of this invention. It is a figure which shows the structure of the communication control system which concerns on one Embodiment of this invention. It is a figure which shows the structure of the communication control system which concerns on one Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

First embodiment

The first embodiment will be described.

First, FIG. 1 shows a configuration example of a communication network system according to the first embodiment.

In the communication network system in FIG. 1, a transmission path 9 that transmits a packet, a plurality of terminal devices 3 that transmit and receive the packet, a plurality of network nodes 2 that relay packets between the transmission path 9 and the terminal device 3, As shown in FIG. 1, a packet filter device 1 that transmits a packet received from one transmission path 9 to the other transmission path 9 is connected in the transmission path 9.

Further, as the communication network system, for example, an industrial network defined by the IEEE 802.3 standard, the IEC 61158 standard, or the IEC 61375 standard may be used.

The terminal device 3 includes, for example, a programmable logic controller and a monitoring computer used in an industrial plant, a control computer for sending a control command to the controller, and a gateway device used for connecting a communication network and an external network. Etc. may be used.

The packet filter device 1 is a device that performs a filtering process that restricts the passage of packets according to a specific filter rule, and receives all the packets that are subject to the filtering process among the packets that are transmitted through the connected transmission line 9. Then, the packet subjected to some processing in the packet filter device 1 is transmitted to the connected transmission line 9.

The packet filter device 1 transmits a part of the packet received from the transmission path 9 to the transmission path 9 without performing the filtering process when the processing load in the apparatus exceeds a threshold value. The processing load of 1 does not exceed the threshold.

The packet transmitted to the transmission line 9 without performing the filtering process includes not only regular packets but also illegal packets.

Also, in this embodiment, it is assumed that the terminal device 3 having a higher importance is installed from the upstream (left side in FIG. 1) to the downstream (right side in FIG. 1) where the packet flows. When a packet flows to the terminal device 3 having a high degree of importance, the packet filter device is provided in multiple stages and the load distribution is performed so that the processing load of each filter device does not exceed the threshold value. Can be performed without arriving at the terminal device 3 having a high degree of importance, and without losing regular packets in response to a rapid increase in illegal packets, thereby providing a system that maintains real-time characteristics.

FIG. 2 is a diagram illustrating a configuration example inside the packet filter device 1 that performs the above-described operation.

That is, the packet filter device 1 includes a reception interface unit 191 that receives a packet from the transmission path 9 and converts it into a bit string that can be processed inside the device, a control unit 100 that performs various filtering processes on the received packet, The storage unit 200 stores a filter rule 11 for processing, and a transmission interface unit 192 that converts a bit string of a received packet into a code suitable for transmission on a transmission path. Here, the filter rule 11 is a rule set in advance for selecting illegal packets and regular packets. The packet source address, destination address, protocol, source port number, destination port number, packet Judgment criteria such as payload are defined. Further, as a program executed by the control unit 10, a reception protocol processing unit 13 that performs reception processing on the converted reception packet according to a communication protocol and a filter rule 11 that serves as a reference for determining an illegal packet are received and received. An illegal packet determination unit 12 that determines whether a packet is an illegal packet or a regular packet; a filter rule 11; a transmission protocol processing unit 14 that performs transmission processing according to a communication protocol for a packet that the illegal packet determination unit 12 determines to be a normal packet; Based on the received packet information notified from the reception protocol processing unit, the result of measuring the processing load such as the amount of packets to be filtered per unit time and the amount of packets to be received per unit time is notified as the own device processing load information. A processing load measuring unit 17 and the own device processing load information; When the measured processing load becomes larger than the threshold, the filtering processing is not performed (the processing is not performed by the illegal packet determination unit 12) and the transmission load is notified. An apparatus processing load determination unit 10 that notifies an instruction to transmit (short circuit relay instruction), and the reception interface unit 191 according to a predetermined rule when the short circuit relay instruction is notified from the apparatus processing load determination unit 10 A short-circuit relay switching unit 15 that selects a part of the received packet output from the terminal (short-circuit relay packet) and outputs the selected packet to the transmission interface unit 192.

Here, in the present embodiment, the control unit 100 is configured by, for example, a CPU, and has been described as having various programs as processing performed by the control unit 100. However, each function and processing is implemented by hardware by designing, for example, an integrated circuit. It can also be realized. Further, the processing load measuring unit 10 can receive information from the reception interface unit 191 or the illegal packet determination unit 12. Further, the apparatus processing load determination unit 10 can also function as the processing load measurement unit 17.

The threshold value is, for example, the amount of packets to be filtered per unit time or the number of packets to be received per unit time so that packets received by the packet filter device can be filtered without causing packet loss. It is good also as a standard value of the upper limit of quantity.

Next, the operation of the packet filter device 1 will be described.

FIG. 3 is a diagram illustrating an operation when the amount of packets transmitted through the transmission path 9 is small. When the amount of packets transmitted through the transmission path 9 is small, as shown in FIG. 3, in the packet filter device 1a that is upstream of the path through which the packets are transmitted, it is possible to perform a filtering process on all received packets. The regular packets A and B can be relayed to the downstream transmission path 9, and the illegal packets X and Y can be excluded.

FIG. 4 is a diagram showing an operation when the amount of packets transmitted through the transmission path 9 increases. As shown in FIG. 4, the amount of packets transmitted through the transmission path 9 increases, the processing load measured by the processing load measurement unit 17 exceeds the threshold, and exceeds the processing capability of the illegal packet determination unit 12 of the packet filter device 1a. Then, the device processing load determination unit 10 issues a short-circuit relay instruction, and the short-circuit relay switching unit 15 selects a part of the reception packet output from the reception interface unit 191 according to a predetermined rule, and transmits the transmission interface unit 192. To the transmission line 9.

Here, the predetermined rule followed by the short-circuit relay switching unit 15 is stored in the storage unit 200, and is a certain percentage of the received packet amount (for example, 50% of the total received packet amount). Alternatively, a packet having specific information selected from information described in the received packet or information obtained from the identifier, such as the destination terminal device, the transmission source terminal device, or the type of data included in the packet (for example, the destination All packets whose terminal device is A, packets for transmitting voice data, etc.) may be used.

By the above-described operation of the packet filter 1a, as shown in FIG. 4, the normal packet A and the illegal packets X1, X2, and X3 are filtered, and the normal packet A is relayed to the downstream transmission path 9, and the illegal packet X1 , X2, and X3 are excluded, but the normal packet B and the illegal packets Y1 and Y2 transmitted to the transmission path 9 by the short-circuit relay instruction without performing the filtering process are not subjected to the filtering process and are directly transmitted to the downstream transmission path. 9 is relayed.

On the other hand, a packet filter device 1b is connected downstream of the transmission line 9, and the regular packets A and B and illegal packets Y1 and Y2 transmitted from the upstream packet filter device 1a to the transmission line 9 By receiving and filtering by 1b, the regular packets A and B can be relayed to the downstream transmission path 9, and the illegal packets Y1 and Y2 can be excluded.

In this way, even when the processing load exceeds the threshold in the upstream packet filter device and an illegal packet is transmitted to the transmission line without performing the filtering process, the downstream packet filter device filters and removes the illegal packet. can do.

Further, even if the downstream packet filter device also transmits an illegal packet to the transmission line without performing a filtering process because the processing load exceeds the threshold, the downstream packet filter device (not shown in FIG. 4) Unauthorized packets can be filtered out.

FIG. 5 is a processing flowchart showing the operation of the packet filter device 1 in this embodiment. The packet filter device receives the packet from the transmission path 9 (S101), measures the filtering processing load, that is, the processing load applied to the packet filter device, by the processing load measuring unit 17, and the processing load is determined by the device processing load determining unit 10. It is determined whether the threshold value is exceeded (S102). When the threshold value is not exceeded (NO in S102), the illegal packet determination unit 12 performs a filtering process on all packets (S103), and transmits the filtered packet from the transmission path 9 (S104). On the other hand, when the processing load exceeds the threshold value (YES in S102), the device processing load determination unit 10 outputs a short-circuit instruction to the short-circuit relay switching unit 15, and the short-circuit relay switching unit 15 determines the received packet according to a predetermined rule. A part is output to the filtering process, and the other received packets are output to the transmission interface without performing the filtering process (S105). Then, the packet filtered according to the rule is output to the transmission line (S104).

The first embodiment has been described above.

As described above, in this embodiment, if the packet filter device of the present invention is connected in multiple stages to the transmission path on the packet route, the processing load exceeds the threshold value in the upstream packet filter device, and the filtering process is performed. Even if relayed downstream without performing the filtering, filtering processing is performed in a plurality of packet filter devices connected downstream, so that it is possible to prevent illegal packets from reaching the destination terminal device.

In addition, even when the packet filter device receives a large number of illegal packets as described above, the packet loss is prevented by the short-circuit relay instruction in the packet filter device, so that the regular packet can be prevented from being lost.

Second embodiment

In the above-described first embodiment, the device processing load determination unit 10 of each packet filter device 1 determines only from the processing load measured by the processing load measurement unit 17 of its own device and issues a short-circuit relay instruction. However, since various packets are transmitted and received between terminal devices connected to the communication network, packets are transmitted in all directions on the transmission path 9, and the processing load of the downstream packet filter device 1 is not necessarily small. Is not limited.

Therefore, in the second embodiment, information regarding the processing load of the own device (hereinafter referred to as “own device processing load information”) is periodically exchanged between the plurality of packet filter devices 1 to each packet filter device 1. When the device 1 grasps information on the processing load of the other packet filter device 1 (hereinafter referred to as “other device processing load information”) and the processing load of the own device exceeds the threshold, the downstream packet filter device 1 A method for adjusting the amount of packets transmitted downstream by short-circuit relaying without performing filtering processing according to the size of the processing load will be described.

A configuration example of the information network system according to the second embodiment is the same as that shown in FIG.

FIG. 6 is a diagram showing an example of the internal configuration of the packet filter device 1.

That is, the packet filter device 1 includes a reception interface unit 191 that receives a packet from the transmission path 9 and converts it into a bit string that can be processed inside the device, a control unit 100 that performs various filtering processes on the received packet, The storage unit 200 stores a filter rule 11 for processing, and a transmission interface unit 192 that converts a bit string of a received packet into a code suitable for transmission on a transmission path. Here, the filter rule 11 is a rule set in advance for selecting illegal packets and regular packets. The packet source address, destination address, protocol, source port number, destination port number, packet Judgment criteria such as payload are defined.

In addition, as a program executed by the control unit 10, another device that performs reception processing on the converted received packet according to a communication protocol and notifies the other device processing load information received from another packet filter device 1 A reception protocol processing unit 131 that outputs a processing load information packet to the apparatus processing load determination unit 101 and a filter rule 11 that is a criterion for determining an illegal packet, and determines whether the received packet is an illegal packet or a regular packet. A packet determination unit 12, a packet determined by the illegal packet determination unit 12 as a regular packet, and a local device processing load information packet for reporting the local device processing load information output by the device processing load determination unit 101 are transmitted according to a communication protocol. A transmission protocol processing unit 141 that performs transmission and a bit of a packet to be transmitted. A transmission interface unit 192 that converts a sequence into a code suitable for transmission through a transmission path, and a packet amount to be filtered per unit time based on received packet information notified from the reception protocol processing unit and a unit time per unit time The processing load measuring unit 17 for notifying the result of measuring the processing load such as the amount of packets to be received as own device processing load information, and the own device processing load including own device processing load information to be notified to other packet filter devices 1 When the information processing packet is output periodically and the processing load notified by the self-device processing load information is compared with a threshold value and the measured processing load becomes larger than the threshold value, another packet filter device 1 Based on the processing load information received from the other device, the filtering processing is not performed (the illegal packet determination unit 12 performs processing). A device processing load determination unit 101 that determines a rule such as the amount of packets to be transmitted to the transmission path 9 and notifies an instruction of the determination content (short circuit relay instruction), and the short circuit from the device processing load determination unit 101 When a relay instruction is notified, a part of the received packet output from the reception interface unit 191 is selected according to the instructed rule (short-circuit relay packet) and is output to the transmission interface unit 192. 151.

The self-device processing load information packet may be notified by a UDP / IP packet or a TCP / IP packet, or may be notified by using a protocol decided in advance with all the packet filter devices 1. Good. Further, the own device processing load information packet may be notified only to the adjacent packet filter device 1 or may be notified to all other packet filter devices 1.

FIG. 7 is a diagram showing a data flow when notifying all other packet filter devices 1. As shown in FIG. 7, the packet processing apparatus 1 transmits the packet processing load information packet received from one transmission path 9 from the other packet filter apparatus 1 to the other transmission path 9 as it is. However, it is possible to obtain all other packet filter device 1 processing load information. For example, the processing load information of 1a transmitted by the packet filter device 1a is relayed to the

packet filter devices

1b and 1c via the transmission path 9, so that all the packet filter devices 1 acquire the processing load information of other devices. be able to.

FIG. 8 is a diagram illustrating an example of a rule that the apparatus processing load determination unit 101 instructs the short-circuit relay switching unit 151. As a rule such as the amount of packets transmitted to the transmission line 9 without performing the filtering process, for example, as shown in FIG. 8, three

packet filter devices

1a, 1b, 1c are connected to the transmission line 9 side by side. Assuming the case where a packet is transmitted from the left side of the transmission path 9 in a communication network (for the sake of explanation, illustration of the network node 2 and the terminal device 3 is omitted), the packet filter device 1a Assume that the processing loads 1b and 1c are 30%, 90%, and 30% of the threshold value, respectively. Here, for simplification of explanation, it is assumed that the processing capabilities of all the packet filter devices are equal.

Next, it is assumed that the amount of packets transmitted from the left side of the transmission path 9 increases and the processing load of the packet filter device 1a exceeds the threshold (100%) and reaches the threshold of 150%. At this point, the processing loads of the downstream

packet filter devices

1b and 1c are 90% and 30% of the threshold value, respectively, and the remaining processing capabilities of the

packet filter devices

1b and 1c are 80%, so the packet filter device 1a Suppresses the processing load of its own device to 90% (the remaining 10% is considered to absorb the processing load fluctuation) and processes the remaining packet amount (60% <80%) by the downstream

packet filter device

1b or 1c. The device processing load determination unit 101 of the packet filter device 1a issues a short-circuit relay instruction so that 60% of the received packet amount is transmitted to the downstream transmission line 9 as it is without performing filtering processing.

On the other hand, since the packet filter device 1b received 60% more from the packet filter device 1a than when the processing load was originally 90%, the processing load of the packet filter device 1b exceeded the threshold (100%) to 150%. Reach. At this point, since the processing load of the downstream packet filter device 1c is 30% of the threshold and the remaining processing capacity is 70%, the packet filter device 1b has a processing load of 90% (the remaining 10% is the remaining 10%). It is determined that the remaining packet amount (60% <70%) can be processed by the downstream packet filter device 1c, and filtering processing is performed on 60% of the received packet amount. Instead, the device processing load determination unit 101 of the packet filter device 1b issues a short-circuit relay instruction so that it is transmitted to the downstream transmission path 9 as it is.

Further, since the packet filter device 1c received 60% more from the packet filter device 1b where the processing load was originally 30%, the processing load of the packet filter device 1c reaches 90% of the threshold value. %) Is not exceeded and can be processed, the device processing load determination unit 101 of the packet filter device 1c does not issue a short-circuit relay instruction. Here, as described above, a rule is stored in advance in the storage unit 200 to filter the packet amount by the own device when the downstream packet filter device has a processing load, and the device processing load determination unit 101. The short-circuit relay switching unit 151 determines the amount of packets to be filtered according to the rule.

As described above, FIG. 8 shows an example in which the three

packet filter devices

1a, 1b, and 1c cooperate to perform a filtering process on a large amount of received packets. However, if the packet filter device 1a has an excessively large amount, When a packet is received (for example, 500% of the threshold value), it is assumed that the packet filter device 1a determines that all received packets cannot be processed even if the processing capabilities of the downstream

packet filter devices

1b and 1c are combined. In this case, for example, a received packet that cannot be processed in the most downstream packet filter device 1c may be discarded, or a received packet that cannot be processed in the upstream packet filter device 1a determined to be unprocessable. May be discarded.

The reason why the packet may be discarded is that a received packet that cannot be processed may include an illegal packet. In order to prevent the destination terminal from receiving an illegal packet, the packet filter device 1a This is because, when it is determined that all the received packets cannot be processed even if the processing capabilities of the

packet filter devices

1b and 1c are combined, a means of intentionally discarding the received packets that cannot be processed can be considered.

FIG. 9 is a processing flowchart showing the operation of the packet filter device 1 in the present embodiment. The packet filter device 1 receives a packet from the transmission line 9 (S201), measures the filtering processing load, that is, the processing load applied to the packet filter device, by the processing load measuring unit 17, and the device processing load determining unit 10 processes the processing load. Is determined to exceed the threshold (S202). When the threshold value is not exceeded (NO in S202), the illegal packet determination unit 12 performs a filtering process on all packets (S203), and transmits the filtered packet from the transmission path 9 (S204). On the other hand, if the processing load exceeds the threshold value (YES in S202), whether or not the amount of data that can be processed by the downstream packet filter device will be determined downstream if the packet is transmitted downstream from the own device without performing the filtering process. Judgment is made from the processing load information of a certain packet filter device (S205). If the amount of data that can be processed by the downstream packet filter device does not exceed (NO in S205), a part of the received packet is output to the filtering process according to a predetermined rule, and the other received packets are transmitted without performing the filtering process. After output to the interface (S206), the packet is transmitted from the transmission path (S204). When it is determined that the amount of data that can be processed by the downstream packet filter device is exceeded (YES in S205), the packet filter device 1 discards the received packet that is not subjected to the filtering process (S207), and only the packet determined to be a regular packet is transmitted. The packet is transmitted from (S204).

Here, a process of discarding a received packet that is not filtered in S207 is performed, but discarding of a packet that cannot be processed may be performed by a downstream packet filter device.

The second embodiment has been described above.

As described above, in this embodiment, the plurality of packet filter devices 1 regularly exchange their own processing load information with each other, and each packet filter device 1 performs processing of the other packet filter devices 1. The information on the load is grasped, and when the processing load of the own device exceeds the threshold, the packet of the packet to be transmitted to the downstream by short-circuit relaying without performing the filtering process depending on the processing load of the downstream packet filter device 1 By adjusting the amount, even when the upstream packet filter device 1 receives a large number of packets, the processing load can be optimally shared in cooperation with the plurality of downstream packet filter devices 1. Therefore, it is possible to prevent illegal packets from reaching the destination terminal device, and even when a large number of illegal packets are received by the packet filter device, in order to prevent packet loss due to a short-circuit relay instruction within the packet filter device, regular packets Can be prevented from disappearing.

Third embodiment

As shown in FIG. 1, in the first embodiment and the second embodiment described above, the packet filter device 1 is connected inline to the transmission line 9. This connection method is characterized in that the packet filter device 1 can target all packets transmitted through the transmission path 9 as a filtering process.

On the other hand, when the packet transmitted through the transmission path 9 includes a packet specified as not subject to filtering processing, the packet filtering apparatus 1 uses the packet specified as not subject to filtering processing in the connection method shown in FIG. As a result, reception processing and transmission processing are performed until a wasteful processing load occurs.

Therefore, in the third embodiment, the packet filter device 1 transmits / receives only the packet defined as the filtering target, and the packet defined as not subject to the filtering process does not pass through the packet filter device 1 and is transmitted through the transmission line 9. A configuration capable of transmitting the data will be described with reference to FIG.

Note that FIG. 10 is a diagram focusing only on the portion where the packet filter device 1 is connected to the transmission line 9, and descriptions of the network node 2 and the terminal device 3 are omitted.

In FIG. 10, the packet relay device 200 is connected inline to the transmission line 9, and the packet relay device 200 and the packet filter device 1 are connected via the transmission line 900.
The packet relay apparatus 200 relays a packet defined as a filtering process target among the packets transmitted through the transmission path 9 to the transmission path 900, and relays a packet defined as not subject to the filtering process to the transmission path 900. Without relaying to the transmission line 9 (the transmission line 9 in the direction opposite to the direction of reception).

The packet filter device 1 internally processes the packet received from the transmission line 900, and then transmits the transmission packet to the transmission line 900. The packet relay apparatus 200 that has received a packet from the transmission path 900 relays the packet to the transmission path 9.

The basis for the packet relay device 200 to determine a packet that is subject to filtering processing or not subject to filtering processing may be information on a destination terminal device or a transmission source terminal device included in the packet, It may be a specific bit string included in the data loaded in the packet.

Here, the packet relay apparatus 200 relays a packet received from the left direction of the transmission path 9 among the packets defined as a filtering process target to the transmission path 900, and the packet filtering apparatus 1 performs the filtering process. When the packet is relayed to the transmission path 9 again, it is necessary to relay the packet to the right direction of the transmission path 9, and the packet received from the right direction of the transmission path 9 is relayed to the transmission path 900, and the packet filter device 1 When the packet subjected to the filtering process is relayed to the transmission path 9 again, it is necessary to relay the packet to the left of the transmission path 9.

As a method for realizing the above-described relay method in the packet relay device 200, there is a method of configuring a plurality of VLANs (Virtual LANs) between the packet relay device 200 and the packet filter device 1, as shown in FIG.

That is, in FIG. 11, VLAN 1 and VLAN 2 are configured between the packet relay device 200 and the packet filter device 1, and the packet relay device 200 moves to the left of the transmission path 9 among the packets defined as the filtering processing target. The packet received from 1 is attached with a VLAN tag of VLAN 1 and relayed to the transmission line 900, and the packet received from the right side of the transmission line 9 is attached with a VLAN tag of VLAN 2 and relayed to the transmission line 900.

On the other hand, when the packet filter device 1 internally processes a packet received from the transmission line 900 and transmits it again to the transmission line 900, the packet with the VLAN tag of VLAN1 is attached to the VLAN tag of VLAN2 and transmitted. A packet with a VLAN tag of VLAN2 is attached to the VLAN tag of VLAN1 and transmitted.

Further, the packet relay apparatus 200 removes the VLAN tag from the packet received from the transmission path 900 and transmits it to the left side of the transmission path 9 with the VLAN tag of VLAN2. The packet is sent to the right side of the transmission line 9 with the VLAN tag removed.

By the way, as described above, when the packet filter device 1 cannot cope with a packet having a VLAN tag, a transmission path 901 and a transmission path 902 are provided between the packet relay device 200 and the packet filter device 1 as shown in FIG. The packet relay apparatus 200 relays a packet received from the left direction of the transmission path 9 among the packets stipulated for filtering processing, to the transmission path 901 and receives a packet received from the right direction of the transmission path 9 Is relayed to the transmission line 902.

On the other hand, the packet filter device 1 internally processes a packet received from the transmission path 901 and then transmits it to the transmission path again when transmitting to the transmission path 902 and internally processes a packet received from the transmission path 902. When transmitting again to the transmission path, the transmission is performed to the transmission path 901.

Further, the packet relay apparatus 200 transmits the packet received from the transmission path 901 to the left of the transmission path 9 and transmits the packet received from the transmission path 902 to the right of the transmission path 9.

As the packet relay device 200, for example, a switching hub or a layer 3 switch used in a LAN compliant with the IEEE 802.3 standard may be used, or a packet having specific destination information or transmission source information is specified. It may have a function capable of setting to relay to the relay destination port. Such a function can be realized by using, for example, the Static MAC Address setting function implemented in the Catalyst 2950 of Cisco, CenterCOM IA810M, CenterCOM x610Series, etc. of Allied Telesis.

The third embodiment has been described above.

As described above, according to the present embodiment, the packet filter device 1 only needs to perform the filtering process for only the packets prescribed for the filtering process. A more robust communication control system can be constructed against cyber attacks.

As described in the above embodiments, the present invention provides a packet filter device that performs a filtering process that restricts the passage of packets according to a specific filter rule in a communication network in which a plurality of terminal devices are connected to a transmission path and transmits and receives packets. A plurality of packet filter devices are arranged on a path of a transmission path that is connected to the path and through which a packet is transmitted from the source terminal apparatus to the destination terminal apparatus.

In addition, the packet filter device receives all the packets to be subjected to filtering processing among the packets transmitted on the connected transmission path, and the packets subjected to some processing inside the packet filter device are connected. Send to transmission line.

Each of the packet filter devices performs a filtering process on a part of a packet received from a transmission line when a filtering processing load, a packet reception processing load, etc. (hereinafter referred to as “processing load”) exceeds a threshold value. By not transmitting to the transmission line, the processing load of the packet filter device is prevented from exceeding a threshold value.

Here, the packets transmitted to the transmission line without performing the filtering process include not only regular packets but also illegal packets.

In order for the packet filter device to transmit a part of the packet received from the transmission line to the transmission line without performing the filtering process when the processing load exceeds the threshold, the packet filter apparatus includes the following: A processing function is provided.

That is, a reception interface unit that receives a packet from a transmission path and converts it into a bit string that can be processed inside the apparatus, a reception protocol processing unit that performs reception processing on the converted reception packet according to a communication protocol, and a reception packet An illegal packet determination unit that determines whether the packet is an illegal packet or a regular packet, a filter rule storage unit that stores a filter rule for the malicious packet determination unit to determine an illegal packet, and the illegal packet determination unit is a normal packet A transmission protocol processing unit that performs transmission processing on the determined packet according to a communication protocol, a transmission interface unit that converts a bit string of the packet to be transmitted into a code suitable for transmission on the transmission path, and filtering processing per unit time, for example Packets received and processed per unit time A processing load measuring unit that measures a processing load such as a processing amount and a processing load measured by the processing load measuring unit are compared with a threshold value, and when the measured processing load becomes larger than the threshold value, a filtering process is performed. A device processing load determination unit that issues an instruction to transmit to a transmission line without transmission (hereinafter referred to as a “short circuit relay instruction”), and a predetermined when a short circuit relay instruction is issued from the device processing load determination unit. A short-circuit relay switching unit that selects a part of the received packet output from the reception interface unit according to a rule (the selected packet is referred to as a “short-circuit relay packet”) and outputs the selected packet to the transmission interface unit. .

The threshold value is, for example, the amount of packets to be filtered per unit time or the reception processing per unit time so that all packets received by the packet filter device can be filtered without causing packet loss. It is good also as a standard value of the upper limit of packet amount.

Here, a packet transmitted to the transmission line without performing the filtering process is subjected to a filtering process in a packet filter device connected downstream of the transmission line.

Therefore, even when the processing load exceeds the threshold in the upstream packet filter device and an illegal packet is transmitted to the transmission line without performing the filtering process, the downstream packet filter device filters and removes the illegal packet. Even if the downstream packet filter device also sends an illegal packet to the transmission line without performing a filtering process because the processing load exceeds a threshold, the downstream packet filter device filters the illegal packet. Can be removed.

From the above, if the packet filter device of the present invention is connected in multiple stages to the transmission path on the packet route, the processing load exceeds the threshold in the upstream packet filter device and relayed downstream without performing filtering processing. However, since the filtering process is performed in a plurality of packet filter devices connected downstream, it is possible to prevent an illegal packet from reaching the destination terminal device.

In addition, even if the filtering capability of individual packet filter devices is not high in response to an attack from a person who has entered the system of an industrial system, the multiple packet filter devices connected in multiple stages cooperate to reduce the filtering processing load. By sharing, a large amount of attack packets can be filtered, and a secure industrial system can be constructed.

Also, even if a large number of attack packets occur, the reception buffer overflow in each packet filter device can be prevented, so that regular packets are not lost and the system can be prevented from being stopped.

In addition, this invention is not limited to the above-mentioned Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

In addition, each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

Also, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

1, 1a, 1b, 1c Packet filter device 100 Control unit 200

Storage unit

10, 101 Device processing load determination unit 11 Filter rule storage unit 12 Illegal

packet determination unit

13, 131 Reception

protocol processing unit

14, 141 Transmission

protocol processing unit

15, 151 Short-circuit relay switching unit 17 Processing load measuring unit 191 Reception interface unit 192 Transmission interface unit 2 Network node 200 Packet relay device 3

Terminal devices

9, 900, 901, 902 Transmission path

Claims

In a packet filter device that is connected to a plurality of terminal devices via a transmission path, receives a packet transmitted through the transmission path, and performs a filtering process that restricts the passage of the packet according to a specific rule.
A storage unit for storing the specific rule;
And a control unit configured to change the specific rule stored in the storage unit and perform the filtering process when a processing load for packet processing reaches a specified value.
In claim 1,
The control unit collects information on the processing load of the packet in the other packet filter device from another packet filter device connected via the transmission path, and the processing load for processing the packet of the own device, and The packet filter device, wherein the specific rule is changed based on the information on the processing load collected from the other packet filter device.
In a packet filter device that is connected to a plurality of terminal devices via a transmission path, receives a packet transmitted through the transmission path, and performs a filtering process that restricts the passage of the packet according to a specific rule.
A storage unit for storing the specific rule;
Information regarding packet processing load is mutually exchanged with other packet filter devices connected via the transmission path, and the specific rule is changed according to the information regarding the processing load received from the other packet filter devices. And a control unit that performs the filtering process.
In claim 2 or 3,
Changing the specific rule means changing the filtering so as to omit the filtering process for some or all of a plurality of packets received from the transmission path.
In claim 4,
The controller omits the filtering process based on information on the processing load collected from the other packet filter device so that the processing load on the other packet filter device falls within a predetermined threshold. A packet filter device characterized by determining the amount of.
In claim 4,
If the control unit omits the filtering process for a part of the received plurality of packets, and determines that the processing load on the other packet filter device exceeds a predetermined threshold, the received packet A packet filter device that discards the packet from which the filtering process is omitted.
In claim 4,
A plurality of other packet filter devices are connected to the transmission line in multiple stages,
The control unit obtains the amount of packets that can be processed by the plurality of other packet filter devices based on the information on the processing load collected from the plurality of other packet filter devices, and determines the number of packets for which the filtering process is omitted. A packet filter device characterized by determining an amount.
In claim 4,
The control unit omits the filtering process based on any of a specific bit string included in the packet, information on the packet transmission source terminal device, information on the packet destination terminal device, and information on the protocol used by the packet data. A packet filter device that selects a packet to be transmitted.
In claim 2 or 3,
The processing load is obtained from the amount of packets received by the packet filter device per unit time.
A plurality of terminal devices connected to each other via a transmission path and transmitting and receiving packets;
A plurality of packet filter devices for receiving a packet transmitted through the transmission path and performing a filtering process for restricting the passage of the packet according to a specific rule, and a communication control system comprising:
The packet filter device includes:
A storage unit for storing the specific rule;
And a control unit that performs the filtering process by changing the specific rule stored in the storage unit when a processing load for packet processing reaches a specified value.
In claim 10,
At least one packet filter device collects information on the processing load of the packet of the other packet filter device from another packet filter device;
The at least one packet filter device has a processing load applied to the other packet filter device based on a processing load applied to processing the packet of the own device and information relating to the processing load collected from the other packet filter device. The specific rule is changed so as to omit the filtering processing of a part or all of a plurality of packets so that is within a predetermined threshold value.
In claim 10,
At least one of the packet filter devices has a relay device connected between the packet filter device and the transmission path,
The communication apparatus according to claim 1, wherein the relay apparatus selects a packet to be subjected to the filtering process from packets flowing through the transmission path and transmits the selected packet to the at least one packet filter apparatus.