COMMUNICATION CONTROL DEVICE, COMMUNICATION CONTROL METHOD, AND COMMUNICATION CONTROL PROGRAM

Abstract

In a network in which individual edge devices (20) are logically separated from each other by different VLANs, a security device (10) detects unauthorized communication in each VLAN. When unauthorized communication is detected, the security device (10) broadcasts prescribed data into a VLAN in which the unauthorized communication has been detected, and identifies an edge device (20) in the VLAN on the basis of a response to the broadcast. Then, the security device (10) instructs the identified edge device (20) to perform communication control with respect to the unauthorized communication.

Description

[Technical field]

[0001] The present invention relates to a communication control device, a communication control method, and a communication control program. [Background technology]

[0002] Traditionally, quality control functions that control high-quality communications have been deployed in edge functions close to subscriber terminals, but due to rising costs caused by distributed deployment, there is an expectation that they will be deployed centrally in the cloud, etc.

[0003] On the other hand, centralized deployment makes it impossible to provide flexible control between the subscriber terminal and the quality control function, and there is a concern that an attack that sends a large amount of high-quality traffic may result in the high-quality traffic of other users who are using the service appropriately being discarded, causing communication outages, etc.

[0004] Normally, this can be dealt with by identifying the communication path from the IP (Internet Protocol) address of the attacker and issuing a cut-off command to the device on the path. However, in services with a large number of users, duplicate IP addresses are sometimes assigned to subscribers and then logically divided and forwarded using VLANs (Virtual Local Area Networks) or various tunnels. In such cases, since the communication path cannot be identified using the IP address alone, various information is managed by security devices, etc., and the device that issues the cut-off command is identified from the detected information, and the cut-off is then performed. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] IDS technology and trends, [online], [Retrieved March 16, 2022], Internet<https: / / www.bcm.co.jp / site / security / security2-5.pdf> [Non-Patent Document 2] The forefront of intrusion prevention measures, [online], [Retrieved March 16, 2022], Internet<https: / / atmarkit.itmedia.co.jp / fsecurity / special / 07ids / ids01c.html> Summary of the Invention [Problem to be solved by the invention]

[0006] However, conventional technologies have the problem of being unable to appropriately control communications while reducing the costs of information management. For example, when issuing a command to block a communication, it is necessary to constantly update and manage information using security devices, etc., so that the IP address and other information, as well as the information of the controlled communication destination device, can always be identified reliably. However, this requires manual work by an operator and software that automatically reflects changes to the security device when communication conditions are changed, which is expensive.

[0007] In addition, for example, in cases where settings are broadcast as in BGP Flowspec and the communication device that receives the settings determines whether or not settings are necessary and then implements the settings, it becomes difficult to make a judgment if there are duplicate IP addresses, and it is not possible to appropriately block communications.

[0008] The present invention has been made in consideration of the above, and aims to provide a communication control device, a communication control method, and a communication control program that can appropriately control communications while reducing the costs associated with information management. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems and achieve the objective, the communication control device of the present invention is characterized in that it has a detection unit that detects unauthorized communication in each VLAN in a network in which each edge device is logically divided into different VLANs, an identification unit that, when unauthorized communication is detected by the detection unit, broadcasts specified data within the VLAN in which the unauthorized communication was detected and identifies an edge device in the VLAN based on the response to the broadcast, and a communication control unit that instructs the edge device identified by the identification unit to control communication against the unauthorized communication. Effect of the Invention

[0010] According to the present invention, it is possible to appropriately control communications while reducing the costs involved in information management. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram illustrating an example of a configuration of a communication system according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a communication path in the communication system according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating the configuration of a security device according to the present embodiment. [Figure 4] FIG. 4 is a diagram showing a process in which a security device issues an instruction to block unauthorized communication. [Diagram 5] FIG. 5 is a flowchart illustrating an example of a processing procedure of the security processing. [Figure 6] FIG. 6 is a diagram for explaining the problems that arise when using a conventional BGP Flowspec. [Figure 7] FIG. 7 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A communication control device, a communication control method, and a communication control program according to the present application will be described in detail below with reference to the accompanying drawings. The present invention is not limited to the following embodiments.

[0013] [Communication system configuration] A configuration of a communication system according to an embodiment will be described. Fig. 1 is a block diagram showing an example of the configuration of a communication system according to an embodiment. As shown in Fig. 1, the communication system includes a security device (communication control device) 10, a plurality of edge devices 20A-20C, a plurality of subscriber terminals 30A-30C, a plurality of SWs (switches) 40A-40D, and a plurality of quality control devices 50A and 50B.

[0014] When the multiple edge devices 20A-20C, multiple subscriber terminals 30A-30C, multiple SWs (switches) 40A-40D, and quality control devices 50A and 50B are described without any particular distinction, they will be referred to as edge device 20, subscriber terminal 30, SW40, and quality control device 50, respectively. Furthermore, the configuration shown in Fig. 1 is merely an example, and the specific configuration and the number of each device are not particularly limited.

[0015] In addition, in the communication system illustrated in FIG. 1, it is assumed that the communication using the mechanism handles particularly high-priority (high-quality) communications, and that large amounts of packet loss or communication interruptions are not acceptable.

[0016] In the communication system, the edge devices 20A to 20C are logically divided into different VLANs. That is, in the communication system, for example, one edge device 20, a quality control device 50, and a security device 10 are configured in a logically divided state such as one VLAN.

[0017] Also, for example, in a communication system, when a high-quality setting and large-volume unauthorized communication is performed from a subscriber terminal 30, congestion occurs between the subscriber terminal 30 and the quality control device 50, causing a large amount of packet loss and communication interruption. For this reason, a security device 10 capable of detecting attacks is installed on the route or at a point where traffic can be copied and received in the communication system.

[0018] The security device 10 detects unauthorized communication and performs communication control to block the unauthorized communication. Here, with reference to FIG. 2, a communication path in the communication system will be described. FIG. 2 is a diagram showing an example of a communication path in the communication system according to the embodiment. As illustrated in FIG. 2, it is assumed that the subscriber terminal 30A transmits a packet to the subscriber terminal 30C via the edge device 20A, SW40A, SW40B, SW40C, SW40D, and the edge device 20C. In such a case, for example, the security device 10 receives a copy of the packet from SW40B and analyzes the received packet to detect unauthorized communication.

[0019] The edge devices 20A to 20C and the SWs (switches) 40A to 40D are communication devices that transfer packets. The quality control devices 50A and 50B manage sessions and also perform quality control.

[0020] [Security device configuration] 3 is a block diagram illustrating the configuration of a security device of this embodiment. As illustrated in FIG. 3, a security device 10 of this embodiment includes a communication processing unit 11, a control unit 12, and a storage unit 13.

[0021] The communication processing unit 11 is realized by a NIC (Network Interface Card) or the like, and controls communication via electric communication lines such as a LAN (Local Area Network) or the Internet.

[0022] The storage unit 13 stores data and programs necessary for various processes by the control unit 12, and has an edge device address storage unit 13a. For example, the storage unit 13 is a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The edge device address storage unit 13a stores the IP address of the edge device 20 identified by the identification unit 12b described later.

[0023] The control unit 12 has an internal memory for storing programs that define various processing procedures and required data, and executes various processes using these. For example, the control unit 12 has a detection unit 12a, a specification unit 12b, and a communication control unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0024] The detection unit 12a detects unauthorized communication in each VLAN in a network in which each edge device 20 is logically divided into different VLANs. Any method may be used to detect unauthorized communication. For example, in order to detect unauthorized communication, the detection unit 12a counts the amount of data of transmitted packets in a predetermined period for each source IP address or destination IP address for each VLAN. Then, when the amount of data is equal to or greater than a predetermined threshold, the detection unit 12a detects that unauthorized communication has occurred for the source IP address or destination IP address in the VLAN.

[0025] When the detection unit 12a detects unauthorized communication, the identification unit 12b advertises predetermined data within the VLAN in which the unauthorized communication was detected, and identifies the edge device 20 in the VLAN based on a response to the advertisement. As a method for identifying the edge device 20, the identification unit 12b may identify the edge device 20 by using, for example, DHCP (Dynamic Host Configuration Protocol), RA (Router Advertisement), or other broadcast or multicast.

[0026] For example, the identification unit 12b broadcasts a DHCP IP address request message (DHCP Discover message) within the VLAN in which unauthorized communication is detected, receives a response to the message (DHCP Offer message) from an edge device 20 in the VLAN, and identifies the IP address of the edge device 20 in the VLAN from the information contained in the received response.

[0027] For example, the identification unit 12b multicasts an RS message within the VLAN in which the unauthorized communication was detected, receives a response to the RA message as a response to the RS message, and identifies the IP address of the edge device 20 in the VLAN from the information contained in the received response.

[0028] After identifying the IP address of the edge device 20, the identifying unit 12b stores the identified IP address of the edge device 20 in the edge device address storage unit 13a.

[0029] The communication control unit 12c instructs the edge device 20 identified by the identification unit 12b to control communication against unauthorized communication. For example, the communication control unit 12c notifies the edge device 20 identified by the identification unit 12b of an IP address for which communication is to be blocked, and instructs the edge device 20 to perform communication control to block communication related to the IP address.

[0030] More specifically, the communication control unit 12c, for example, reads out the IP address of the specified edge device 20 from the edge device address storage unit 13a, and notifies the edge device 20 arranged in the VLAN where the unauthorized communication was detected of the IP address of the packet to be blocked, with the read out IP address as the destination, thereby blocking the unauthorized communication. Note that the method of communication control for unauthorized communication by the communication control unit 12c is not limited to blocking packets related to the unauthorized communication, and may, for example, perform processing such as reducing the communication rate related to the unauthorized communication.

[0031] As a result, for example, as illustrated in FIG. 4, the security device 10 can instruct the edge device 20A of the VLAN where the unauthorized communication occurred to block the unauthorized communication. FIG. 4 is a diagram showing the process in which the security device instructs the blocking of unauthorized communication. In other words, the security device 10 does not require a database (DB) or the like that constantly manages the information of the notification destination for instructing the blocking of unauthorized communication in an updated state, and it is possible to reduce costs. In addition, the security device 10 can directly use the communication path of the VLAN used by the attack traffic to publicize the response from the edge device 20A that can be blocked, and can apply the blocking conditions on the side of the identified edge device 20A, thereby blocking the unauthorized communication.

[0032] [Security device procedure] Next, an example of a processing procedure of a process executed by the security device 10 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of a processing procedure of a security process.

[0033] As illustrated in FIG. 5, for example, when the detection unit 12a of the security device 10 detects unauthorized communication (Yes in step S101), the identification unit 12b broadcasts data within the VLAN in which the unauthorized communication was detected (step S102) and receives a response from the edge device 20 within the VLAN (step S103).

[0034] Then, the identifying unit 12b stores the IP address of the identified edge device 20 in the edge device address storage unit 13a (step S104). Next, the communication control unit 12c transmits a cut-off instruction to the IP address of the edge device 20 (step S105).

[0035] [Effects of the embodiment] In this way, the security device 10 according to the embodiment detects unauthorized communication in each VLAN in a network in which each edge device 20 is logically divided into different VLANs. When the security device 10 detects unauthorized communication, it broadcasts predetermined data within the VLAN in which the unauthorized communication was detected, and identifies the edge device 20 in the VLAN based on the response to the broadcast. The security device 10 then instructs the identified edge device 20 to control communication against the unauthorized communication. This allows the security device 10 to appropriately control communication while reducing costs associated with information management.

[0036] In other words, conventionally, when a security device performs a centralized analysis, a mechanism for identifying the destination of a blocking instruction based on information on IP packets determined to be unauthorized was required, and it was costly to constantly manage the information in an updated state. In contrast, the security device 10 according to this embodiment is able to identify the destination device to which a notification to block unauthorized communications is to be sent by using information other than its own management information, and does not require a database for constantly managing information on the destination of notifications to block unauthorized communications in an updated state, making it possible to reduce costs.

[0037] In addition, in the past, when the settings were broadcast like BGP Flowspec and the communication device that received it judged whether or not the settings were necessary and then carried out the settings, it was difficult to make the judgment if there were duplicate IP addresses. For example, as shown in Fig. 6, in the past, in BGP Flowspec, etc., a security device would publicize a blocking instruction for a terminal with an IP address that detected an attack to the entire network via a relay device that relays the notification, and the relevant edge device would perform the blocking process. Fig. 6 is a diagram explaining the issues when using the conventional BGP Flowspec.

[0038] However, for communications with many users, it is possible to convert IP addresses using NAPT (Network Address Port Translation) etc. and allow overlapping IP addresses of subscriber terminals. For this reason, in the past, if communication was blocked using only IP addresses, there was a concern that communication that should not be blocked would also be blocked, and it was not possible to block communication by publicizing the target IP addresses.

[0039] For example, as illustrated in FIG. 6, if the IP address "192.168.0.1" of subscriber terminal 300A and that of subscriber terminal 300B overlap and only subscriber terminal 300A is conducting unauthorized communication, when security device 100 instructs the relay device to block communication with IP address "192.168.0.1", communication between both subscriber terminal 300A and subscriber terminal 300B will be blocked.

[0040] In contrast, the communication system of this embodiment is networked in such a way that each edge device 20 is logically divided into different VLANs, and the security device 10 identifies the edge device 20 in the VLAN in which unauthorized communication is detected, and instructs the edge device 20 in that VLAN to control communication against the unauthorized communication. Therefore, if there are no overlapping IP addresses of subscriber terminals 30 within the VLAN, it is possible to block communication only of the subscriber terminal 30 that is performing unauthorized communication.

[0041] [System configuration, etc.] Each component of each device shown in the figures according to the above embodiment is a functional concept, and does not necessarily have to be physically configured as shown in the figures. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figures, and all or a part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0042] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0043] 〔program〕 It is also possible to create a program in which the processing executed by the security device 10 described in the above embodiment is written in a language executable by a computer. In this case, the same effect as in the above embodiment can be obtained by having the computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize the same processing as in the above embodiment.

[0044] Fig. 7 is a diagram showing a computer that executes a program. As shown in Fig. 7, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0045] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as exemplified in FIG. 7. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031, as exemplified in FIG. 7. The disk drive interface 1040 is connected to a disk drive 1041, as exemplified in FIG. 7. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, as exemplified in FIG. The video adapter 1060 is connected to a display 1061, as exemplified in FIG. 7.

[0046] 7, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored in, for example, the hard disk drive 1031 as program modules in which instructions to be executed by the computer 1000 are written.

[0047] Moreover, the various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1031 into the RAM 1012 as necessary, and executes various processing procedures.

[0048] Note that the program module 1093 and program data 1094 relating to the program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 relating to the program may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)) and read by the CPU 1020 via the network interface 1070.

[0049] Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and drawings which form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0050] 10. Security Devices 11 Communication processing unit 12 Control section 12a Detection unit 12b Specific part 12c Communication control section 13 Storage section 13a Edge device address storage unit 20A, 20B, 20C Edge Device 30A, 30B, 30C Subscriber terminal 40A, 40B, 40C, 40D SW 50A, 50B Quality control device

Claims

1. In a network in which edge devices are logically divided into different VLANs, a detection unit detects unauthorized communications in each VLAN; an identification unit that, when the detection unit detects unauthorized communication, broadcasts predetermined data within a VLAN in which the unauthorized communication has been detected, and identifies an edge device in the VLAN based on a response to the broadcast; a communication control unit that instructs the edge device identified by the identification unit to perform communication control against the unauthorized communication; A communication control device comprising:

2. The communication control device according to claim 1, characterized in that the identification unit broadcasts a DHCP IP address request message within the VLAN in which the unauthorized communication is detected, receives a response to the message, and identifies the IP address of an edge device in the VLAN from information contained in the received response.

3. The communication control device according to claim 1, characterized in that the identification unit multicasts an RS message within the VLAN in which the unauthorized communication is detected, receives a response to the RA message as a response to the message, and identifies the IP address of an edge device in the VLAN from information contained in the received response.

4. 2 . The communication control device according to claim 1 , wherein the communication control device notifies the edge device identified by the identification unit of an IP address for which communication is to be cut off, and instructs communication control to cut off communication relating to the IP address.

5. A communication control method executed by a communication control device, A detection step of detecting unauthorized communication in each VLAN in a network in which each edge device is logically divided into a different VLAN; an identifying step of, when unauthorized communication is detected by the detection step, broadcasting predetermined data within the VLAN in which the unauthorized communication was detected, and identifying an edge device in the VLAN based on a response to the broadcast; a communication control step of instructing the edge device identified by the identification step to control communication against the unauthorized communication; A communication control method comprising:

6. A detection step of detecting unauthorized communication in each VLAN in a network in which each edge device is logically divided into a different VLAN; a step of broadcasting predetermined data within a VLAN in which the unauthorized communication is detected, and identifying an edge device in the VLAN based on a response to the broadcast, when the unauthorized communication is detected by the detection step; a communication control step of instructing the edge device identified by the identification step to control communication against the unauthorized communication; A communication control program that causes a computer to execute the above.

Images