Server, information processing method, and program

Abstract

To provide a server, an information processing method, and a program capable of determining whether or not an external network is exposed. [Solution] A server having a memory unit for recording programs and a processor for executing the programs, wherein the processor executes the programs and functions as a packet acquisition unit for acquiring multiple packets to be processed by the server, a detection unit for detecting a connection response packet indicating a response for establishing a communication session from among the multiple packets based on a flag indicating the packet attributes set in each packet, and a determination unit for determining whether the server is exposed to an external network based on the source information and destination information set in the detected connection response packet.

Description

[Technical Field]

[0001] The present disclosure relates to a server, an information processing method, and a program. [Background technology]

[0002] If a server used on an intranet such as a company's internal network is accessible from an external network that is not intended to be allowed by the system, it could lead to serious damage, such as the port to the external network being exploited by an attacker. Conventionally, whether or not a server is exposed to an external network has been verified by checking the settings of the server, network equipment, etc.

[0003] For example, Patent Document 1 discloses a technology for determining the degree to which a cloud workflow is exposed to the Internet. Specifically, Patent Document 1 uses a cloud provider's API to identify cloud traffic paths and filtering elements (e.g., security groups, firewalls, load balancers, etc.) and acquires their network settings. The acquired network settings are then evaluated to determine the degree to which the target workload is exposed to the Internet. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] U.S. Patent Application Publication No. 2023 / 0336554 Summary of the Invention [Problem to be solved by the invention]

[0005] In the case of a method for externally checking network settings as in Patent Document 1, even if a specific port is exposed to all IP addresses (i.e., 0.0.0.0 / 0), it is not possible to determine whether the port is actually operating. Furthermore, the technology in Patent Document 1 is applicable to cloud computing environments, and for servers set up in on-premise environments, it may be practically difficult to obtain setting information such as network settings from the outside. In such cases, it is necessary to determine exposure to an external network using a method different from that in Patent Document 1.

[0006] One of the objectives of the exemplary embodiments of the present disclosure is to provide a server, an information processing method, and a program that can determine whether or not an external network is exposed. [Means for solving the problem]

[0007] A server according to one aspect of the present disclosure includes a storage unit that stores a program and a processor that executes the program, The processor executes the program, a packet acquisition unit that acquires a plurality of packets processed by the server; a detection unit that detects a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag that indicates a packet attribute set in each packet; It functions as a determination unit that determines whether or not the server is exposed to an external network based on the source information and destination information set in the detected connection response packet.

[0008] By having the above-mentioned characteristics, the server can efficiently determine whether or not the server itself is exposed to an external network through internal processing performed by executing a program.

[0009] Other problems and solutions disclosed in the present application will become apparent from the embodiments and drawings of the present disclosure. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a network configuration including a server according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the server 1 shown in FIG. [Figure 3] FIG. 3 is a block diagram illustrating an example of the software configuration of the server 1 shown in FIG. [Figure 4] FIG. 4 is a schematic diagram for explaining a connection establishment procedure (three-way handshaking) used in TCP and the like. [Figure 5] FIG. 5 is a block diagram showing an example of the flow of packets processed by the server 1 shown in FIG. [Figure 6] FIG. 6 is a flowchart showing an example of an information processing method for determining whether or not there is exposure to an external network. DETAILED DESCRIPTION OF THE INVENTION

[0011] A server according to an embodiment of the present disclosure will be described below with reference to the drawings. In the accompanying drawings, identical or similar elements are designated by identical or similar reference symbols and names, and duplicate descriptions of identical or similar elements may be omitted in the description of the embodiment. Note that the contents shown in the drawings are merely examples for explaining the present embodiment and are merely schematic examples for ease of explanation. The contents of the drawings may be modified or changed within the scope of technical problems.

[0012] <System Overview> FIG. 1 is a diagram illustrating an overview of a system according to this embodiment. The server 1 according to this embodiment is used on an intranet (internal network), such as a company network, a network within a specific organization, such as a network within an educational institution, or a network restricted to specific users. In this case, the server 1 is communicatively connected to one or more internal terminals 2 via the intranet. The internal terminals 2 include any information processing terminal connectable to an intranet, and may be, but are not limited to, a workstation, a personal computer (PC), a tablet terminal, a smartphone, a business terminal, an IoT device, or the like. While this embodiment illustrates a server 1 that can be used on an intranet, the intranet is merely an example, and the server 1 may also be a web server for external access.

[0013] Server 1 operates within an intranet and is responsible for providing various services and functions to internal terminals 2. For example, Server 1 can be used in various forms depending on the usage environment and / or organizational operations, such as document management, schedule management, campus management system, business application service, database service, file sharing service, storage service, etc. These services are intended for use by specific users or members of specific organizations, and it may be desirable to eliminate access from third parties via external networks such as the Internet, or to restrict direct access from external networks from a security perspective.

[0014] Even when restricting access from external networks as described above, improper network configuration and / or operational management may cause the communication ports of Server 1 to be opened to external networks such as the Internet, unintentionally making them accessible from external networks. For example, a port temporarily opened for test operation of a specific service may remain open, or a firewall may be configured incorrectly to allow external connections. In such cases, risks of unauthorized access from external networks, information leaks, and denial-of-service attacks (DoS attacks) may arise. Therefore, it is important to properly determine whether Server 1 is exposed to external networks and take appropriate measures. Even when at least some ports are intentionally exposed to the outside world, it may be necessary to determine whether communication with external networks is actually occurring via the intended ports from the perspectives of asset management, vulnerability prioritization, and so on.

[0015] Conventional methods for checking whether a server is exposed to an external network include external port scanning, or in cloud computing environments, checking network configuration information using a cloud provider's API, etc. However, simply checking network configuration information makes it difficult to determine whether a port exposed to an external IP address is actually running (i.e., whether a process accepting packets from the port is running). Furthermore, if Server 1 is configured in an on-premise environment other than a cloud computing environment, it is generally difficult to obtain network configuration information for Server 1 from the outside, and there are limitations to determining whether a server is exposed to an external network through external scanning.

[0016] Therefore, in this embodiment, a dedicated program is installed on the server 1, and by executing the program, the server 1 itself autonomously determines (checks) whether it is exposed to an external network through internal processing. The internal processing monitors packets processed (sent or received) by the server 1 and determines whether a connection response packet satisfying a specific condition is detected among the packets. If a connection response packet satisfying a specific condition is detected, it is determined that the server 1 is exposed to the external network. This configuration makes it possible to efficiently and accurately confirm whether the server 1 is exposed to an external network without relying on external scanning or configuration information acquisition. Below, the server 1 and a method for determining whether the server 1 is exposed to an external network will be described in detail, taking as an example a case where the server 1 is an information processing device set up in an on-premises environment.

[0017] <Server 1 hardware configuration> The server 1 is one or more information processing devices managed by a predetermined organization (user) such as a company. The server 1 may be configured on-premise using, for example, a general-purpose computer such as a workstation or a personal computer. As shown in FIG. 2, the server 1 includes at least a processor 10, a memory 11, a storage 12, a transmitter / receiver 13, an input / output device 14, etc., which are electrically connected to each other via a bus 16. Note that the configuration shown in the figure is an example, and the server 1 may have other configurations.

[0018] The processor 10 is a computing device that controls the overall operation of the server 1, controls the transmission and reception of data between each element, and performs information processing necessary for application execution and authentication processing. For example, the processor 10 is a CPU (Central Processing Unit) and / or a GPU (Graphics Processing Unit). Each function (means) of the server 1 is realized by the processor 10 executing a program or the like stored in the storage 12 and deployed in the memory 11.

[0019] The memory 11 includes a main memory configured with a volatile storage device such as a DRAM (Dynamic Random Access Memory) and an auxiliary memory configured with a non-volatile storage device such as a flash memory, an HDD (Hard Disc Drive), etc. The memory 11 is used as a work area for the processor 10, and also stores a BIOS (Basic Input / Output System) that is executed when the server 1 starts up, various setting information, etc.

[0020] The storage 12 stores various programs such as application programs, and in particular stores a program for determining whether the server 1 is exposed to an external network through internal processing. A database storing data used for each process may also be constructed in the storage 12. For example, a storage unit 120, which will be described later, is realized as part of the storage area of ​​the memory 11 and / or the storage 12.

[0021] The transmitting / receiving unit 13 is a communication interface that enables the server 1 to communicate with various information processing terminals such as the internal terminal 2 via a communication network such as an intranet. The transmitting / receiving unit 13 may further include a short-range communication interface such as Bluetooth (registered trademark) and BLE (Bluetooth Low Energy) and / or a USB (Universal Serial Bus) terminal.

[0022] The input / output device 14 is an information input device such as a keyboard, a mouse, etc., and an output device such as a display, etc. The input / output device 14 may include a touch panel or the like that has both functions of inputting and outputting information, and may also include a printer, a speaker, etc. as an output device.

[0023] A bus 16 is commonly connected to the above elements and transmits, for example, address signals, data signals and various control signals.

[0024] <Server 1 Functions (Software Configuration)> 3 is a block diagram illustrating an example of functions (software configuration) implemented in server 1. Server 1 may include, for example, a packet acquisition unit 101 (packet acquisition unit), a detection unit 102 (detection unit), a determination unit 103 (determination unit), and a notification unit 104 (notification unit) as functions (units) realized by processor 10 executing a program. Furthermore, storage unit 120 of server 1 may include various databases such as program-related information storage unit 121, processing result information storage unit 122, and setting information storage unit 123.

[0025] The program-related information storage unit 121 stores program code for realizing the Internet exposure determination process executed by the server 1, as well as setting parameters related to the program. The program code includes packet acquisition processing, packet analysis processing, external network exposure determination processing, log management processing, etc. The setting parameters include, for example, filter conditions for capturing specific packets using a filter such as a Berkley Packet Filter (BPF) described below, capture intervals for intermittently monitoring packets, and threshold information that serves as a determination condition for determining exposure to an external network.

[0026] The processing result information storage unit 122 stores packet information indicating packets processed by the server 1 and header information associated with the packets, analysis results by each functional unit described below, exposure determination results, and log information related to these. The header information of a packet is attribute information of the packet used for packet transmission / reception management, communication path control, and identification of communication targets. For example, the header information includes information indicating the protocol type of the packet, flag information indicating the communication control status and / or the content of the control request, sender information indicating the sender of the packet, and destination information indicating the destination of the packet. By storing the above information, the processing result information storage unit 122 makes it possible to check the monitoring results of whether or not the packet is exposed to the Internet at a later date and to use the results for operational audits and / or fault analysis of the server 1.

[0027] The setting information storage unit 123 stores system setting information of the server 1. The system setting information of the server 1 may include, for example, identification information of the server 1 (such as the server name), basic information of the server 1 such as the OS version, address information indicating the IP address assigned to the server 1 and its version (for example, IPv4, IPv6, etc.), information indicating the upstream network configuration, etc. In addition, the setting information storage unit 123 stores various setting information of the server 1 used in the process of determining exposure to an external network.

[0028] The type of OS of the server 1 (e.g., a Windows-based OS, a Linux®-based OS, a UNIX®-based OS, a macOS®-based OS, etc.) is not particularly limited. The upstream network configuration refers to a configuration of network devices or functions that are interposed between the server 1 and an external network (the Internet) and perform processes such as forwarding, distributing, blocking, monitoring, and converting communications to the server 1. Examples of the upstream network configuration include a network address translation (NAT), a network load balancer (NLB) that distributes load at the L3 / L4 layer, an application load balancer (ALB) that distributes load at the L7 layer, a web application firewall (WAF), and a proxy server. A case in which a global IP address is directly assigned to the network interface of the server 1 (direct connection) is also considered to be one aspect of the upstream network configuration. The upstream network configuration of the server 1 is not necessarily limited, and the external network exposure determination process described in this embodiment is particularly suitable for a case in which the upstream network configuration of the server 1 is a NAT, NLB, or direct connection.

[0029] The packet acquisition unit 101 acquires multiple packets processed by the server 1. Here, a "packet" is a unit of communication data transmitted and received over a network, and includes the aforementioned header information and a payload portion, which is the communication data itself. Furthermore, "packets processed by the server 1" refers to both packets transmitted and received by the server 1. In other words, the "processing" referred to here includes packet reception and / or transmission. The packet acquisition unit 101 acquires at least packets transmitted by the server 1, and may acquire both packets received by the server 1 and packets transmitted by the server 1. In particular, the packet acquisition unit 101 acquires packets transmitted or received via TCP (Transmission Control Protocol). The external network exposure determination process of this embodiment does not require the process of transmitting and receiving inspection packets from the outside (in principle, the process of transmitting inspection packets from the outside is not executed), and the packet acquisition unit 101 acquires packets processed by the server 1 during normal operation.

[0030] The packet acquisition unit 101 may acquire packets processed by the server 1 in real time, for example, by using a predetermined filtering mechanism. In this case, the predetermined filtering mechanism is not necessarily limited, and for example, a Berkley Packet Filter (BPF) may be suitably adopted. As shown in FIG. 5, the BPF is a filtering mechanism that operates in the kernel space between the NIC (Network Interface Card) and netfilter, and is a mechanism that passes only packets that meet predetermined filter conditions from among packets passing through the kernel space to the user land. When using the BPF, the packet acquisition unit 101 acquires packets sent or received by the server 1 in the kernel space, and the detection unit 102, described below, extracts only packets that meet predetermined filter conditions from among the packets acquired by the packet acquisition unit 101.

[0031] The packet acquisition unit 101 may operate intermittently to acquire packets for a predetermined time at predetermined intervals. Here, "operating intermittently" means, for example, acquiring packets intermittently at predetermined intervals, with one cycle consisting of a step of acquiring packets for a predetermined period of time (t minutes) and a step of stopping packet acquisition for a predetermined period of time (m hours) after t minutes have elapsed. A configuration in which packets are acquired continuously imposes a large computational load in a high-traffic environment, but acquiring packets through the above-described intermittent operation can reduce the computational load.

[0032] The detection unit 102 detects a connection response packet indicating a response for establishing a communication session from among the multiple packets acquired by the packet acquisition unit 101 based on flag information indicating the attributes of the packet set in each packet.

[0033] In communications using TCP, a procedure for establishing a communication session called three-way handshake, as shown in Figure 4, is executed. In this three-way handshake, three types of packets are exchanged between a party requesting a connection (access) and a party accepting the request: a connection request packet, a connection response packet, and a connection establishment completion packet. The connection request packet is a TCP packet sent to start a communication session, and has the SYN flag set in its header. The connection response packet is a TCP packet sent in response by the party receiving the connection request packet, and has both the SYN flag and the ACK flag (hereinafter, the SYN flag and the ACK flag are collectively referred to as the SYN-ACK flag) set in its header. The connection establishment completion packet is a TCP packet sent by the party receiving the connection response packet, and has the ACK flag set in its header. Figure 4, which shows an example of the transmission and reception of these packets, illustrates an example in which a communication session is established when an external terminal 3 attempting to access a server 1 via an external network such as the Internet sends a connection request packet, the server 1 sends a connection response packet, and then the external terminal 3 sends a connection establishment completion packet.

[0034] The detection unit 102, when monitoring packets (when the packet acquisition unit 101 is operating), refers to flag information included in the header information of packets processed by the server 1, and selectively detects connection response packets with the SYN-ACK flag set from among the packets acquired by the packet acquisition unit 101. That is, the detection unit 102 filters the packets acquired by the packet acquisition unit 101 using the filtering condition that the packets are connection response packets, and selectively extracts (captures) connection response packets from among the multiple packets processed by the server 1. As described above, the external network exposure determination process of this embodiment differs from a method of intentionally sending and receiving inspection packets from outside, and therefore the detection unit 102 extracts connection response packets with the SYN-ACK flag set regardless of whether they are responses corresponding to inspection packets. By selectively detecting connection response packets, rather than connection request packets or connection establishment completion packets, from among the three packets sent and received when establishing a communication session, it is possible to efficiently determine exposure to an external network while suppressing false detections.

[0035] Specifically, the reason for selectively detecting only connection response packets will be described in detail with reference to FIG. 5. FIG. 5 is a diagram showing an example of the flow of packet processing within the server 1. The NIC in FIG. 5 is an interface that has the function of sending and receiving packets between the server 1 and the network. Packets sent from the network are received by the NIC and passed to the kernel network stack. After the kernel network stack analyzes the contents of the packets (e.g., protocol analysis, routing processing, etc.), netfilter (a kernel module that applies filter settings such as iptables or nftables), which is a firewall function, controls whether the packets are allowed (ALLOW), dropped (DROP), or forwarded based on predetermined iptables or nftables setting information. Packets allowed by netfilter are processed by the protocol stack and passed to userland via a process waiting on an appropriate port.

[0036] When BPF is used in a packet processing flow such as that shown in Figure 5, BPF hooks packets between the NIC and netfilter to detect packets that meet specified filter conditions. When detecting connection request packets in this flow to determine exposure to external networks, not only are connection request packets that pass through netfilter captured, but connection request packets that would normally be dropped by netfilter are also captured. This results in a large number of false positives. In contrast, connection response packets are generated after connection request packets from the network have passed through netfilter. Therefore, capturing connection response packets allows you to detect actual communication sessions and properly determine whether or not a connection is exposed to external networks.

[0037] Furthermore, if exposure to an external network is determined using a connection establishment completion packet rather than a connection response packet, there is a risk of missed detection. For example, during the process of establishing a communication session, even if the party sending the connection request packet (e.g., external terminal 3) receives a connection response packet from server 1, it may reset the connection (RST: Reset packet) without returning a connection establishment completion packet. Even in such a case, communication with the external network is possible, that is, the device is exposed to the external network. However, a specification that captures connection establishment completion packets cannot detect RSTed communications. Capturing connection response packets makes it possible to detect RSTed communications, detect actual communication sessions without missing any detections, and reliably determine exposure to an external network. As described above, capturing connection response packets rather than connection request packets or connection establishment completion packets allows for efficient detection of exposure to an external network while ensuring accuracy of the determination.

[0038] When the packet acquisition unit 101 acquires packets through intermittent operation, the detection unit 102 also detects connection response packets intermittently at predetermined intervals in conjunction with the operation of the packet acquisition unit 101. By performing detection through such intermittent operation, the computational load associated with exposure determination can be reduced even when BPF is used.

[0039] The determination unit 103 determines whether the server 1 is exposed to an external network based on the source information and destination information set in the connection response packet detected by the detection unit 102. Specifically, the determination unit 103 references the source information and destination information included in the header information of the detected connection response packet and determines whether the server 1 is exposed to an external network based on whether the source information and destination information satisfy a predetermined determination condition. For example, the determination condition may be that the source indicated by the source information is an address assigned to the server 1 (Condition 1) and the destination IP address indicated by the destination information is not in a private IP range (Condition 2). Here, a private IP range refers to a range of IP addresses available on a network within a specific organization, such as an internal company. The determination unit 103 determines that the server 1 is exposed to an external network if the detected connection response packet satisfies the determination condition. In this way, by performing a determination process by comparing the source information and destination information of the detected connection response packet with the determination condition, the exposure status to an external network can be efficiently grasped. Furthermore, in the determination process of selectively capturing and verifying such connection response packets, an actually operating communication session with an external network can be detected.

[0040] The determination conditions applied to the determination unit 103 are not limited to the above examples. In addition to the above-described conditions 1 and 2, a determination condition for specifying an IP address to be excluded from the exposure determination target according to the setting of an authorized address may be set. That is, a determination condition for excluding connection response packets addressed to an authorized address from detection targets may be set so that even communications to an external network, communications to external destinations permitted within the organization, are excluded from the exposure determination target. When such a determination condition is set, the determination unit 103 determines that communication to the destination address is permitted, even if the destination information is in a global IP range that is not included in the private IP range, if the destination address is pre-registered in the storage unit 120 as an authorized address (i.e., if the authorized address is set as a determination condition). If the destination address is an IP address in the global IP range that is not an authorized address, the determination unit 103 determines that the server 1 is exposed to the external network based on the connection response packet addressed to the IP address. By determining exposure to the external network using a determination condition that takes the authorized address into account in this way, it is possible to efficiently and accurately grasp the exposure status of the server 1 to the external network while suppressing false positives and missed detections. In addition, the judgment unit 103 may determine whether the exposure to an external network is unintended by the system administrator, or instead of making such a judgment, may determine whether the port is intentionally made public by the sender (whether it is an address assigned to server 1 that is intentionally made public), whether the destination is an authorized address, etc., thereby determining whether the exposure to an external network is intentionally made public by the sender.

[0041] When the packet acquisition unit 101 acquires packets through intermittent operation, the determination unit 103 determines, at predetermined intervals during the intermittent operation, whether or not a connection response packet satisfying the predetermined determination condition, as described above, is included among the multiple packets. If a connection response packet satisfying the predetermined determination condition is detected even once, the determination unit 103 immediately determines that the server 1 is exposed to the external network. On the other hand, the determination unit 103 may count the determination of one cycle of intermittent operation as one determination result, and determine that the server 1 is in an unexposed state, i.e., not exposed to the external network, if it determines that a connection response packet satisfying the predetermined determination condition is not included a predetermined number of times or more consecutively. For example, if the packet acquisition unit 101 is set to capture packets every hour, the determination unit 103 may determine that the server 1 is unexposed if a connection response packet satisfying the determination condition is not detected 24 times in a row (i.e., for 24 consecutive hours).

[0042] Note that various settings such as the determination conditions, intermittent operation settings, and conditions for determining a non-exposure state (non-exposure determination conditions) may be set by a user of the organization that owns the server 1, or may be set by a provider that provides a program for external network exposure determination processing. The server 1 may include a setting processing unit (setting means) that receives an input operation from the user to specify various settings, and registers various settings such as the determination conditions, intermittent operation settings, and / or non-exposure determination conditions.

[0043] The notification unit 104 notifies the determination result regarding the exposure state of the server 1 to an external network. For example, when the determination unit 103 determines that there is exposure to an external network, the notification unit 104 is configured to notify the notification target of that fact. The notification target may be the user who owns the server 1, or, in addition to the user, or instead of the user, may be a provider that provides a program for determining exposure to an external network that is installed on the server 1. The notification method is not particularly limited, and any notification method may be used, such as a pop-up display on a management console, sending an email, an SNMP trap notification, or logging in a management system.

[0044] Furthermore, when the determination unit 103 determines that the server 1 is in a non-exposed state based on predetermined non-exposure determination conditions, the notification unit 104 may notify the determination result indicating the non-exposed state. This allows the user or provider to continuously and reliably grasp whether the server 1 is exposed to an external network, thereby enabling appropriate security management and operational management. Furthermore, when the determination unit 103 detects exposure to an external network via an intentionally exposed port or address, the notification unit 104 may notify the notification target of the detection result of exposure to the external network at the intentionally exposed port. Such detection result of exposure at an intentionally exposed port can be used for asset management and / or prioritizing vulnerability responses.

[0045] The processor 10 of the server 1 may have other auxiliary functions in addition to the above-mentioned functional units. For example, the program-related information storage unit 121 of the server 1 may store a plurality of patterns of commands according to the version of the IP address as commands for the process of determining exposure to an external network executed by each functional unit. In this case, the processor 10 of the server 1 may have a control function of reading out a command corresponding to the version of the IP address assigned to the server 1 from the program-related information storage unit 121 and instructing the command to each functional unit (such as the packet acquisition unit 101, the detection unit 102, and the determination unit 103).

[0046] <Example of information processing method> Next, an example of an external network exposure determination processing method according to this embodiment will be described with reference to the flowchart shown in FIG.

[0047] First, upon receiving a monitoring request for exposure to an external network (Internet), the processor 10 of the server 1 executes a program installed on the server 1 (step SQ101) and starts each process. Specifically, the packet acquisition unit 101 first acquires a plurality of packets processed by the server 1 (step SQ102). At this time, the packet acquisition unit 101 may use BPF to acquire packets passing between a predetermined packet flow, such as between a NIC and netfilter, in real time. Furthermore, packet acquisition may be performed continuously during the exposure determination period, but from the perspective of reducing the computational load, the packet acquisition unit 101 may also acquire packets intermittently at predetermined intervals.

[0048] Next, the detection unit 102 refers to flag information indicating the attributes of each of the multiple packets acquired in step SQ102, and determines whether or not any of these packets includes a connection response packet indicating a response for establishing a communication session (step SQ103). If no connection response packet is detected ("No" in step SQ103), the process proceeds to step SQ107, which will be described later. On the other hand, if a connection response packet with the SYN-ACK flag set is detected ("YES" in step SQ103), the determination unit 103 compares the source information and destination information set in the detected connection response packet with predetermined determination conditions, and determines whether or not the server 1 is exposed to an external network (step SQ104). For example, if the detected connection response packet satisfies the determination conditions that the sender indicated by the sender information is an address assigned to server 1 and the destination indicated by the destination information is not in a private IP range ("YES" in step SQ104), the determination unit 103 determines that server 1 is exposed to the external network (step SQ105). On the other hand, if the determination conditions are not met, such as the sender of the detected connection response packet not being the address of server 1 or the destination being in a private IP range, it is determined that no signs of exposure can be detected, and the process proceeds to step SQ107. As described above, by capturing the connection response packet and evaluating the captured connection response packet under predetermined determination conditions, it is possible to efficiently and accurately determine the exposure status of server 1 to the external network.

[0049] In step SQ107, the determination unit 103 compares the results of steps SQ102 to SQ104 with the non-exposure determination criteria for determining whether or not the device is in a non-exposed state, and determines whether or not to continue packet monitoring. For example, when packet capture and exposure determination are performed intermittently as described above, even if a single cumulative determination result does not detect exposure to an external network, this single determination result may not be sufficient to conclude that the device is in a non-exposed state. In such cases, the determination unit 103 may log the results of steps SQ102 to SQ104 and determine whether or not to continue packet monitoring based on whether a predetermined number of determination results indicating that the packet does not contain a connection response packet that satisfies the predetermined determination criteria have been obtained. If packet monitoring is to be continued ("Yes" in step SQ107), the unit 103 executes the packet acquisition process of step SQ102 after a predetermined time has elapsed (step SQ108), and repeats the determination cycle of steps SQ102 to SQ104 until the non-exposure determination criteria are met.

[0050] If the determination result indicates that the connection response packet that satisfies the predetermined determination condition is not included consecutively for a number of times equal to or greater than the threshold value set in the non-exposure determination condition, the determination unit 103 determines that the server 1 is in a non-exposed state, i.e., not exposed to an external network (step SQ109). By performing the exposure determination intermittently as in steps SQ107 to SQ109, it is possible to determine exposure to an external network with high accuracy while reducing the computational load. Note that the determination result of exposure to an external network in the above-mentioned step SQ105 and / or the determination result indicating a non-exposed state in step SQ109 may be notified to the user and / or the program provider by the notification unit 104 (steps SQ106 and SQ110).

[0051] Note that the method for determining exposure to an external network shown in the flowchart of Fig. 6 is merely an example, and the information processing method of this embodiment is not limited to the example of Fig. 6. For example, instead of intermittent monitoring, packets may be captured continuously at all times during a predetermined verification period, and the presence or absence of exposure to an external network may be determined based on whether or not a connection response packet that satisfies a predetermined determination condition is detected during that verification period.

[0052] The above-described embodiments are merely examples for facilitating understanding of the present disclosure and are not intended to limit the present disclosure. The present disclosure may be modified and improved without departing from its spirit, and the present disclosure naturally includes equivalents thereof. For example, in the above-described embodiments, the server 1 is illustrated as an information processing device set up in an on-premises environment. However, the above-described external network exposure determination method and program may also be applied to a server set up in a cloud computing environment. Furthermore, the functions of the processor 10 and storage 12 of the server 1 described in the above embodiments may be realized by different servers connected to each other via a network.

[0053] Furthermore, the method and program for determining external network exposure in this embodiment may be applied not only to the server 1 but also to a server operating in a virtual machine (VM) or container environment, or to a host server that manages them. Furthermore, the present invention may be applied as a program executed by a processor mounted on a network device such as a router, a firewall device, or a load balancer. The target of packet acquisition is not limited to TCP packets, but packets corresponding to other protocols may also be targeted. Exposure determination may be performed based on a filter condition using a specific port number or protocol type instead of detecting a connection response packet. Furthermore, the destination of notification sent by the notification unit 104 is not limited to the user or the provider, but may be linked to another management service or security management system designated by the user.

[0054] Furthermore, the effects described herein are merely descriptive or exemplary and are not limiting. In other words, the technology according to the present disclosure may achieve other effects that are apparent to those skilled in the art from the description of this specification, in addition to or in place of the above-described effects.

[0055] The server, information processing method, and program of the present disclosure may have the following configuration. [Item 1] A server having a storage unit that records a program and a processor that executes the program, The processor executes the program, a packet acquisition unit that acquires a plurality of packets processed by the server; a detection unit that detects a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag that indicates a packet attribute set in each packet; A server that functions as a determination unit that determines whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet. [Item 2] The server according to item 1, wherein the determination unit determines that the server is exposed to an external network if the source indicated by the source information is an address assigned to the server and the destination indicated by the destination information is not in a private IP range. [Item 3] Item 2. The server according to item 1, wherein the packet acquisition unit intermittently acquires the plurality of packets at predetermined intervals. [Item 4] The server according to item 3, wherein the determination unit determines whether the connection response packet satisfying the predetermined condition is included in the plurality of packets at each predetermined interval, and determines that the server is not exposed to an external network if it determines that the connection response packet satisfying the predetermined condition is not included a predetermined number of times or more. [Item 5] The server according to any one of items 1 to 4, wherein the server is set up in an on-premises environment. [Item 6] An information processing method executed by a server by causing a processor of the server to execute a program stored in a storage unit, obtaining a plurality of packets to be processed by the server; detecting a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag indicating a packet attribute set in each packet; determining whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet; The information processing method is executed by the server. [Item 7] A program installed on a server, The program a packet capture function for capturing a plurality of packets processed by the server; a detection function for detecting a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag indicating a packet attribute set in each packet; a determination function for determining whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet; A program for causing the server to execute the above. [Explanation of symbols]

[0056] 1 server 101 Packet acquisition unit (packet acquisition means) 102 detection unit (detection means) 103 Judgment unit (judgment means)

Claims

1. A server having a storage unit that records a program and a processor that executes the program, The processor executes the program, a packet acquisition unit that acquires a plurality of packets processed by the server; a detection unit that detects a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag that indicates a packet attribute set in each packet; A server that functions as a determination unit that determines whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet.

2. The server according to claim 1, wherein the determination unit determines that the server is exposed to an external network if the source indicated by the source information is an address assigned to the server and the destination indicated by the destination information is not in a private IP range.

3. The server according to claim 1 , wherein the packet acquisition unit intermittently acquires the plurality of packets at predetermined intervals.

4. 4. The server according to claim 3, wherein the determination unit determines whether the plurality of packets includes a connection response packet that satisfies a predetermined condition at each predetermined interval, and determines that the server is not exposed to an external network if it determines that the plurality of packets does not include a connection response packet that satisfies the predetermined condition a predetermined number of times or more.

5. The server according to any one of claims 1 to 4, wherein the server is set up in an on-premise environment.

6. An information processing method executed by a server by causing a processor of the server to execute a program stored in a storage unit, obtaining a plurality of packets to be processed by the server; detecting a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag indicating a packet attribute set in each packet; determining whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet; The information processing method is executed by the server.

7. A program installed on a server, The program a packet capture function for capturing a plurality of packets processed by the server; a detection function for detecting a connection response packet indicating a response for establishing a communication session from among the plurality of packets based on a flag indicating a packet attribute set in each packet; a determination function for determining whether the server is exposed to an external network based on source information and destination information set in the detected connection response packet; A program for causing the server to execute the above.

Images