Communication control device

Abstract

A communication control device (100) according to the present embodiment comprises a determination unit (121), an instruction unit (122), and a provision unit (123). The determination unit (121) determines whether a specific condition is satisfied. If the determination unit (121) determines that the specific condition is satisfied, the instruction unit (122) instructs that an encrypted packet be captured that is transmitted and received between a host device and a communication device. The provision unit (123) provides information to be used for decrypting the packet for which capture was instructed by the instruction unit (122).

Description

communication control device

[0001] The present invention relates to a communication control device.

[0002] Currently, in large-scale networks such as those operated by carriers, which are composed of a large number of diverse communication devices, it is difficult to configure and manage each device individually, so a management device that performs centralized management is used. For example, the management device encrypts communications with each communication device using SSH (Secure Shell) to ensure security. For encryption of SSH communications, a different private key is generated and used for each session.

[0003] In some cases, when an unexpected error occurs in communication between a management device and a communication device, analysis of raw packets without using an application is required for maintenance purposes. In such cases, the communication is encrypted by SSH before being processed by each device, making it difficult to analyze the communication.

[0004] In this regard, to decrypt SSH communications, it is necessary to obtain a private key generated for each session and information for deriving it (such as a random number for the host / client). Therefore, in analyzing / decrypting SSH communications, a proxy may be inserted between the host and client, and an SSH session may be established between them, allowing the proxy to decrypt / analyze the communications (see, for example, Non-Patent Document 1).

[0005] “SSH Proxy”, [online], [searched on August 14, 2020], Internet <https: / / docs.paloaltonetworks.com / pan-os / 11-0 / pan-os-admin / decryption / decryption-concepts / ssh-proxy>

[0006] However, conventional technologies have room for improvement in analyzing encrypted communication content. For example, conventional proxy methods require SSH termination, which requires decryption and re-encryption during communication, which can cause processing delays. Furthermore, because a proxy is inserted between the host and client, the client cannot authenticate the communication device, increasing security risks. Furthermore, capturing all communications, including communications that do not require decryption other than those being analyzed, puts strain on storage.

[0007] In order to solve the above-mentioned problems and achieve the objectives, the communication control device of the present invention is characterized by having a judgment unit that judges whether or not certain conditions are met, an instruction unit that instructs the capture of encrypted packets sent and received between the device itself and the communication device when the judgment unit judges that the certain conditions are met, and a provision unit that provides information used to decrypt the packets that the instruction unit instructs to be captured.

[0008] According to the present invention, it is possible to easily analyze encrypted communication content.

[0009] FIG. 1 is a diagram showing a communication control system according to an embodiment. FIG. 2 is a diagram showing an example of the configuration of a communication control device according to an embodiment. FIG. 3 is a diagram showing a specific example of communication control processing according to an embodiment. FIG. 4 is a diagram showing a specific example of communication control processing according to an embodiment. FIG. 5 is a diagram showing an example of data stored in the storage of a communication function acquisition unit according to an embodiment. FIG. 6 is a flowchart showing an example of the flow of communication control processing according to an embodiment. FIG. 7 is a diagram showing an example of a computer constituting a communication control device.

[0010] Hereinafter, an embodiment of a communication control device according to the present application will be described in detail with reference to the drawings. However, the communication control device according to the present application is not limited to this embodiment.

[0011] 1. System Configuration Example First, a communication control system including a communication control device 100 according to this embodiment will be described. Fig. 1 is a diagram showing the communication control system according to the embodiment. The communication control system shown in Fig. 1 is configured by the communication control device 100 on the client side, a communication device 200 on the host side, a communication acquisition function unit 300 that captures packets transmitted and received between the communication control device 100 and the communication device 200, and an optical TAP (Terminal Access Point) 400.

[0012] The communication control device 100 is a management device that performs centralized management of multiple communication devices 200, and is implemented by an information processing device such as a PC (Personal Computer). As described above, communication between the communication control device 100 and the communication devices 200 is encrypted using SSH or the like, and a different private key is generated and used for encryption and decryption for each session.

[0013] The communication device 200 is an information processing device that is connected to the communication control device 100 via a wired or wireless connection and transmits and receives information, and is realized by a PC or the like. Like the communication control device 100, the communication device 200 performs encrypted communication by generating and using a different private key for each session for encryption and decryption. Furthermore, the number of communication devices that make up the communication control system can be increased or decreased at the request of an administrator or the like, and each communication device 200 and the communication control device 100 are connected so that they can communicate with each other.

[0014] The communication acquisition function unit 300 is an information processing device having a packet capture function, a storage function, and a linking function, and is realized by a PC, etc. Here, the communication acquisition function unit 300 acquires encrypted packet data between the communication control device 100 and the communication device 200, for example, by the packet capture function.

[0015] Furthermore, the communication acquisition function unit 300 uses, for example, a storage function to associate the encrypted packet data to be analyzed with information such as a private key used to decrypt the packet data and store them. Then, using a linking function, the communication acquisition function unit 300 transmits and receives information to and from the communication control device 100 and executes instructions based on instructions for packet capture and instructions for information to be stored in storage.

[0016] The optical TAP 400 is a device that separates the communication between the communication control device 100 and the communication device 200 and supports packet capture by the communication acquisition function unit 300. Here, the TAP is a device that branches and extracts communication traffic, and by installing it between the communication control device 100 and the communication device 200, it allows the communication acquisition function unit 300 to acquire encrypted packets between the two devices.

[0017] The communication control device 100 determines whether a specific condition is satisfied, and if it is determined that the specific condition is satisfied, instructs the capture of encrypted packets transmitted and received between the communication control device 100 and the communication device 200. Then, the communication control device 100 provides information used to decrypt the packets instructed to be captured.

[0018] For example, the communication control device 100 determines that a specific condition is met when communication with a specific host is detected or an error log is generated regarding communication between the communication control device 100 and the communication device 200. Then, when it is determined that a specific condition is met, for example, the communication control device 100 instructs the communication acquisition function unit 300 to capture packet data encrypted by SSH communication or the like between the communication control device 100 and the communication device 200.

[0019] The communication control device 100 then provides the communication acquisition function unit 300 with information used to decrypt the encrypted packet, such as a private key corresponding to the packet for which capture was instructed, or a random number generated by the communication control device 100 or the communication device 200.

[0020] As a result, when an unexpected malfunction occurs or when a maintenance person requests it, the communication control device 100 can receive an instruction to capture encrypted packet data to be analyzed and information such as a private key required for decryption, and store the two pieces of information in association with each other in the communication acquisition function unit 300. Therefore, the communication control device 100 can easily analyze encrypted communication content without installing a device such as a proxy between the communication control device 100 and the communication device 200.

[0021] 1 shows an example in which the communication control device 100 and the communication acquisition function unit 300 work together as separate devices to associate and store encrypted packets with information used for decryption, but the present invention is not limited to this, and for example, the communication control device 100 may include the communication acquisition function unit 300. In other words, by having the packet capture function and storage function of the communication acquisition function unit 300, the communication control device 100 may perform the above-mentioned series of processes by itself, without installing the communication acquisition function unit 300 as an independent device.

[0022] Furthermore, while FIG. 1 illustrates a case in which an optical TAP 400 is installed between the communication control device 100 and the communication device 200, this is not limited to this. For example, if encrypted packet data between the communication control device 100 and the communication device 200 can be obtained by implementing port mirroring on a switch between the two devices or by using a packet capture tool on the communication control device 100, then there is no need to install an optical TAP 400.

[0023] 2. Configuration of the communication control device 100 Next, the configuration of the communication control device 100 shown in Fig. 1 will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the configuration of a communication control device according to an embodiment. The communication control device 100 has a communication unit 110, a control unit 120, and a storage unit 130.

[0024] The communication control device 100 and the communication device 200 are connected to each other by wire or wirelessly so that they can communicate with each other, and transmit and receive encrypted information by SSH communication, etc. The communication control device 100 and the communication acquisition function unit 300 are also connected to each other so that they can communicate with each other, and the communication control device 100 provides the communication acquisition function unit 300 with instructions for packet capture and information used for decryption.

[0025] The communication unit 110 is realized by, for example, a network interface card (NIC). The communication unit 110 is connected to each of the communication device 200 and the communication acquisition function unit 300 via a wired or wireless connection, and transmits and receives information. The communication unit 110 realizes encrypted communication between the two devices by, for example, encrypting data transmitted from the communication control device 100 to the communication device 200 and decrypting data received from the communication device 200 to the communication control device 100.

[0026] The storage unit 130 is realized by a storage device such as a RAM (Random Access Memory) or a hard disk. The storage unit 130 stores data and programs necessary for various processes by the control unit 120. For example, the storage unit 130 stores information such as identification information and public key information of the communication device 200, session private key information, and random numbers used for encryption. The storage unit 130 also stores information used to determine communication problems, such as error log information and command response times, which are used in the determination process of the determination unit 121, which will be described later.

[0027] The control unit 120 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in a storage device within the device using RAM as a work area. The control unit 120 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 120 has a determination unit 121, an instruction unit 122, and a provision unit 123.

[0028] The determination unit 121 determines whether a specific condition is satisfied. Specifically, the determination unit 121 determines that the specific condition is satisfied when communication with a specific host occurs. For example, the determination unit 121 refers to the information stored in the storage unit 130, and determines that the specific condition is satisfied when the identification information of the communication device 200, which is the host, corresponds to the identification information of a preset malicious host.

[0029] Furthermore, when a communication error occurs, the determination unit 121 determines that a specific condition has been satisfied. For example, the determination unit 121 refers to information stored in the storage unit 130 and determines whether a communication error has occurred based on information that may be a trigger for a communication malfunction, such as when a communication error log is acquired, when the time taken for a command response is equal to or exceeds a threshold, or when the time during which communication from the communication device 200 does not arrive is equal to or exceeds a threshold, and when a communication error has occurred, the determination unit 121 determines that a specific condition has been satisfied.

[0030] Furthermore, the determination unit 121 determines that a specific condition is satisfied when an instruction from a maintenance person is received. For example, the determination unit 121 determines that a specific condition is satisfied when an instruction to analyze communications is received from a maintenance person who manages the communication control system.

[0031] When the determination unit 121 determines that a specific condition is satisfied, the instruction unit 122 instructs the communication acquisition function unit 300 to capture encrypted packets transmitted and received between the communication control device 100 and the communication device 200. For example, when the determination unit 121 notifies the instruction unit 122 that a specific condition is satisfied, the instruction unit 122 instructs the communication acquisition function unit 300 to capture encrypted packets transmitted and received between the communication control device 100 and the communication device 200.

[0032] Here, the packet capture of the communication acquisition function unit 300 may capture encrypted packet data and store it in storage only when instructed to do so by the instruction unit 122, or may always capture encrypted packet data and store the captured packet data in storage only when instructed to do so by the instruction unit 122.

[0033] In addition, if the communication acquisition function unit 300 constantly captures packet data, it can delete packet data that is not stored in storage after a certain period of time has passed, such as after the SSH session ends or after several days.

[0034] The providing unit 123 provides information used to decrypt packets instructed to be captured by the instruction unit 122. For example, the providing unit 123 provides the communication acquisition function unit 300 with information such as a private key and a random number corresponding to the session of encrypted packet data instructed to be captured by the instruction unit 122.

[0035] The communication acquisition function unit 300 then associates the encrypted packet data that has been instructed to be captured (stored) with the private key and other information corresponding to the packet data and stores them in storage. This allows an administrator to easily decrypt the packet data to be analyzed from the stored information, making it easy to analyze the encrypted communication content.

[0036] 3. Specific Example of Communication Control Processing Now, a specific example of communication control processing by the communication control device 100 will be described with reference to Fig. 3 and Fig. 4. Fig. 3 and Fig. 4 are diagrams showing a specific example of communication control processing according to an embodiment. Fig. 3 shows an example in which, during an SSH session, it is determined that a specific condition is met due to communication with a specific host or the occurrence of an error log, and a decision is made as to whether or not to store the communication. In contrast, Fig. 4 shows an example in which, when instructed by a maintenance person or the like, it is determined that a specific condition is met, and an instruction is given to capture packets and store the communication.

[0037] First, the example in Fig. 3 will be described. The communication acquisition function unit 300 captures encrypted packet data between the communication control device 100 and the communication device 200 before the start of the SSH communication to be analyzed, and stores the packet data for each capture session. Then, the determination unit 121 of the communication control device 100 determines whether the communication between the two devices meets pre-set communication storage conditions (specific conditions), such as communication with a specific host or the occurrence of an error log.

[0038] When the determination unit 121 determines that the communication storage conditions are met, the instruction unit 122 instructs the packet capture of the communication acquisition function unit 300 to store the captured packet data. Furthermore, at the same time as the above instruction, the provision unit 123 provides the communication acquisition function unit 300 with decryption information such as a private key required to decrypt the packet data instructed to be stored. Then, the communication acquisition function unit 300 associates the packet data instructed to be stored with the corresponding decryption information and stores them in storage, and then sends a reception response to the communication control device 100.

[0039] As a result, encrypted packet data to be analyzed that meets the communication storage conditions and the decryption information for decrypting it are linked and stored in the storage of the communication acquisition function unit 300, so that a maintenance person or the like can retrieve the stored information at any time, decrypt it, and analyze the packet data. Note that the communication acquisition function unit 300 deletes packet data that has not been instructed to be stored after a certain period of time has passed.

[0040] Next, an example will be described with reference to Fig. 4. In the example of Fig. 4, the same processing as in the example of Fig. 3 described above is performed, but it differs in that the packet capture function of the communication acquisition function unit 300 is activated by an instruction from a maintenance person or the like, and encrypted packet data is captured.

[0041] When the determination unit 121 of the communication control device 100 determines that a specific condition is met upon receiving instructions from a maintenance person or the like, the instruction unit 122 instructs the communication acquisition function unit 300 to capture packet data and save the captured data.

[0042] As a result, in the example shown in FIG. 4, the timing for capturing and saving packet data is determined according to the wishes of the maintenance person or the like, so that reproducible analysis of SSH communications can be performed.

[0043] Next, with reference to Fig. 5, information stored in the storage of the communication acquisition function unit 300 after the above-described processes are performed will be described. Fig. 5 is a diagram illustrating an example of data stored in the storage of the communication function acquisition unit according to the embodiment.

[0044] 5, data corresponding to the items of "communication content (raw packets)," "decryption information," and "defect details" are stored in the storage. Here, "communication content (raw packets)" refers to encrypted packet data captured by packet capture, and stores packet data instructed to be stored by the instruction unit 122. Furthermore, "decryption information" stores information used for decryption, such as a private key corresponding to the "communication content (raw packets)."

[0045] The "failure content" field stores the content of the communication failure, such as "error log occurrence" or "abnormal command response time," when the judgment unit 121 detects information that may be the trigger for a communication failure, such as the occurrence of an error log or command response time, and determines that a specific condition is met.

[0046] Through a series of processes performed by the communication control device 100 and the communication acquisition function unit 300 described above, the data shown in Figure 5 is stored in storage, allowing maintenance personnel and others to easily analyze the encrypted communication data.

[0047] 4. Example of communication control processing Next, the communication control processing by the communication control device 100 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of the flow of the communication control processing according to the embodiment. The example of Fig. 6 shows, as an example, an example in which it is determined that a specific condition is satisfied when communication with a specific host has occurred.

[0048] First, the determination unit 121 of the communication control device 100 determines whether communication has occurred between the communication control device 100 and a specific host (communication device 200), thereby determining whether a specific condition has been met (S101).

[0049] Then, when the determination unit 121 determines that a specific condition is satisfied (S101; Yes), the instruction unit 122 instructs the capture of encrypted packets transmitted and received between the communication control device 100 itself (the communication control device 100) and the communication device 200 (S102). On the other hand, when the determination unit 121 determines that communication with a specific host has not occurred (S101; No), the communication control device 100 waits until it determines that communication with a specific host has occurred.

[0050] Thereafter, the providing unit 123 provides decryption information such as a private key used to decrypt the encrypted packet instructed to be captured by the instructing unit 122 (S103), and the process ends in the communication control device 100. Note that the communication control device 100 repeats the above-described series of processes every time communication with a specific host occurs.

[0051] 5. Effects of the embodiment As described above, the communication control device 100 according to the present embodiment includes a determination unit 121, an instruction unit 122, and a provision unit 123. The determination unit 121 determines whether a specific condition is met. When the determination unit 121 determines that the specific condition is met, the instruction unit 122 instructs the communication control device 100 to capture encrypted packets transmitted and received between the communication control device 100 itself and the communication device 200. The provision unit 123 provides information used to decrypt packets instructed to be captured by the instruction unit 122.

[0052] As a result, when certain conditions are met, the communication control device 100 can associate packet data of encrypted communication performed between the communication control device 100 on the client side and the communication device 200 on the host side with information for decrypting the data and store the associated data. Thus, the communication control device 100 allows a maintenance person or the like to easily analyze the encrypted communication content.

[0053] Furthermore, by limiting the acquisition of packet data and decryption information to cases where specific conditions are met, the communication control device 100 can reduce storage load compared to when all communications are saved. Furthermore, because the communication control device 100 does not use a device such as a proxy as in conventional technology, it can reduce the impact of processing delays and security risks.

[0054] Furthermore, when communication with a specific host occurs, the determination unit 121 of the communication control device 100 determines that a specific condition has been satisfied. As a result, when communication with a preset malicious host occurs, the communication control device 100 associates the packet data of the communication with the decryption information and stores the associated data, thereby making it possible to easily analyze the content of the communication with the malicious host, which may cause a malfunction.

[0055] Furthermore, when a communication error occurs, the determination unit 121 of the communication control device 100 determines that a specific condition has been satisfied. As a result, when the communication control device 100 detects information such as an error log regarding communication between the communication control device 100 and the communication device 200, the communication control device 100 associates the packet data of the communication that is the subject of the error log with the decoding information and stores them, thereby making it possible to easily analyze the communication in which the error occurred.

[0056] Furthermore, when an instruction from a maintenance person is received, the determination unit 121 of the communication control device 100 determines that a specific condition has been satisfied. As a result, when the maintenance person instructs the communication control device 100 to acquire and store packet data, the communication control device 100 performs the process, thereby making it possible to easily analyze communication data at the timing desired by the maintenance person.

[0057] [6. System Configuration, etc.] Of the processes described in the above embodiments, some of the processes described as being performed automatically can also be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0058] Furthermore, the components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0059] 2 may be stored in a storage server or the like, rather than being stored in the communication control device 100. In this case, the communication control device 100 acquires various pieces of information by accessing the storage server.

[0060] 7. Hardware Configuration Fig. 7 is a diagram showing an example of a hardware configuration. The communication control device 100 according to the embodiment described above is realized by a computer 1000 having a configuration as shown in Fig. 7, for example.

[0061] 7 is a diagram showing an example of a computer that executes a communication control program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0062] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0063] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process of the communication control device 100 are implemented as program modules 1093 in which code that can be executed by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the communication control device 100 are stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0064] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0065] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may instead be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0066] REFERENCE SIGNS LIST 100 Communication control device 110 Communication unit 120 Control unit 121 Determination unit 122 Instruction unit 123 Provision unit 130 Storage unit 200 Communication device 300 Communication acquisition function unit 400 Optical TAP

Claims

1. A communications control device comprising: a judgment unit that judges whether or not a specific condition is met; an instruction unit that instructs the capture of encrypted packets transmitted and received between the device itself and a communications device when the judgment unit judges that the specific condition is met; and a provision unit that provides information used to decrypt the packets that have been instructed to be captured by the instruction unit.

2. A communication control device according to claim 1, characterized in that said determination unit determines that said specific condition is satisfied when communication with a specific host occurs.

3. The communication control device according to claim 1, wherein said determination unit determines that said specific condition is satisfied if a communication error occurs.

4. The communication control device according to claim 1, characterized in that the determination unit determines that the specific condition is satisfied when an instruction from a maintenance person is received.

Images