Information processing device and analysis method

Abstract

A client (10) has an analysis control unit (132) and a communication control unit (131). When a predetermined condition is satisfied, the analysis control unit (132) provides, to an analysis device (40) connected to a network, decoding information for performing SSH communication. Before the condition is satisfied, the communication control unit (131) performs SSH communication with a host (20) different from the analysis device (40) connected to the network, and after the condition is satisfied, performs SSH communication with the analysis device (40).

Description

Information processing device and analysis method

[0001] The present invention relates to an information processing device and an analysis method.

[0002] SSH (Secure Shell) is known as an encryption method for ensuring security when performing communication between a host and a client.

[0003] In some cases, corporate communications are monitored to ensure confidentiality and security. However, with SSH, a shared key is generated between the host and client for each session, and mutual authentication is performed, making it difficult for a third party (such as a corporate monitoring device) to intervene and analyze the communications.

[0004] In response to this, a method has been proposed for analyzing and decrypting SSH communications using a proxy (see, for example, Non-Patent Document 1). Non-Patent Document 1 describes a method in which a proxy is inserted between a host and a client, and an SSH session is established between the client and the proxy, and between the proxy and the host, so that the proxy can decrypt and analyze communications.

[0005] “SSH Proxy,” TECHDOCS, paloaltonetworks, [Retrieved February 14, 2024], Internet (https: / / docs.paloaltonetworks.com / pan-os / 11-0 / pan-os-admin / decryption / decryption-concepts / ssh-proxy)

[0006] However, conventional techniques may not be able to efficiently analyze communications.

[0007] For example, the technology described in Non-Patent Document 1 has a problem in that the processing load increases and delays are likely to occur, especially when the number of sessions increases, due to the need to terminate SSH at the proxy. Furthermore, the technology described in Non-Patent Document 1 has a problem in that a large amount of information (certificates, etc.) must be stored at the proxy, and when associating information between the host and client, management becomes complicated. Furthermore, the technology described in Non-Patent Document 1 has a problem in that direct authentication between the host and client cannot be performed, making it vulnerable to man-in-the-middle (MitM) attacks. A man-in-the-middle attack is an attack in which an attacker interrupts communication between two parties, steals encryption keys, etc., and eavesdrops and falsifies data.

[0008] In order to solve the above-mentioned problems and achieve the objectives, the information processing device is characterized by having an analysis control unit that provides decryption information for performing SSH communication to an analysis device connected to a network when predetermined conditions are met, and a communication control unit that performs SSH communication between the analysis device connected to the network and a target device different from the analysis device before the conditions are met, and performs SSH communication with the analysis device when the conditions are met.

[0009] According to the present invention, communication analysis can be performed efficiently.

[0010] FIG. 1 is a diagram illustrating the configuration and operation of an analysis system according to a first embodiment. FIG. 2 is a diagram illustrating the configuration and operation of an analysis system according to the first embodiment. FIG. 3 is a diagram illustrating an example configuration of a client according to the first embodiment. FIG. 4 is a diagram illustrating an example configuration of an analysis device according to the first embodiment. FIG. 5 is a diagram illustrating the processing flow of the analysis system according to the first embodiment. FIG. 6 is a flowchart illustrating the processing flow of a client according to the first embodiment. FIG. 7 is a flowchart illustrating the processing flow of the analysis device according to the first embodiment. FIG. 8 is a diagram illustrating the processing flow of an analysis system according to a second embodiment. FIG. 9 is a diagram illustrating the configuration and operation of an analysis system according to a third embodiment. FIG. 10 is a diagram illustrating the configuration and operation of an analysis system according to the third embodiment. FIG. 11 is a diagram illustrating an example of a computer that executes an analysis program.

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an information processing apparatus and an analysis method according to embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described below.

[0012] First, the configuration of the analysis system according to the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating the configuration and operation of the analysis system according to the first embodiment.

[0013] 1, the analysis system 1 includes a client 10, a host 20, a firewall 30, an analysis device 40, and a network device 50. The client 10 and the host 20 are information processing devices (e.g., mobile terminals, PCs, or server devices) that have SSH termination functions (decryption, encryption, message authentication, etc.). For example, the host 20 can remotely control the client 10 using SSH.

[0014] The FW 30 is a firewall that controls communication between an internal network (network) of an organization (for example, an internal company network) and an external network. The network device 50 is a device (for example, a router) having a function related to communication.

[0015] As shown in FIG. 1, the client 10 performs SSH communication with the host 20 without going through the analysis device 40 .

[0016] Here, the client 10 has a function of activating a trigger to start the execution of the analysis, that is, the client 10 causes the analysis system 1 to start analyzing the communication when a condition is met.

[0017] For example, the condition for starting the analysis of communication is that a command instructing the start of the analysis has been received from the host 20, that TCP communication with a specific destination has been detected by the FW 30, that the usage status of the NWCTR (Network Controller) that controls the network has reached a specific status, etc. The condition may also be that the SCP (Secure Copy Protocol) has been executed.

[0018] When the trigger is activated (when the conditions are satisfied), the client 10 performs SSH communication with the host 20 via the analysis device 40, as shown in Fig. 2. Fig. 2 is a diagram illustrating the configuration and operation of the analysis system according to the first embodiment.

[0019] This allows the analysis device 40 to analyze the communication between the client 10 and the host 20 .

[0020] 2 indicates that SSH communication is not performed directly between the client 10 and the host 20.

[0021] In this case, the analysis device 40 only needs to perform the SSH communication termination function for the session currently being executed between the client 10 and the host 20, so the processing load is not extremely large. Furthermore, the analysis device 40 does not need to manage authentication information, and direct authentication can be performed between the client 10 and the host 20. As a result, this embodiment solves the problems of the prior art. Note that a method for realizing communication in the form shown in FIG. 2 will be described later.

[0022] The configuration of the client 10 will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the configuration of a client according to the first embodiment. As shown in Fig. 3, the client 10 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0023] The communication unit 11 is an interface for performing data communication with other devices via a network, and is, for example, a network interface card (NIC).

[0024] The storage unit 12 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. Note that the storage unit 12 may also be a data-rewritable semiconductor memory such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM). The storage unit 12 stores an operating system (OS) and various programs executed by the client 10.

[0025] The storage unit 12 stores a condition list 121. The condition list 121 is a list of conditions for starting an analysis.

[0026] The control unit 13 controls the entire client 10. The control unit 13 is, for example, an electronic circuit such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), or GPU (Graphics Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). The control unit 13 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory.

[0027] The control unit 13 also functions as various processing units by running various programs. For example, the control unit 13 includes a communication control unit 131 and an analysis control unit 132.

[0028] The communication control unit 131 controls communication with other devices. For example, in the case of Fig. 1, the communication control unit 131 performs SSH communication with the host 20. Also, for example, in the case of Fig. 2, the communication control unit 131 performs SSH communication with the analysis device 40. In this way, before the condition is satisfied, the communication control unit 131 performs SSH communication with the target device (host 20) different from the analysis device 40 connected to the network, and when the condition is satisfied, performs SSH communication with the analysis device 40.

[0029] The analysis control unit 132 determines whether the conditions included in the condition list 121 are satisfied, and if it determines that the conditions are satisfied, it causes the analysis system 1 to start analyzing the communication. For example, the analysis control unit 132 may notify the analysis device 40 of the start of the analysis, or may provide necessary information to the analysis device 40. If predetermined conditions are satisfied, the analysis control unit 132 provides decryption information for performing SSH communication to the analysis device 40 connected to the network. This enables the analysis device 40 to perform SSH communication between the client 10 and the host 20.

[0030] The configuration of the analysis device 40 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the configuration of the analysis device according to the first embodiment. As shown in Fig. 4, the analysis device 40 includes a communication unit 41, a storage unit 42, and a control unit 43.

[0031] The communication unit 41 is an interface for performing data communication with other devices via a network, and is, for example, a NIC.

[0032] The storage unit 42 is a storage device such as an HDD, SSD, optical disk, etc. The storage unit 42 may also be a data-rewritable semiconductor memory such as RAM, flash memory, NVSRAM, etc. The storage unit 42 stores the OS and various programs executed by the client 10.

[0033] The control unit 43 controls the entire client 10. The control unit 43 is, for example, an electronic circuit such as a CPU, MPU, or GPU, or an integrated circuit such as an ASIC or FPGA. The control unit 43 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory.

[0034] The control unit 43 also functions as various processing units by running various programs. For example, the control unit 43 includes a communication control unit 431 and an analysis unit 432.

[0035] The communication control unit 431 controls communication with other devices. For example, in the case of FIG. 2, the communication control unit 431 performs SSH communication between the client 10 and the host 20.

[0036] The analysis unit 432 analyzes communications between the client 10 and the host 20. For example, the analysis unit 432 determines whether or not there are any abnormalities by decoding IP packets transmitted and received between the client 10 and the host 20 and then performing pattern matching or the like. The analysis unit 432 also determines whether or not the contents of files transmitted and received between the client 10 and the host 20 are malicious.

[0037] 5 is a diagram illustrating the flow of processing in the analysis system according to the first embodiment. As shown in Fig. 5, before the analysis starts, SSH communication is performed between the client 10 and the host 20 (the state in Fig. 1) (step S11).

[0038] If the communication storage conditions set in advance are met (step S12), that is, if the conditions included in the condition list 121 are satisfied, the client 10 activates a trigger and determines to start analysis (step S13).

[0039] The client 10 provides decryption information for SSH communication to the analysis device 40 (step S14). The analysis device 40 sets a path between the client 10 and the FW 30 (step S15). For example, the decryption information is a private key that is randomly generated for each SSH session.

[0040] Next, the client 10 sets the communication to go through the analysis device 40 (step S16). As a result, the client 10 performs SSH communication with the host 20 via the analysis device 40 (the state in FIG. 2). The analysis device 40 also analyzes the communication (step S17).

[0041] Depending on the content of the analysis, the analysis device 40 may also block communication between the client 10 and the host 20 (step S18). For example, if the analysis device 40 detects that a malicious packet is being sent from the client 10 to the host 20, it will block the communication.

[0042] Thereafter, the client 10 transmits an instruction to cancel the analysis to the analysis device 40 (step S19). Upon receiving the instruction to cancel the analysis, the analysis device 40 cancels the path setting (step S20).

[0043] Thereafter, the settings are returned to normal, and SSH communication is performed between the client 10 and the host 20 (the state in FIG. 1) (step S21).

[0044] The flow of processing by the client 10 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing the flow of processing by the client according to the first embodiment.

[0045] First, the client 10 performs SSH communication with the host 20 (step S101) until a trigger is activated (step S102, No). When the trigger is activated (step S102, Yes), the client 10 provides decryption information to the analysis device 40 (step S103).

[0046] Here, the client 10 sets the SSH communication to go through the analysis device 40 (step S104). Then, the client 10 performs SSH communication with the host 20 via the analysis device 40 (step S105).

[0047] Specifically, in S104, the communication control unit 131 performs NAT (Network Address Translation). The communication control unit 131 rewrites the dst (destination) address included in the header of the packet to be sent from the IP address of the host 20 to the IP address of the analysis device 40. The communication control unit 131 may also control the communication destination by MPLS instead of NA.

[0048] The need to rewrite the dst address is notified to the analysis device 40 in advance. The analysis device 40 can then transfer the packet to the host 20 by further rewriting the dst address.

[0049] If the analysis termination condition is not satisfied (No at step S106), the client 10 continues SSH communication with the host 20 via the analysis device 40 (step S105).

[0050] If the analysis termination condition is satisfied (Yes in step S106), the client 10 sets the SSH communication so that it does not go through the analysis device 40 (step S107). At this time, the client 10 may also send an analysis termination instruction to the analysis device 40.

[0051] The processing flow of the analysis device 40 will be described with reference to Fig. 7. Fig. 7 is a flowchart showing the processing flow of the analysis device according to the first embodiment. First, the analysis device 40 waits (step S401) until decryption information is provided from the client 10 (step S402, No).

[0052] When the analysis device 40 receives decryption information from the client 10 (Yes in step S402), the analysis device 40 sets up a return path between the client 10 and the host 20 (step S403). Then, the analysis device 40 analyzes the communication between the client 10 and the host 20 (step S404).

[0053] Specifically, in step S403, the communication control unit 431 can set a path between the FW 30 and the analysis device 40 by setting up a tunnel or rewriting the src address and dst address. For example, the communication control unit 431 executes NAT, which rewrites the dst address in the header of the packet received from the client 10 to the IP address of the host 20.

[0054] If the communication path between the analysis device 40 and the client 10 has not been lost (step S405, No), the analysis device 40 continues the analysis (step S404). If the communication path between the analysis device 40 and the client 10 has been lost (step S405, Yes), the analysis device 40 ends the process.

[0055] The condition for the analysis device 40 to end the analysis may not be the loss of the communication path with the client 10, but may be the receipt of an explicit instruction to terminate the analysis.

[0056] Second Embodiment In the first embodiment, the case where the client 10 activates the trigger has been described. However, the trigger may be activated by a device other than the client 10. For example, the FW 30 and the NW device 50 may activate the trigger.

[0057] Fig. 8 shows the processing flow when the FW 30 activates a trigger. Fig. 8 is a diagram illustrating the processing flow of the analysis system according to the second embodiment. Here, the differences between Fig. 5 and Fig. 8 will be explained. In this case, it is assumed that the FW 30 stores the condition list 121.

[0058] As shown in FIG. 8, when the communication preservation conditions set in advance are met (step S121a), that is, when the conditions included in the condition list 121 are satisfied, the FW 30 instructs the client 10 to start analysis (step S122a).

[0059] When the client 10 receives the instruction to start the analysis, it determines to start the analysis (step S13a). The subsequent processing is common to both Figs.

[0060] [Third embodiment] The configuration of the network to be analyzed is not limited to that shown in Fig. 1 etc. For example, the analysis method can also be applied to a network closed within an organization as shown in Fig. 9. Fig. 9 is a diagram illustrating the configuration and operation of an analysis system according to a third embodiment.

[0061] For example, even in communications that are closed within a company, unexpected file movements (such as movements from a private segment to a public segment) are expected, so analysis of SSH communications is necessary.

[0062] 10, when performing analysis, the analysis device 40 of the analysis system 1a sets a path between the analysis device 40 and the host 20, not between the analysis device 40 and the FW 30. Fig. 10 is a diagram illustrating the configuration and operation of the analysis system according to the third embodiment.

[0063] [System Configuration, etc.] The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic. The program may be executed not only by the CPU but also by other processors such as a GPU.

[0064] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0065] [Program] In one embodiment, the client 10 can be implemented by installing a program that executes the above-described processing as package software or online software on a desired computer. For example, by having an information processing device execute the above-described analysis program, the information processing device can function as the client 10. The information processing device referred to here includes desktop and notebook personal computers. Other information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0066] 11 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0067] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0068] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the client 10 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the client 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0069] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0070] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0071] 10 Client 11, 41 Communication unit 12, 42 Storage unit 13, 43 Control unit 20 Host 30 FW 40 Analysis device 50 Network device 121 Condition list 131, 431 Communication control unit 132 Analysis control unit 432 Analysis unit

Claims

1. An information processing device comprising: an analysis control unit that provides decryption information for performing SSH communication to an analysis device connected to a network when a predetermined condition is met; and a communication control unit that performs SSH communication between the analysis device connected to the network and a target device different from the analysis device before the condition is met, and performs SSH communication with the analysis device when the condition is met.

2. The information processing device according to claim 1, characterized in that, when the condition is satisfied, the communication control unit rewrites the destination address of a packet sent via SSH communication from the IP address of the target device to the IP address of the analysis device.

3. The information processing device according to claim 1, wherein the analysis control unit provides, as the decryption information, a private key that is randomly generated for each SSH communication session.

4. An analysis method executed by an analysis system having a client, a host, and an analysis device, wherein the client performs SSH communication with the host before a predetermined condition is met, the client provides the analysis device with decryption information for performing SSH communication when the condition is met, and performs SSH communication with the analysis device, and the analysis device performs SSH communication between the client and the host, and analyzes the communication between the client and the host.

Images