Filtering device and filtering method

Abstract

An L2 switch (30) has: a recording unit (322) that records first collation data included in a main signal transmitted from a random number remote TP (20R); and a comparison unit (321) that discards an OSC signal received from the random number remote TP (20R) when the first collation data recorded in the recording unit (322) does not coincide with second collation data included in the received OSC signal. When the first collation data coincide with the second collation data, the comparison unit (321) allows the received OSC signal to pass and successfully authenticates the random number remote TP (20R) which has transmitted the OSC signal.

Description

Filtering device and filtering method

[0001] The present invention relates to a filtering device and a filtering method.

[0002] In user networks, security is generally ensured by filtering communications from malicious terminals using a filtering function that determines whether or not to allow incoming signals from the outside. Non-Patent Document 1 describes MAC (Media Access Control address) address filtering using a port security function provided in L2 switches. MAC address filtering involves the port of an L2 switch learning in advance the MAC addresses that are allowed to access the port, and filtering signals from unlearned MAC addresses.

[0003] On the other hand, Non-Patent Document 2 describes a standard called IEEE802.1X as a protocol for performing access control by performing user authentication on a terminal basis, rather than on a signal basis.

[0004] Cisco Systems, Inc., "Port Security," [online], [Retrieved August 9, 2024], Internet <URL: https: / / www.cisco.com / c / ja_jp / td / docs / switches / lan / catalyst9300 / software / release / 17-2 / configuration_guide / sec / b_172_sec_9300_cg / configuring_port_security.pdf> IEEE 802.1 Working Group, "IEEE802.1X Port-Based Network Access Control," [online], [Retrieved August 9, 2024], Internet <URL: https: / / 1.ieee802.org / security / 802-1x / >

[0005] In conventional security technologies such as those described in Non-Patent Documents 1 and 2, even for legitimate terminals, the burden of preparations to prepare for cases in which a new terminal that has been replaced attempts to access from the outside is large.

[0006] FIG. 7 is a configuration diagram of an authentication system to which IEEE 802.1X, as described in Non-Patent Document 2, is applied. In this authentication system, an authenticator L2 switch 30 relays an authentication request from a remote TP (Transponder) 20 used by a supplicant (client) to an authentication server 70, which then performs user authentication. When the L2 switch 30 receives an Optical Supervisory Channel (OSC) signal transmitted from the authenticated remote TP 20 via an Extensible Authentication Protocol (EAP) module (OSC-MD) 31, the L2 switch 30 passes the signal from an MD 39 for a Data Communication Network (DCN) to a DCN router 61. The OSC signal (monitor control signal) is a management signal used to monitor and control optical signal communications and is an important signal that should be filtered more strictly than ordinary data signals. A DCN is a network for data communications, such as the Internet or an in-house network.

[0007] The authentication server 70 can perform the client authentication of the remote TP 20 in one of two ways, depending on the type of EAP: An authentication method that uses a digital certificate, such as EAP-TLS (Transport Layer Security). An authentication method that uses a username / password, such as EAP-TTLS (Tunneled Transport Layer Security), EAP-PEAP (Protected Extensible Authentication Protocol), or EAP-FAST (Flexible Authentication via Secure Tunneling).

[0008] 7 is costly due to the following issues: A RADIUS (Remote Authentication Dial-In User Service) server must be installed as the authentication server 70 that implements IEEE802.1X. User names / passwords and digital certificates must be managed.

[0009] 8 is a configuration diagram of an optical transmission system 100z to which the port security function of Non-Patent Document 1 is applied. The optical transmission system 100z is an optical network in which a WDM (Wavelength Division Multiplexing) coupler 51 on the user site side and a WDM coupler 53 on the subscriber building side are connected by an optical fiber 52. The user site side includes a user terminal 10, a remote TP 20, and the WDM coupler 51. The subscriber building side includes an L2 switch 30, a ROADM (reconfigurable optical add / drop multiplexer) 40, a DCN router 61, a DCN 62, and the WDM coupler 53.

[0010] The following signals, each with a different type of arrow, flow through the optical transmission system 100z. The OSC signal (optical signal), indicated by the thick solid arrow, is transmitted from the OSC-MD 22 of the remote TP 20 and passes through the WDM coupler 51, optical fiber 52, WDM coupler 53, the OSC-MD 31 of the L2 switch 30, the SFP (Small Form-factor Pluggable) 32, and the SFP 33, in that order. The SFPs 32 and 33 are optical modules that convert electrical signals to and from optical signals. The OSC signal (electrical signal), indicated by the thick dashed arrow, is an OSC signal (optical signal) converted into an electrical signal, and passes through the OSC-MD 31 of the L2 switch 30, the SFP 32, the SFP 33, the DCN router 61, and the DCN 62, in that order. The main signal (optical signal) indicated by the thin solid arrow is a signal used for data communication, and when transmitted from the remote TP 20, it passes through the WDM coupler 51, the optical fiber 52, another WDM coupler 53, and the ROADM 40 in this order.

[0011] Here, each port of the L2 switch 30 (OSC-MD31, SFP32, SFP33) learns MAC addresses using the port security function. The number of MAC addresses to be learned can be set by an administrator or other user. Each port of the L2 switch 30 then performs MAC address filtering so that previously learned MAC addresses pass through and unlearned MAC addresses are discarded. Note that the connection with the OSC-MD31 on the user site side may be disconnected (link down), causing the learned MAC address content within the OSC-MD31 to be lost. Even in this case, because the SFP32 and SFP33 are directly connected, the connection remains intact (link up), and the learned MAC address content within the SFP32 and SFP33 is not lost.

[0012] 9 is a configuration diagram of an optical transmission system 100z in which a malicious PC 20B is connected instead of the remote TP 20. The control and monitoring system enclosed by the dashed rectangle in FIG. 9 is the range through which the OSC signal propagates. As shown in FIG. 8, the remote TP 20 transmits a main signal (optical signal) to the ROADM 40 and the opposing ROADM 50, and transmits an OSC signal to the DCN router 61 via the L2 switch 30 and the DCN-directed MD 39.

[0013] Now, consider the case where an attacker removes the remote TP 20 connected to the OSC-MD 31 (dashed arrow) and connects a malicious PC 20B instead (solid arrow). Like the remote TP 20, the malicious PC 20B attempts to send an OSC signal to the DCN router 61 via the L2 switch 30 and the DCN-directed MD 39. Then, each port of the OSC-MD 31 forgets the learned MAC addresses due to link down or power off. Therefore, the ports of the OSC-MD 31 allow the OSC signal from the malicious PC 20B to pass through.

[0014] However, SFP32 and SFP33, which are connected downstream of OSC-MD31, maintain link-up by being connected to each other and continue to store the learned MAC addresses. Therefore, SFP32 and SFP33 can appropriately block OSC signals from malicious PC 20B by filtering the learned MAC addresses (in the figure, this is indicated by an x ​​on the link connecting SFP32 and SFP33).

[0015] FIG. 10 is a configuration diagram of an optical transmission system 100z in which an alternative TP 20G is connected in place of the remote TP 20. Note that FIG. 10 illustrates only the control and monitoring system enclosed by the dashed-line rectangle, and the area through which the main signal propagates is omitted. FIGS. 9 and 10 have in common the fact that the remote TP 20 is replaced with another device, and that this replacement results in a link down of the OSC-MD 31. Meanwhile, FIG. 10 differs from FIG. 9 in that the device replacing the remote TP 20 is an alternative TP 20G provided by a legitimate user. Simply replacing the remote TP 20 with the alternative TP 20G would unintentionally block the OSC signal from the alternative TP 20G at SFP 32 and SFP 33, which maintain a link up (shown as an x ​​on the link connecting SFP 32 and SFP 33).

[0016] Therefore, when providing optical fiber services via E2E (End to End), the maintenance person at the subscriber building does not have the L2 switch 30 learn the MAC address of the malicious PC 20B, but has the L2 switch 30 learn the MAC address of the alternative TP 20G. This allows the OSC signal from the alternative TP 20G to pass through and blocks the OSC signal from the malicious PC 20B. Therefore, the maintenance person at the subscriber building must re-learn the MAC address of the alternative TP 20G as a trusted address in the SFP 32 and SFP 33 (separate from the MAC address of the remote TP 20), which is a time-consuming operation. While there is a method for automatically linking up by periodically forgetting the MAC address in the L2 switch 30, this method would allow the malicious PC 20B to connect after a certain period of time has passed, posing a security concern.

[0017] Therefore, a main object of the present invention is to enable filtering on the receiving side to function with a low burden even when the transmitting device is replaced.

[0018] In order to solve the above problems, the filtering device of the present invention comprises the following means: a recording unit that records first matching data included in a main signal transmitted from a transmitting-side device, and a comparing unit that discards the received monitoring and control signal when the first matching data recorded in the recording unit does not match second matching data included in the monitoring and control signal received from the transmitting-side device.

[0019] According to the present invention, even if the device on the sending side is replaced, filtering can be performed on the receiving side with a low burden.

[0020] FIG. 1 is a schematic diagram of an optical transmission system according to the present embodiment. FIG. 2 is a configuration diagram of an optical transmission system according to the present embodiment. FIG. 3 is a detailed configuration diagram of an optical transmission system according to the present embodiment. FIG. 4 is a flowchart showing the operation of the optical transmission system according to the present embodiment. FIG. 5 is a table explanatory diagram showing an example of random value values ​​according to the present embodiment. FIG. 6 is a hardware configuration diagram of each device in the optical transmission system according to the present embodiment. FIG. 7 is a configuration diagram of an authentication system to which IEEE802.1X of Non-Patent Document 2 is applied. FIG. 8 is a configuration diagram of an optical transmission system to which the port security function of Non-Patent Document 1 is applied. FIG. 9 is a configuration diagram of an optical transmission system when a malicious PC is connected instead of a remote TP. FIG. 10 is a configuration diagram of an optical transmission system when an alternative TP is connected instead of a remote TP.

[0021] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0022] 1 is a schematic diagram of an optical transmission system 100. The optical transmission system 100 connects a user site and a subscriber building via an optical fiber network, through which an OSC signal (monitor control signal) and a main signal pass. The user site includes a user terminal 10 and a random number remote TP (transmitting device) 20R. The subscriber building includes an L2 switch (filtering device) 30, an OH acquisition unit 341, a DCN router 61, and a DCN 62.

[0023] The random number remote TP20R is different from the remote TP20 of FIG. 8 in that a random number generation unit 21 is added. The random number generation unit 21 generates a random number value as authentication data. The random number remote TP20R then adds a random number value to the OSC signal transmitted via the OSC-MD22, and also adds the same random number value to the main signal transmitted from the random number remote TP20R. The OH acquisition unit 341 reads the overhead (OH), which is the header of the main signal transmitted from the random number remote TP20R, and notifies the L2 switch 30 of the overhead (main signal OH). The main signal OH includes a random number value. The OH acquisition unit 341 may be provided as an internal module of the L2 switch 30, or may be provided in a device separate from the L2 switch 30.

[0024] The comparator 321 of the L2 switch 30 then compares the random number value in the OSC signal received from the random number remote TP 20R with the random number value in the main signal OH received from the OH acquisition unit 341. If the two random number values ​​match, the authentication of the random number remote TP 20R as the alternative TP 20G (FIG. 10) is successful, and communication between the L2 switch 30 and the DCN router 61 is established. As a result, the OSC signal is transferred from the L2 switch 30 to the DCN 62 via the DCN router 61.

[0025] If both random numbers match, the L2 switch 30 may perform one of the following processes: - As a filtering process for each signal, if both random numbers match, the L2 switch 30 passes the OSC signal, and if both random numbers do not match, blocks the OSC signal. If another OSC signal is subsequently received from the same random number remote TP20R, the L2 switch 30 again determines whether the two random numbers match the random number value in the main signal OH. - As an authentication process for each device, if both random numbers match, the authentication is successful for the random number remote TP20R (device). As a result, the L2 switch 30 passes the signal (OSC signal or main signal) from the successfully authenticated random number remote TP20R. Therefore, the L2 switch 30 may store the identification information (such as a MAC address) of the successfully authenticated random number remote TP20R, and use the identification information in the signal instead of the random number value in the signal for subsequent signal determinations.

[0026] On the other hand, if the two random number values ​​do not match, the compared OSC signal is discarded, thereby making it possible to appropriately filter out unauthorized signals from a malicious PC 20B (FIG. 9) that does not have a random number generation unit 21. Note that even if the OSC signal is discarded, the main signal can still be transmitted, but the malicious PC 20B will not be able to use the unauthorized OSC signal to perform unauthorized monitoring and control of the OPS (Operation System) located beyond the DCN 62.

[0027] The L2 switch 30 of the optical transmission system 100 described above with reference to FIG. 1 has the following features. The L2 switch 30 has a recording unit 322 ( FIG. 3 ) that records first verification data (first random number value) included in the main signal transmitted from the random number remote TP 20R. The L2 switch 30 has a comparison unit 321 that discards the received OSC signal if the first verification data recorded in the recording unit 322 does not match the second verification data (second random number value) included in the OSC signal received from the random number remote TP 20R. If the first verification data and the second verification data match, the comparison unit 321 passes the received OSC signal and successfully authenticates the random number remote TP 20R that transmitted the OSC signal.

[0028] This L2 switch 30 provides the following maintenance load reduction effects: - Authentication can be performed automatically between the random number remote TP 20R and the L2 switch 30 based on a random number value. This eliminates the need to build an authentication server 70 (FIG. 7) or manage user names / passwords and digital certificates, which were necessary for IEEE802.1x authentication as in Non-Patent Document 2, improving maintainability. - Even when the remote TP 20 (FIG. 9) is replaced with the random number remote TP 20R, which is the alternative TP 20G (FIG. 9), the manual recovery operation required in the conventional method of learning MAC addresses as in Non-Patent Document 1 is no longer necessary.

[0029] FIG. 2 is a configuration diagram of an optical transmission system 100. The main differences between the optical transmission system 100 of FIG. 2 and the optical transmission system 100z of FIG. 8 are as follows: [First Difference] In the optical transmission system 100 of FIG. 2, the remote TP 20 of the optical transmission system 100z is replaced with the random number remote TP 20R described in FIG. 1. [Second Difference] In the optical transmission system 100 of FIG. 2, the main signal (optical signal) shown by the thin solid arrow passes through a newly added coupler 35. This coupler 35 is a WDM coupler (splitter) that branches the main signal (optical signal) and distributes it not only to the ROADM 40 but also to the main signal termination MD 34 newly added to the L2 switch 30.

[0030] [Third Difference] The SFP 32 of the optical transmission system 100 is replaced with a comparison MD 32C in the optical transmission system 100 of Fig. 2. The comparison MD 32C has the comparison unit 321 of Fig. 1, and the comparison unit 321 compares the random number value in the OSC signal (electrical signal) notified from the OSC-MD 31 with the random number value in the main signal (electrical signal) notified from the main signal termination MD 34. Therefore, the OSC-MD 31 and the main signal termination MD 34 convert the received optical signal into an electrical signal before transferring it to the comparison MD 32C.

[0031] 3 is a detailed configuration diagram of the optical transmission system 100. In addition to the random number generator 21 described in FIG. 1, the random number remote TP 20R includes an OSC signal generator 23, a main signal OH generator 24, and transponders (Tx 25, Rx 26) for connecting to the subscriber building. The OSC signal generator 23 generates an OSC signal including the random number value generated by the random number generator 21 and transmits the OSC signal from the OSC-MD 22 to the OSC-MD 31. The main signal OH generator 24 generates a main signal OH including the random number value generated by the random number generator 21 and transmits the main signal including the main signal OH from the Tx 25 to the coupler 35.

[0032] 2, the comparison MD 32C, the SFP 33, and the main signal termination MD 34 having the OH acquisition unit 341 of FIG. 1, as well as a DCN-oriented MD 39 for connecting to the DCN router 61. The comparison MD 32C has, in addition to the comparison unit 321 of FIG. 1, a recording unit 322 for recording data (random number values ​​of the OSC signal and the main signal) used in the comparison process of the comparison unit 321. The ROADM 40 has transponders (Rx, TX) for connecting to the user site side and the opposing ROADM 50 side, as well as an MCS (Multicast Switch) and an ROADM on a Blade (ROB).

[0033] To improve security, the random number values ​​generated by the random number generator 21 may be changed every time an OSC packet is transmitted or every predetermined time (e.g., one day). In this case, the OSC signal generator 23 and the main signal OH generator 24 set the random number values ​​included in the OSC signal and the main signal transmitted at the same time (simultaneously or close to each other) to the same random number value (e.g., the most recent random number value). The comparison MD 32C then records the random number values ​​included in the OSC signal and the main signal in the recording unit 322. In this case, the comparison MD 32C stores multiple updated random number values ​​by time, and the comparison unit 321 compares random number values ​​that are shortly spaced from each other at the same time (e.g., the most recent).

[0034] 4 is a flowchart showing the operation of the optical transmission system 100. The random number remote TP 20R generates a random number value in the random number generator 21 (S11), writes the generated random number value into the main signal OH and OSC signal (S12), and transmits the main signal OH and OSC signal to the subscriber building (S13). The L2 switch 30 compares the random number values ​​of the main signal OH and OSC signal transmitted in S13 in the comparison MD 32C (S14). If the random numbers match in S14 (Yes in S15), the authentication of the source random number remote TP 20R is successful, and the OSC signal is allowed to pass (S16). If the random numbers do not match in S14 (No in S15), the authentication of the source random number remote TP 20R is failed, and the OSC signal is rejected (S17).

[0035] FIG. 5 is a table illustrating an example of the random number value generated in S11 of FIG. 4. This table lists a single 8-bit random number value, with the upper 3 bits representing a counter area and the lower 5 bits representing a random number area. In this way, the random number remote TP20R stores the same random number value, consisting of a set of a counter area value and a random number area value, in both the main signal OH and the OSC signal. As a result, even if the two signals arrive at the L2 switch 30 at different times, the L2 switch 30 stores both signals in the recording unit 322, and the comparison unit 321 compares random numbers with the same counter area value. Furthermore, the random number generator 21 increments the counter area value by one each time it updates the random number value, resetting it to 0 if the counter area value is at its maximum value.

[0036] 5, the first matching data included in the main signal and the second matching data included in the OSC signal each have a random number domain value and a counter domain value that is incremented each time the random number domain value is updated. If the random number domain values ​​of the first matching data and the second matching data having the same counter domain value do not match, the comparator 321 discards the received OSC signal.

[0037] 6 is a hardware configuration diagram of each device in the optical transmission system 100. Each device in the optical transmission system 100 (user terminal 10, random number remote TP 20R, L2 switch 30, DCN router 61, DCN 62, ROADM 40, and opposing ROADM 50) is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (filtering program) loaded into the RAM 902. This program (also called an application, or simply "app") can be distributed via a communication line or recorded on a recording medium 917 such as a USB memory and distributed.

[0038] [Effect] The L2 switch 30 of the present invention is characterized by having a recording unit 322 that records the first matching data contained in the main signal transmitted from the random number remote TP20R, and a comparison unit 321 that discards the received OSC signal if the first matching data recorded in the recording unit 322 does not match the second matching data contained in the OSC signal received from the random number remote TP20R.

[0039] This eliminates the need for a maintenance person to manually re-learn the MAC address of the replaced new random number remote TP 20R in the L2 switch 30. Therefore, even if the sending device is replaced, filtering on the receiving side can function with low burden.

[0040] The L2 switch 30 of the present invention is characterized in that, when the comparison unit 321 determines that the first matching data and the second matching data match, it passes the received OSC signal and successfully authenticates the random number remote TP20R that sent the OSC signal.

[0041] This allows the L2 switch 30 to ensure the security of the random number remote TP 20R while eliminating the need to install an authentication server or manage digital certificates, which are required for IEEE802.1X authentication.

[0042] The L2 switch 30 of the present invention is characterized in that the first matching data and the second matching data each have a random number area value and a counter area value that is added each time the random number area value is updated, and the comparison unit 321 discards the received OSC signal if the random number area values ​​of the first matching data and the second matching data that have the same counter area value do not match.

[0043] This allows the L2 switch 30 to update the verification data, ensuring the security of the random number remote TP 20R even if old verification data is misused.

[0044] 10 User terminal 20R Random number remote TP (transmitting side device) 21 Random number generator 22 OSC-MD 23 OSC signal generator 24 Main signal OH generator 30 L2 switch (filtering device) 32C Comparison MD 100 Optical transmission system 321 Comparison unit 322 Recording unit

Claims

1. A filtering device characterized by having: a recording unit that records first matching data contained in a main signal transmitted from a transmitting device; and a comparison unit that discards the received monitoring control signal if the first matching data recorded in the recording unit does not match the second matching data contained in the monitoring control signal received from the transmitting device.

2. The filtering device described in claim 1, characterized in that if the first matching data and the second matching data match, the comparison unit passes the received monitoring control signal and successfully authenticates the transmitting device that sent the monitoring control signal.

3. The filtering device described in claim 1, characterized in that the first matching data and the second matching data each have a random number area value and a counter area value that is added each time the random number area value is updated, and the comparison unit discards the received monitoring control signal if the random number area values ​​of the first matching data and the second matching data, which have the same counter area value, do not match.

4. A filtering method comprising: a filtering device having a recording unit and a comparison unit; the recording unit records first matching data contained in a main signal transmitted from a transmitting device; and the comparison unit discards the received monitoring control signal when the first matching data recorded in the recording unit does not match second matching data contained in the monitoring control signal received from the transmitting device.

Images