KR20200130180A - Monitoring apparatus and monitoring method - Google Patents

Abstract

An object of the present invention is to provide a monitoring technique capable of detecting an illegal terminal in an IPv6 environment while reducing the burden of monitoring ICMPv6 packets flowing in a network.
The monitoring device 1 includes a generator 11 for generating a transmission packet including a preset illegal header, and an all-node multicast transmission of the transmission packet through a network NW, and from a terminal receiving the transmission packet. A transmission/reception unit 10 for receiving a reply packet including an error message via a network (NW), and an acquisition unit 13 for acquiring unique identification information for identifying a terminal from which the reply packet is transmitted, included in the reply packet. Wow, based on the matching result of the matching unit 14 and the matching unit 14, which collates the acquired identification information with a white list of identification information stored in the storage unit 12, the terminal of the sender of the reply packet A determination unit 15 is provided for determining whether or not the terminal is connected to the network NW illegally.

Description

Monitoring device and monitoring method {MONITORING APPARATUS AND MONITORING METHOD}

TECHNICAL FIELD [0001] The present invention relates to a monitoring apparatus and a monitoring method, and more particularly, to a technique for monitoring illegal access to a network in an IPv6 environment.

Recently, with the spread of IoT, various devices have been connected to the Internet. Accordingly, the number of devices connected to the Internet has exploded, and the transition from IPv4, which has been conventionally used as an Internet protocol, to IPv6 as a protocol having an address length of 128 bits is progressing. Further, in many network security products such as network monitoring devices, there is a rapid demand for IPv6 support.

Conventionally, when determining a terminal in a network, an agent (SW) is put in each terminal, or an address resolution protocol (ARP), which is a communication protocol used in IPv4, is used.

However, in particular, it is difficult to put an agent in a built-in device (eg, a camera), and in a situation where various devices are connected to a network, there may be cases where it is not possible to identify a specific device or terminal on the network. In addition, even in the search for a terminal that has unauthorized access to the network, ARP is based on the IPv4 protocol, and it is difficult to search for an illegal terminal in the IPv6 environment.

Therefore, techniques for preventing unauthorized access to a network in an IPv6 environment have been proposed. For example, in Patent Document 1, a monitoring device is installed in a network to monitor NS (Neighbor Solicitation) packets flowing in the network, and whether the terminal is permitted to access the network based on the source address or MAC address of the NS packet. Determine whether or not.

Japanese Patent Publication No. 2007-104396

However, in the technique described in Patent Literature 1, when a terminal (hereinafter referred to as "an unauthorized terminal") that connects to a network illegally for eavesdropping purposes does not transmit an NS packet or the like by itself, the illegal terminal cannot be detected.

The present invention has been made to solve the above-described problems, and an object of the present invention is to provide a monitoring technology capable of detecting an illegal terminal in an IPv6 environment while reducing the burden of monitoring ICMPv6 packets flowing in a network.

In order to solve the above-described problem, the monitoring apparatus according to the present invention includes a generator configured to generate a transmission packet including a preset illegal header, a transmission unit configured to transmit the transmission packet all-node multicast through a communication network. , A receiving unit configured to receive a reply packet including an error message from the terminal receiving the transmission packet through the communication network, and a unique identification identifying the terminal, which is the source of the reply packet, included in the reply packet An acquisition unit configured to acquire information, a verification unit configured to collate the acquired identification information with a list of identification information stored in a storage unit, and a verification result of the verification unit, the terminal of the transmission source And a determination unit configured to determine whether or not the terminal is unauthorized access to the communication network.

Further, in the monitoring apparatus according to the present invention, the list includes unique identification information of terminals permitted to access the communication network, and the determination unit includes the identification information acquired by the acquisition unit. If it is not included in the list, it may be determined that the terminal is a terminal that illegally accesses the communication network.

Further, in the monitoring device according to the present invention, a notification unit configured to notify a result of the determination by the determination unit may be further provided.

Further, in the monitoring apparatus according to the present invention, the communication network is a communication network corresponding to IPv6, and the transmission packet includes an illegal IPv6 header that the terminal receiving the transmission packet determines that there is a problem with the packet. May be.

Further, in the monitoring apparatus according to the present invention, the reply packet may include a parameter negation message by ICMPv6.

Further, in the monitoring apparatus according to the present invention, the identification information may be a MAC address.

Further, in the monitoring device according to the present invention, the acquisition unit detects a terminal connected to the communication network, acquires at least any of an IP address and a MAC address as information of the terminal, and the determination unit includes the detected Based on the information of the terminal and the verification result of the verification unit, it may be determined whether or not the terminal of the transmission source is a terminal that illegally connects to the communication network.

In order to solve the above-described problem, the monitoring method according to the present invention includes a generating step of generating a transmission packet including a preset illegal header, a transmission step of transmitting the transmission packet all-node multicast through a communication network, A receiving step of receiving a reply packet including an error message from a terminal receiving the transmission packet through the communication network, and unique identification information for identifying the terminal, which is the source of the reply packet, included in the reply packet An acquisition step of acquiring an acquisition step, a verification step of collating the acquired identification information with a list of identification information stored in a storage unit, and a verification result in the verification step, the terminal of the source transmits the communication And a determining step of determining whether or not the terminal is accessing the network illegally.

According to the present invention, an all-node multicast transmission of a transmission packet including a preset illegal header, acquisition of identification information of a terminal included in a reply packet including an error message from a terminal receiving the transmission packet, and identification Since the information is collated with the list, it is possible to detect an illegal terminal in the IPv6 environment while reducing the burden of monitoring ICMPv6 packets flowing in the network.

1 is a block diagram showing a configuration of an unauthorized connection monitoring system including a monitoring device according to an embodiment of the present invention.
2 is a block diagram showing the configuration of a monitoring device according to the present embodiment.
3 is a block diagram showing the hardware configuration of the monitoring device according to the present embodiment.
4 is a flowchart for explaining the operation of the monitoring device according to the present embodiment.
5 is a diagram showing an example of a data structure of a white list according to the present embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 5.

[Configuration of illegal access monitoring system]

The illegal connection monitoring system according to the embodiment of the present invention searches for an illegal terminal 3 that is illegally connected to the network NW by illegal access. The illegal connection monitoring system includes a monitoring device 1, a regular terminal 2, and an illegal terminal 3 as shown in FIG. 1.

The monitoring device 1, the regular terminal 2, and the unauthorized terminal 3 can be connected to each other through a network NW such as a LAN. In Fig. 1, the regular terminal 2 is a terminal such as a PC running IPv6, which is permitted to connect to the network NW. On the other hand, the illegal terminal 3 is a terminal such as a PC running IPv6 that is not permitted to connect to the network NW.

In this embodiment, the illegal connection monitoring system searches for and detects the illegal terminal 3 that performs illegal connection to the network NW on the same segment of the link local. In the example of Fig. 1, each of the three regular terminals 2 is assigned IPv6 addresses "1", "2", and "3", and MAC addresses "A", "B", and "C" Has. Further, the illegal terminal 3 has an IPv6 address "4" and a MAC address "D". Further, in the illegal connection monitoring system, a link local address "a" is assigned.

The illegal access monitoring system according to the present embodiment uses the agreement regarding the ICMPv6 parameter negation message (ICMP Parameter Problem) specified in the specifications of the Internet Communication Message Protocol (ICMP) in IPv6, and uses the illegal terminal 3 in the link local. ) Is detected.

[Function block of monitoring device]

As shown in Fig. 2, the monitoring device 1 includes a transmission/reception unit (transmitting unit, receiving unit) 10, a generation unit 11, a storage unit 12, an acquisition unit 13, a verification unit 14, and determination. A unit 15 and a notification unit 16 are provided.

The transmission/reception unit 10 transmits all-node multicast packets to the regular terminal 2 and the unauthorized terminal 3 via the network NW. Further, the transmission/reception unit 10 receives packets sent from the regular terminal 2 and the unauthorized terminal 3 through the network NW. More specifically, the transmission/reception unit 10 transmits a multicast packet including an illegal IPv6 header described later to an all-node multicast address. Further, the transmission/reception unit 10 receives an ICMPv6 error message to be described later, which is returned from each terminal in the network NW as a reply to the multicast packet.

The generation unit 11 generates a multicast packet (transmission packet) sent to an all-node multicast address including an invalid header set in advance. The preset invalid header refers to an IPv6 header that is judged to have a problem in a packet by the normal terminal 2 and the invalid terminal 3, which are IPv6 nodes, or an IPv6 header in which a problem field is included in the extension header.

Here, in the ICMP specification sheet (RFC) for IPv6, there are the following agreements. According to the RFC, when an IPv6 node processing a packet finds an IPv6 header in which it is impossible to completely process the packet, or a field with a problem included in the extension header, the packet should be discarded. Further, it is said that the IPv6 node should transmit an ICMPv6 parameter negation message indicating the type and problem point to the origin of the packet.

The generation unit 11 receives an ICMPv6 parameter negation message (hereinafter, referred to as ``ICMPv6 error message'' in some cases) from the regular terminal 2 and the illegal terminal 3 on the network NW. Generates a multicast packet with an invalid header coming.

For example, the generation unit 11 may generate a multicast packet, which is data of an IPv6 extension header whose value of a hop-by-hop option in the IPv6 header cannot be recognized by the IPv6 node. Further, the generation unit 11 may be configured to read out an invalid header prepared in advance from the storage unit 12.

The storage unit 12 stores unique identification information of the regular terminal 2 that is permitted to connect to the network NW. The storage unit 12 stores, for example, a white list in which the MAC address of the regular terminal 2 is registered.

The acquisition unit 13 acquires unique identification information indicating a transmission source included in the reply packets from the normal terminal 2 and the unauthorized terminal 3 in the network NW received by the transmission/reception unit 10. The acquisition unit 13 can acquire, for example, the MAC address of the sender at a predetermined position in the packet of the ICMPv6 error message.

Further, the acquisition unit 13 can detect devices including the regular terminal 2 and the illegal terminal 3 connected to the network NW, and acquire information on these devices. For example, the acquisition unit 13 can detect at least one of an IP address and a MAC address of a device on the network NW.

The matching unit 14 collates the identification information of the sender included in the packet of the ICMPv6 error message acquired by the acquisition unit 13 with the identification information of the regular terminal 2 registered in advance in the storage unit 12 do. More specifically, the matching unit 14 checks the MAC address included in the packet of the ICMPv6 error message with the MAC address registered in the white list.

The determination unit 15 determines whether or not the terminal from which the ICMPv6 error message is transmitted is a terminal that connects to the network NW illegally, based on the verification result of the verification unit 14. Specifically, when the determination unit 15 does not correspond to any of the MAC addresses registered in the white list among the MAC addresses included in the packet of the ICMPv6 error message, the terminal having the MAC address is an illegal terminal 3 ).

Further, the determination unit 15 may perform the above determination based on the information of the device on the network NW detected and acquired by the acquisition unit 13 and the verification result of the verification unit 14.

The notification unit 16 outputs a result of the determination by the determination unit 15. For example, the identification information of the terminal determined by the determination unit 15 as the illegal terminal 3 can be displayed on the display device 107. Further, it is possible to notify the detection of the illegal terminal 3 and the identification information of the illegal terminal 3 to an external server (not shown) connected through a communication network such as the Internet.

[Hardware configuration of monitoring device]

Next, an example of the hardware configuration of the monitoring device 1 having the above-described function will be described with reference to FIG. 3.

As shown in Fig. 3, the monitoring device 1 includes, for example, a processor 102 connected through a bus 101, a main memory device 103, a communication interface 104, an auxiliary storage device 105, and input/output I/ This can be realized by a computer having O 106 and a program that controls these hardware resources.

In the main memory device 103, a program for the processor 102 to perform various controls and calculations is stored in advance. Each function of the monitoring device 1, such as the generation unit 11, the acquisition unit 13, the verification unit 14, the determination unit 15, and the like shown in Fig. 2, by the processor 102 and the main memory device 103 Is realized.

The communication interface 104 is an interface circuit for network connection between the monitoring device 1 and the regular terminal 2 and the unauthorized terminal 3 and various external electronic devices.

The auxiliary storage device 105 is configured with a storage medium capable of being read/written, and a driving device for reading/writing various types of information such as programs and data to the storage medium. In the auxiliary storage device 105, a semiconductor memory such as a hard disk or a flash memory can be used as a storage medium.

The auxiliary storage device 105 has a program storage area in which a program for the monitoring device 1 to execute the detection process of the illegal terminal 3 is stored. Further, the auxiliary storage device 105 stores a white list of the regular terminals 2 that are allowed to connect to the network NW. With the auxiliary storage device 105, the storage unit 12 described in Fig. 2 is realized. Further, for example, it may have a backup area for backing up the above-described data and programs.

The input/output I/O 106 is constituted by an I/O terminal for inputting a signal from an external device or outputting a signal to an external device.

The display device 107 is constituted by a liquid crystal display or the like. The display device 107 realizes the notification unit 16 described in FIG. 2. The notification by the notification unit 16 is displayed on the display device 107.

[Monitoring method]

Next, the operation of the monitoring device 1 having the above-described configuration will be described with reference to the flowchart of FIG. 4. As a premise below, it is assumed that the storage unit 12 stores a white list including identification information of terminals permitted to connect to the network NW in advance.

First, the generation unit 11 generates a packet having an illegal header from which a reply of an ICMPv6 parameter negation message (ICMP Parameter Problem) comes from the normal terminal 2 and the illegal terminal 3 on the network NW (step S1). ). Specifically, the generation unit 11 can generate a multicast packet that is data of an IPv6 extension header that cannot be recognized by an IPv6 node with a value of a hop-by-hop option in the IPv6 header. have.

Next, the transmission/reception unit 10 transmits the generated multicast packet with an invalid header to all-node multicast (step S2). Specifically, as shown in Fig. 1, the transmission/reception unit 10 transmits a multicast packet to the three regular terminals 2 and the unauthorized terminals 3 via a network NW, all-node multicast (for example, " FE02::1").

Thereafter, the transmission/reception unit 10 receives the ICMPv6 error message as a reply packet from the normal terminal 2 and the illegal terminal 3 which have received the multicast packet having an invalid header (step S3). Next, the acquisition unit 13 acquires unique identification information indicating the transmission source included in the packet of the received ICMPv6 error message (step S4). For example, the acquisition unit 13 can acquire the MAC address of the transmission source as unique identification information.

Next, the verification unit 14 collates the unique identification information acquired by the acquisition unit 13 with the white list stored in the storage unit 12 (step S5). Specifically, the verification unit 14 verifies the MAC address of the sender included in the packet of the ICMPv6 error message with the MAC address registered in the white list.

5 shows an example of a white list stored in the storage unit 12. In the white list prepared in advance, MAC addresses "A", "B" and "C" are registered. The verification unit 14 outputs as a verification result whether the MAC address included in the packet of the ICMPv6 error message matches "A", "B", and "C".

When the MAC address included in the packet of the ICMPv6 error message exists in the white list (step S6: YES), until all the acquired MAC addresses are collated with the white list (step S8: NO), step S3 to step S6 is performed. Repeat.

On the other hand, if the MAC address included in the packet of the ICMPv6 error message does not exist in the white list (step S6: NO), the determination unit 15 determines that the terminal having the matched MAC address is an illegal terminal 3 (Step S7).

After that, the notification unit 16 notifies the presence of the illegal terminal 3 and the MAC address of the illegal terminal (step S9). For example, the notification unit 16 can cause the display device 107 to display the MAC address of the illegal terminal 3 or the like. In addition, when the illegal terminal 3 is not detected, the notification unit 16 may provide a notification indicating the effect.

As described above, according to the monitoring device 1 according to the present embodiment, an all-node multicast transmission of a multicast packet including an illegal header to a terminal in the network NW, and then an ICMPv6 error message returned from the terminal The unauthorized terminal 3 is detected using the unique identification information of the source included in the packet of. Therefore, it is possible to detect the illegal terminal 3 connected to the link local in the IPv6 environment without waiting for each terminal in the network NW to transmit the NS packet.

In addition, since the information contained in the packet of the ICMPv6 error message is used, it is possible to detect the illegal terminal 3 in a shorter time by transmitting a smaller amount of search packets.

In addition, in the embodiment described, the case of using the MAC address as the unique identification information of the terminal in the network NW has been illustrated. However, information used as unique identification information is not limited to this. For example, a combination of an IPv6 address and a MAC address may be used.

As described above, embodiments of the monitoring device and monitoring method of the present invention have been described, but the present invention is not limited to the described embodiments, and various modifications that can be conceived by those skilled in the art within the scope of the invention described in the claims are made. It is possible.

1: monitoring device, 2: regular terminal, 3: illegal terminal, 10: transmitting/receiving unit, 11: generating unit, 12: storing unit, 13: acquiring unit, 14: checking unit, 15: judging unit, 16: notifying unit, 101: bus, 102: processor, 103: main memory, 104: communication interface, 105: auxiliary memory, 106: input/output I/O, 107: display, NW: network.

Claims (8)

A generator configured to generate a transmission packet including a preset invalid header,
A transmission unit configured to transmit the transmission packet through an all-node multicast transmission through a communication network,
A receiving unit configured to receive a reply packet including an error message from a terminal receiving the transmission packet through the communication network,
An acquisition unit configured to acquire unique identification information that identifies the terminal that is a transmission source of the reply packet, included in the reply packet;
A matching unit configured to collate the acquired identification information with a list of identification information stored in the storage unit,
A determination unit configured to determine whether or not the terminal of the source is a terminal accessing the communication network illegally, based on the verification result of the verification unit
Monitoring device comprising a. The method of claim 1,
The list includes unique identification information of terminals permitted to access the communication network,
And when the identification information acquired by the acquisition unit is not included in the list, the determination unit determines that the terminal is a terminal that illegally connects to the communication network. The method according to claim 1 or 2,
And a notification unit configured to notify a result of the determination by the determination unit. The method according to claim 1 or 2,
The communication network is a communication network corresponding to IPv6,
And the transmission packet includes an illegal IPv6 header for determining that a problem exists in the packet by a terminal receiving the transmission packet. The method according to claim 1 or 2,
And the reply packet includes a parameter negation message according to ICMPv6. The method according to claim 1 or 2,
The identification information is a monitoring device, characterized in that the MAC address. The method according to claim 1 or 2,
The acquisition unit detects a terminal connected to the communication network, acquires at least one of an IP address and a MAC address as information of the terminal,
And the determination unit, based on the detected information of the terminal and a result of the verification by the matching unit, determines whether the terminal of the source is a terminal accessing the communication network illegally. A generating step of generating a transmission packet including a preset illegal header,
A transmission step of transmitting the transmission packet through an all-node multicast through a communication network,
A receiving step of receiving a reply packet including an error message from a terminal receiving the transmission packet through the communication network,
An acquisition step of acquiring unique identification information that identifies the terminal that is a transmission source of the reply packet, included in the reply packet;
A collating step of collating the acquired identification information with a list of identification information stored in a storage unit;
A determination step of determining whether or not the terminal of the source is a terminal unauthorized access to the communication network, based on the verification result in the verification step
Monitoring method comprising a.

Images