Attack defending system and attack defending method

Abstract

An attack defending system allows effective defense against attacks from external networks even when a communication system uses a communication path encryption technique such as SSL. A firewall device and a decoy device are provided. The firewall device refers to the header of an input IP packet and, when it is determined that the input IP packet is suspicious, it is guided into the decoy device. The decoy device monitors a process providing a service to detect the presence or absence of attacks. When an attack has been detected, an alert including the attack-source IP address is sent to the firewall device so as to reject subsequent packets from attack source.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]The present invention relates generally to a security countermeasure technique in a computer network, and more particularly to a system and a method allowing protection of resources on an internal network against attacks from external networks.[0003]2. Description of the Related Art[0004]As defense techniques against attacks from external networks, the following approaches have been proposed: (1) firewall; (2) intrusion detection system; and (3) decoy (or honeypot) system.[0005]An example of the firewall is disclosed in Japanese Patent Application Unexamined Pub. No. H8-44642 (hereafter referred to as Patent Document 1). According to the Patent Document 1, a firewall is installed at an interface between an external IP network and an internal Ethernet. The firewall determines whether a packet to be inspected should pass through from the external network to the internal network. Specifically, the firewall is provided with...

AI Technical Summary

Benefits of technology

[0018]It is therefore an object of the present invention to provide an attack defending system and an attack defending method as well as a firewall unit, which allow effective defense against attacks from external networks even when a communication system uses a communication path encryption technique.

[0020]Yet another object of the invention is to provide an attack defending system and an attack defending method as well as a firewall unit, which can block securely unauthorized packets directed to a server to be protected.

[0031]As described above, according to the invention, since an input IP packet is guided based on the header information of the input IP packet, the system can effectively detect and defend against attacks even when an encryption technique is employed in accesses from an external network to an internal network. Even when any communication path encryption technique is employed, at least the source IP address or the destination IP address described in an IP header is not encrypted. Further, the guiding to the decoy unit by the firewall unit can be executed based on the information described in the IP header.

[0032]Furthermore, according to the invention, the network performance can be maintained at a high level in a high-speed network environment because the method of guiding to the decoy unit at the firewall unit can be realized with a simple algorithm based on a small number of parameters.

Problems solved by technology

However, the above conventional techniques have problems listed below.

A first problem is that attacks cannot be effectively detected or defended against when a communication path encryption technique such as SSL (Secure Socket Layer) and IPSec (that has obtained RFC2401) is used between an attack-source host on an external network and a server on an internal network.

A second problem is that there are some packets overlooked by an inspection or the speediness of a network is lost since the performance of an attack detecting section cannot catch up completely with the speedup of networks in recent years.

However, the number of packets to be inspected is drastically increasing due to the speedup of networks.

Therefore, it is not possible to distribute packets correctly, permitting normal accesses to be guided to the substitute network and anomalous accesses to be guided to the internal network.

A third problem is that it is difficult to improve the accuracy of detecting attacks.

Therefore, an intrusion detection system often mistakenly detects this maintenance work as attacks.

As is known with Web applications, various application programs such as database operation as a subsystem of a server are often run and attacks causing unauthorized operation taking advantage of such vulnerability of the subsystem are often seen.

However, there is a risk of receiving unknown attacks in the case where there is a subsystem created specifically for a site or where configuration of a server or a subsystem is not complete though the server or the subsystem is a commonly-used one.

In a server system provided with subsystems such as databases and plug-in modules, in which a specific access procedure is defined in a communication protocol between the server system and a client (that is, in the case of a stateful protocol), the client / server communication fails at both of the decoy server and the regular server when using such a method that only suspicious accesses are lured into a server which is not a regular server, such as a decoy server.

Especially when an access has been mistakenly lured into the decoy server, a server failure will occur since processes to be executed on the regular server are not executed thereon.

Images