JP4390813B2 - Communication control device, firewall device, communication control system, and data communication method - Google Patents

Description

  The present invention relates to a communication control device, a firewall device, a communication control system, and a data communication method.

  Conventionally, mobile IPv6, which is a technology in which a mobile device such as a mobile phone uses the same IP (Internet Protocol) address regardless of its movement, has been studied in IETF (Internet Engineering Task Force). Mobile IPv6 is realized by a mobile IP terminal as a mobile device and a home agent. A packet whose destination address is a permanent IP address (home address) of a mobile IP terminal is transferred by a normal IP procedure, and then reaches a link with a home agent. As a result, the home agent receives a packet addressed to the home address.

  When the mobile IP terminal moves, the mobile node is a temporary IP address using the existing stateless address automatic generation technology (RFC2462) or stateful address automatic generation technology (DHCP: Dynamic Host Configuration Protocol) at the destination node. Get care-of address. The mobile IP terminal registers this care-of address with the home agent.

  There are two methods for a mobile IP terminal to communicate with other terminals: a bidirectional tunnel mode and a route optimization mode. In the bidirectional tunnel mode, a tunnel is generated between the mobile IP terminal and the home agent. As disclosed in RFC 2473, a tunnel is an arbitrary IP packet that is transmitted regardless of the source IP address or the destination IP address of the original IP packet by including the original IP packet in another IP packet. This is a technology for carrying packets along the route.

  When transmitting an IP packet from a mobile IP terminal to another terminal, the IP packet is first transmitted to the home agent via a tunnel. The home agent sends an IP packet out of the tunnel and then sends it to another terminal by a normal IP procedure. As a result, the IP packet reaches another terminal. On the other hand, when an IP packet is transmitted from another terminal to the mobile IP terminal, the IP packet reaches the home agent by a normal IP procedure. Thereafter, the home agent puts this IP packet in the tunnel and sends it out to the mobile IP terminal.

  On the other hand, in the route optimization mode, the mobile IP terminal notifies the IP address to other terminals prior to transmission of the IP packet. When the IP packet is transmitted from another terminal to the mobile IP terminal in the bidirectional tunnel mode, the mobile IP terminal sends its care-of address to the other terminal in order to change the mode to the route optimization mode. Send.

  In the route optimization mode, when an IP packet is transmitted from a mobile IP terminal to another terminal, the IP packet is transmitted directly from the mobile IP terminal to another terminal (without going through a tunnel). The At this time, the care-of address is set as the source address of the IP packet, and the home address is set as the home address option in the IP packet.

  On the other hand, when an IP packet is transmitted from another terminal to the mobile IP terminal, a routing header is attached to the IP packet, and the IP packet is directly transmitted from the other terminal to the mobile IP terminal (without passing through the tunnel). To be sent). The routing header is defined by RFC2460 and is information for transmitting a packet via an arbitrary relay point. The care-of address is set as the first destination (relay point) of the IP packet, and the home address is set as the second destination.

  In addition, in an internal network such as a LAN, in order to detect and block unauthorized access from an external network such as the Internet, a firewall that determines whether or not data that has reached the boundary of each network is allowed to pass according to a predetermined filtering condition is installed. . In many cases, a firewall is provided in the form of software and is used by being incorporated in a router, a proxy server, or the like. However, since high performance is required, dedicated hardware may be used (for example, patent documents). 1).

JP-A-10-70576

  Firewalls are expensive and require advanced configuration techniques, and are difficult to operate by non-experts. In addition, firewalls are mainly used to protect corporate LANs for the following reasons. That is, in a mobile device such as a terminal or a mobile phone that performs dial-up connection, the location for connecting to an external network differs depending on the situation and application, and it is difficult to specify an appropriate and fixed installation location of the firewall. In addition, since a terminal that performs dial-up connection has an assigned IP address that varies depending on the connection time, it is necessary to change the filtering condition for each connection time, which is not practical. Furthermore, since the dial-up connection has a short connection time, the possibility of being attacked from the Internet during that time is low, and even if the terminal is not protected by a firewall, there is hardly any trouble.

  Further, in recent years, the number of terminals used by individual users connecting to an external network through constant connection has increased, and the necessity of using a firewall has increased for such terminals. However, mobile terminals such as mobile phones and notebook computers (hereinafter referred to as “mobile devices”) as such terminals are expected to change the connected node frequently and at high speed. A firewall that does not change the installation location cannot be used.

  Therefore, an object of the present invention is to enable application of a firewall function to a mobile device.

  In order to solve the above problems, a communication control device according to the present invention provides firewall setting information suitable for a mobile device in a communication control device that transmits and receives data to and from a plurality of firewall devices to which the mobile device can be connected. Storage means for storing in association with identification information of a mobile device, detection means for detecting a firewall device as a connection destination of the mobile device, and detecting the firewall device as a connection destination of the mobile device, the mobile device Transmitting means for transmitting firewall setting information corresponding to the identification information to the firewall device.

  The data communication method according to the present invention includes a plurality of firewalls to which a communication control device including storage means for storing firewall setting information suitable for a mobile device in association with identification information of the mobile device can connect the mobile device. In the data communication method for transmitting and receiving data to and from a device, the detection unit of the communication control device detects a firewall device to which the mobile device is connected, and the transmission unit of the communication control device includes the mobile device. A transmission step of transmitting firewall setting information corresponding to the identification information of the mobile device to the firewall device in response to detection of a connection destination firewall device.

  According to these inventions, the firewall setting information corresponding to the identification information of the mobile device is transmitted to the firewall device of the new connection destination of the mobile device when the firewall device of the connection destination of the mobile device is detected. Is done. Thereby, firewall setting information suitable for the mobile device is transmitted and set to the firewall device to which the mobile device is connected.

  Therefore, not only when the mobile device makes an initial connection to the firewall device, but also when the mobile device changes the connection destination firewall device due to movement, the firewall setting information is sent and set to the firewall device after the connection destination change. The That is, the firewall setting information follows the movement of the mobile device. Since the firewall setting information includes a filtering condition for the packet addressed to the mobile device, whether the packet reaches the firewall apparatus is determined to pass or fail (transfer or discard) according to the filtering condition. As a result, an appropriate firewall function can be applied to the mobile device.

  The firewall device according to the present invention relates to the filtering condition included in the firewall setting information and the identification information of each mobile device in the firewall device that relays data transmission / reception between the above-described communication control device and a plurality of mobile devices. Holding means, identification means for identifying a mobile device that is a destination of a packet transmitted from the communication control device, and whether or not the packet is allowed to pass according to a filtering condition corresponding to the mobile device identified by the identification means. Determination means for determining whether or not.

  In the data communication method according to the present invention, in the data communication method in which the firewall device relays data transmission / reception between the communication control device and the plurality of mobile devices, the firewall device holding means includes the firewall setting information. A holding step of holding the filtering condition included in association with the identification information of each mobile device, and an identification step in which the identification unit of the firewall device identifies the mobile device that is the destination of the packet transmitted from the communication control device; The determination unit of the firewall apparatus includes a determination step of determining whether or not the packet is allowed to pass according to a filtering condition corresponding to the mobile device identified in the identification step.

  According to these inventions, after the filtering condition included in the firewall setting information is held in association with the identification information of each mobile device, the mobile device that is the destination of the packet transmitted from the communication control device to the firewall device is identified. Then, whether or not the packet is allowed to pass is determined according to the filtering condition corresponding to the mobile device. As a result, the filtering condition used when determining whether or not the packet that has reached the firewall apparatus is allowed to pass is appropriately changed for each mobile device. Therefore, it is possible to prevent the passage permission / inhibition determination process from being performed unnecessarily even for a mobile device in which the packet is not likely to be a destination. As a result, even if the number of mobile devices using firewall devices increases, it is possible to suppress an increase in the transmission delay time of packets addressed to each mobile device.

  The communication control system according to the present invention includes the communication control device described above and the firewall device described above, and the mobile device receives the received packet via the firewall device.

  According to the present invention, it is possible to apply a firewall function to a mobile device.

(First embodiment)
Hereinafter, a first embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram showing an overall configuration of a communication control system 1 according to the present invention. As shown in FIG. 1, the communication control system 1 includes a home agent device 10 (corresponding to a communication control device), three firewall devices 20, 30, 40 (corresponding to a plurality of firewall devices), and a mobile device 50. Configured.

  The home agent device 10 and the mobile device 50 are connected to each other through at least one arbitrary one of the three firewall devices 20 to 40 so that various types of data can be transmitted and received. An IP packet transmitted from an external network such as the Internet is once received by the home agent device 10 and then relayed by the firewall device 20 located closest to the current location of the mobile device 50, and is the destination of the IP packet. The mobile device 50 can be reached.

  FIG. 2 is a diagram showing a functional configuration of the home agent device 10 according to the present invention. As shown in FIG. 2, the home agent device 10 includes a setting file source data storage unit 11 (corresponding to storage means), a BU receiving unit 12 (corresponding to detection means), and a setting file transmission unit 13 (corresponding to transmission means). ). Each unit is connected via a bus so as to be able to input and output signals according to the function of each unit.

Hereinafter, each component of the home agent device 10 will be described in detail.
The setting file source data storage unit 11 stores setting file source data (corresponding to firewall setting information), which will be described later, in association with mobile device identification information. The mobile device identification information is, for example, the home address or MAC address of the mobile device.

For example, the following information is described in the setting file source data.
(1). Firewall name (2). Information necessary for generating “distribution criteria for IP packets coming from external network” (3). Information necessary for generating “distribution standard of IP packet transmitted from mobile device” (4). Information required to generate an access control list

That is, the information of (1) is information that can uniquely specify the setting contents of the firewall, and is used when the home agent device 10 deletes the setting file source data that has already been transmitted or has passed a predetermined time since the creation. Is done.
The information (2) is information for the firewall device to identify the mobile device that is the destination of the IP packet transmitted from the external network via the home agent device 10. The information of (2) is described as necessary. Such information is, for example, the IP address of the mobile device 50, but is not necessarily limited to one IP address, and may be information in which a plurality of destination IP addresses are specified.

  The information (3) is information for the firewall device to identify the transmission source of the IP packet transmitted from the mobile device. Such information is, for example, information for designating whether the transmission source MAC address is used as a distribution reference or the transmission source IP address as a distribution reference, and a MAC address when the MAC address is used as a distribution reference.

  The information (4) is information necessary for generating a well-known and commonly used access control list in which filtering conditions used when the firewall apparatus determines whether or not an IP packet is allowed to pass. For example, it is information for designating a list as a base of the access control list and which part on the list is rewritten with the care-of address. However, the access control list describes the filtering conditions used to determine whether or not the IP packet addressed to the mobile device identified based on the information of (2) and (3) is passed. Filtering conditions are not described. This reduces the amount of search data that accompanies pass / fail judgment and speeds up packet filtering. The access control list is described in units of rows so that it can be sequentially searched from the top row, and “deny” or “permit” indicating whether or not the IP packet can be passed in order from the top item of each row, the IP packet The upper layer protocol, IP packet source address and source port number, IP packet destination address and destination port number, and the like are described.

  The BU receiving unit 12 receives a binding update (BU), which is a packet for notifying that the mobile device 50 has moved, from the destination firewall apparatus 20. Upon receiving this binding update, the BU receiving unit 12 detects that the mobile device 50 is connected to the firewall device (including changing the connection destination), and notifies the setting file transmitting unit 13 to that effect.

  When the connection of the mobile device 50 is notified from the BU receiving unit 12, the setting file transmission unit 13 refers to the binding update and identifies the mobile device connected to the firewall device. The setting file transmission unit 13 acquires the identification information of the identified mobile device and the corresponding setting file source data from the setting file source data storage unit 11, and generates a setting file based on the setting file source data. The configuration file transmission unit 13 transmits the mobile device identification information and the configuration file to a firewall device that is a new connection destination of the mobile device 50 together with a binding acknowledgment (BA). A binding ack is an acknowledgment signal for a binding update.

  FIG. 3 is a diagram showing a functional configuration of the firewall device 20 according to the present invention. The firewall device 20 may be a router itself including an access router, or may be a dedicated terminal for a firewall configured separately from the router. As shown in FIG. 3, the firewall device 20 includes packet distribution units 21 and 24 (corresponding to identification means), firewall processes 221, 222 and 223 (corresponding to holding means and determination means), output buffers 23 and 25, Is provided. Each unit is connected via a bus so as to be able to input and output signals according to the function of each unit.

  When the packet distribution unit 21 receives the mobile device identification information and the setting file transmitted from the home agent device 10, the packet distribution unit 21 specifies a firewall process that is a setting file setting destination based on the mobile device identification information. If there is no corresponding firewall process, a firewall process is generated. The specified or generated firewall process holds the mobile device identification information and the setting file. The packet distribution unit 21 is set with a firewall name in the setting file and a distribution standard for IP packets coming from the external network. In the packet distribution unit 24, the firewall name in the setting file and the distribution standard of the IP packet transmitted from the mobile device are set.

  Thereafter, when receiving the IP packet transmitted from the external network, the packet distribution unit 21 outputs the IP packet to the firewall corresponding to the destination mobile device according to the set distribution standard. Similarly, when receiving the IP packet transmitted from the mobile device, the packet distribution unit 24 outputs the IP packet to the firewall process corresponding to the transmission source mobile device according to the set distribution standard.

  When an IP packet is transmitted in the direction from the external network toward the mobile device 50 (downward direction), the firewall process 221 starts from the IP packet acquired from the packet distribution unit 21 prior to the passage permission determination. The destination IP address and the source IP address for filtering are acquired by the procedure shown in the following 1-3.

  1. When the IP packet is transmitted in the bidirectional tunnel mode, that is, when the source address of the outer IP packet is the home agent address, the destination address is the care-of address, and the IP packet contains the IP packet The firewall process 221 acquires an internal IP packet and applies the procedures shown in 2 and 3 below to the IP packet. On the other hand, when the IP packet is not transmitted in the bidirectional tunnel mode, the firewall process 221 applies the procedure shown in 2 and 3 below to the IP packet acquired from the packet distribution unit 21 as it is.

  2. When the IP packet is transmitted to the mobile device 50 in the route optimization mode, that is, the destination address of the IP packet is the care-of address, the routing header exists, and the second destination set in the routing header Is the home address, the firewall process 221 uses the home address as the destination IP address for filtering. On the other hand, when the IP packet is not transmitted to the mobile device 50 in the route optimization mode, the firewall process 221 uses the destination address of the IP packet as it is as the destination IP address for filtering.

  3. When the IP packet is transmitted from the mobile IP terminal in the route optimization mode, that is, when the source address of the IP packet is a care-of address and the home address option is set, the firewall process 221 The address set in the home address option is used as the source IP address for filtering. On the other hand, when the IP packet is not transmitted from the mobile IP terminal in the route optimization mode, the firewall process 221 uses the IP packet source address as it is as the source IP address for filtering.

  When an IP packet is transmitted in a direction (upward direction) from the mobile device 50 toward the external network, the firewall process 221 determines the following from the IP packet acquired from the packet distribution unit 24 prior to the determination of whether or not the passage is permitted. The destination IP address and the source IP address for filtering are acquired by the procedure shown in 1-3.

  1. When the IP packet is transmitted in the bidirectional tunnel mode, that is, when the source address of the outer IP packet is the care-of address, the destination address is the home agent address, and the IP packet contains the IP packet The firewall process 221 acquires an internal IP packet and applies the procedures shown in 2 and 3 below to the IP packet. On the other hand, when the IP packet is not transmitted in the bidirectional tunnel mode, the firewall process 221 applies the procedure shown in 2 and 3 below to the IP packet acquired from the packet distribution unit 24 as it is.

  2. When the IP packet is transmitted to the mobile IP terminal in the route optimization mode, that is, when the routing header is present in the IP packet, the firewall process 221 uses the second set in the routing header. The destination is used as a destination IP address for filtering. On the other hand, when the IP packet is not transmitted to the mobile IP terminal in the route optimization mode, the firewall process 221 uses the destination address of the IP packet as the destination IP address for filtering as it is.

  3. When the IP packet is transmitted from the mobile device 50 in the route optimization mode, that is, when the source address of the IP packet is a care-of address and the home address option is set, the firewall process 221 The address set in the home address option is used as the source IP address for filtering. On the other hand, when the IP packet is not transmitted from the mobile device 50 in the route optimization mode, the firewall process 221 uses the IP packet source address as it is as the source IP address for filtering.

  Further, the firewall process 221 uses the filtering destination IP address and transmission source IP address acquired in the above procedure, and according to the filtering condition described in the access control list in the configuration file, the packet distribution unit 21. It is determined whether or not the IP packet distributed according to is passed. The IP packet permitted to pass is output to the output buffer 23, and the IP packet refused to pass is discarded. Accordingly, the firewall process 221 realizes filtering of IP packets whose destination or transmission source is the mobile device 50.

  The firewall process 222 has the same functional configuration as the firewall process 221 described above. That is, the firewall process 222 holds identification information and a setting file of a mobile device 60 (not shown) that is a mobile device different from the mobile device 50, and an IP packet whose destination or transmission source address is the mobile device 60. Implement filtering. Similarly, the firewall process 223 holds identification information and a setting file of a mobile device 70 (not shown) as another mobile device, and realizes filtering of IP packets whose destination or transmission source is the mobile device 70. .

  The output buffer 23 transmits (transfers) an IP packet input from any of the firewall processes 221 to 223 to a mobile device that is the destination of the IP packet via a wireless channel.

  The packet distribution unit 24 has the same functional configuration as the packet distribution unit 21 described above, but differs from the packet distribution unit 21 in the IP packet transmission direction. That is, while the packet distribution unit 21 receives an IP packet from an external network such as the Internet formed on the home agent device 10 side, the packet distribution unit 24 receives the IP packet transmitted from the mobile device 50 side. Receive.

The output buffer 25 transmits (transfers) the IP packet input from any of the firewall processes 221 to 223 to the destination node of the IP packet.
Although the firewall devices 30 and 40 are different from the firewall device 20 in the installation position, the configuration is the same as that of the firewall device 20 described above, and a description thereof will be omitted.

  The mobile device 50 is a mobile node compliant with Mobile IPv6. The mobile device 50 is wirelessly connected to the firewall device having the highest reception level among the firewall devices 20 to 40 in accordance with power-on or reconnection after long-term disconnection. In the present embodiment, it is assumed that the mobile device 50 is newly connected (initial connection) to the firewall device 20 in the communication control system 1, but the connection-destination firewall device is changed (handover) as it moves. Of course, it is also possible.

  When the mobile device 50 is connected to the firewall device, the mobile device 50 transmits the binding update to the home agent device 10 via the firewall device. In addition, the mobile device 50 receives the binding ack transmitted from the home agent device 10.

Next, the operation of the communication control system 1 will be described with reference to FIGS. 4 and 5. In addition, each step constituting the data communication method according to the present invention will be described.
FIG. 4 is a flowchart for explaining firewall construction processing that is executed and controlled by the communication control system 1.

  First, in S1, the mobile device 50 has the highest reception level (usually located closest) among the firewall devices 20 to 40 when the power is turned on or reconnected after a long-term disconnection. Wireless connection with the firewall device 20 is established.

  In S <b> 2, the mobile device 50 transmits a binding update to the home agent device 10 in order to notify that the wireless connection with the firewall device 20 is completed according to a well-known and commonly used Mobile IPv6 connection procedure. This binding update includes at least identification information of the mobile device 50 that is the transmission source.

In S <b> 3, the home agent device 10 receives the binding update transmitted from the mobile device 50 by the BU receiving unit 12.
In S4, the home agent device 10 sets the identification information of the mobile device 50 and the setting file source data corresponding thereto based on the identification information of the transmission source mobile device included in the binding update by the configuration file transmission unit 13. Obtained from the file source data storage unit 11.

  In S5, the home agent device 10 causes the setting file transmission unit 13 to generate a setting file according to the following procedures I to V based on the setting file source data acquired in S4.

I. Copy the firewall name from the configuration file source data.
II. The care-of address is set as “IP packet distribution standard from the external network”.
III. When it is specified that the transmission source IP address is used as a distribution reference, the home address and the care-of address are set as the “distribution reference of the IP packet transmitted from the mobile device”. If the transmission source MAC address is designated to be a distribution criterion, the MAC address of the setting file source data is copied as the “distribution criterion of the IP packet transmitted from the mobile device”.
IV. The part of the access control list on which rewriting is specified is replaced with a care-of address and set as an “access control list”.
V. As the “home agent address”, the IP address of the home agent is set.

  In S <b> 6, the home agent device 10 attaches the identification information of the mobile device 50 acquired in S <b> 4 and the configuration file generated in S <b> 5 to the binding ack by the setting file transmission unit 13 and transmits it to the mobile device 50. .

  In the present embodiment, the configuration file has been described as being generated and transmitted on the home agent device 10 side. However, the home agent device 10 may transmit the setting file source data to the firewall device, and the firewall device may generate the setting file based on the setting file source data.

Since the mobile device 50 is connected to the firewall device 20, the binding ack addressed to the mobile device 50 necessarily passes through the firewall device 20. In S7, the firewall apparatus 20 acquires the identification information and the setting file of the mobile device 50 attached to the binding ack during transmission.
In S8, the mobile device 50 receives the binding ack, and thereby the location registration of the mobile device 50 with respect to the home agent device 10 is completed. At this time, the mobile device 50 may receive the setting file together with the binding ack.

  The mobile device identification information and the setting file are transmitted on the binding ack, but may be transmitted separately from the binding ack. That is, the home agent device 10 determines the prefix of the firewall device 20 to which the mobile device 50 is connected based on the care-of address of the binding update, and sets it for all the firewall devices on the network indicated by the prefix. Multicast files. Thereafter, the home agent device 10 transmits a binding ack to the mobile device 50.

  In S9, the firewall device 20 generates a firewall process 221 for the mobile device 50 using the identification information and setting file of the mobile device 50 acquired in S7. The creation of the firewall in S9 means that the process for executing the access control list in the setting file is customized for a specific mobile device. When creating a firewall, execute the above process (internal variable setting) if necessary, and if it exists in the settings file, set it as an internal variable for the above process. .

In S10, the firewall device 20 acquires the firewall name and the distribution standard from the setting file acquired in S7, and sets them in the packet distribution units 21 and 24.
The process of constructing the firewall applied to the mobile device 50 has been described above, but the firewall applied to the mobile devices 60 and 70 is constructed through the same steps.

Next, with reference to FIG. 5, an IP packet filtering process that is executed and controlled by the firewall apparatus 20 after construction of the firewall will be described.
Hereinafter, a case where an IP packet is transmitted in a direction (downward direction) from the home agent 10 toward the mobile device 50 will be described, but a case where an IP packet is transmitted in the opposite direction (upward direction) will be described. The same processing can be executed.

At T1, the packet distribution unit 21 monitors whether or not an IP packet is received.
At T2, the packet distribution unit 21 specifies the destination IP address from the header information of the IP packet, and outputs the IP packet with the firewall corresponding to the mobile device having the address as the distribution destination. For example, when the destination IP address of the received IP packet is the IP address of the mobile device 50, the IP packet is distributed to the firewall process 221.

  At this time, there is a concern that the firewall to which the received IP packet is distributed has not yet been generated. In such a case, a preset process (hereinafter referred to as “default process”) is executed. The As the default processing, for example, the firewall device 20 checks the description content of the IP packet, and if the description content is a binding update to the home agent device 10, the packet is transmitted to the home agent device 10. If it is not a binding update, the IP packet is discarded at that time.

  At T3, the firewall process 221 determines whether or not the IP packet is allowed to pass based on the process generated in S9 of FIG. Note that the firewall process 221 is not limited to IP packet passage permission / inhibition determination processing, and may execute processing such as passage priority setting, authentication information inspection, and description content change.

  If the passage is permitted as a result of the determination at T3 (T4; Yes), the firewall process 221 outputs and holds the IP packet in the output buffer 23 (T5). At T6, the IP packet held in the output buffer 23 is transmitted to the mobile device 50 via the wireless channel connecting the firewall device 20 and the mobile device 50.

  On the other hand, when the passage is rejected as a result of the determination at T3 (T4; No), the firewall process 221 deletes the IP packet (T7). At this time, the fact that the IP packet has been deleted may be notified to the home agent device 10 which is the transmission source.

After completing the process of T6 or T7, the firewall device 20 returns to T1 to wait for further IP packet reception, and executes the processes after T1 again.
The process of filtering the IP packet addressed to the mobile device 50 by the communication control system 1 has been described above. However, the filtering process for the IP packet addressed to the mobile devices 60 and 70 can be executed through the same steps. is there. As a result, it is possible to determine whether or not passage is permitted at high speed with respect to all IP packets addressed to all mobile devices for which a dedicated firewall is generated.

  As described above, according to the communication control system 1 according to the present invention, a firewall is provided at a position of a terminal to which a mobile device may be directly connected. When the home agent device 10 receives a binding update transmitted from an arbitrary mobile device, the home agent device 10 transmits a firewall setting file suitable for the mobile device to the firewall device. The firewall device uses this setting file to generate a firewall suitable for the mobile device. As a result, a firewall for the mobile device is constructed in an arbitrary firewall device to which the mobile device is connected, and the firewall function can be applied to a moving terminal.

  Here, when the firewall function is applied to a mobile device, it is predicted that the amount of description in the access control list in which the filtering condition is specified becomes enormous as the number of users using the mobile device increases. On the other hand, the firewall device collates the header information with the conditions in order from the top row of the access control list when determining whether or not the packet is allowed to pass. For this reason, there is a concern that the processing time for passage permission / prohibition increases as the amount of description increases, and the packet transmission delay time increases.

  In order to eliminate such a concern, it is effective that the firewall apparatus uses different filtering conditions for each mobile device. As a method of changing the filtering condition for each mobile device, it may be possible to change the physical interface for each mobile device. However, this method is extremely difficult to apply to the case where the same physical interface is shared by a large number of mobile devices, such as connection in layer 2 represented by a wireless LAN.

  Therefore, in order to change the filtering condition for each mobile device, when the firewall apparatus receives the packet, the firewall device identifies the mobile device that is the destination of the packet, and appropriately changes the firewall applied to the packet according to the identification result. To do. As a result, it is possible to prevent an unnecessary passage permission / inhibition determination from being performed for a mobile device that is unlikely to transmit a packet. Therefore, an increase in packet transmission delay time accompanying an increase in mobile devices is suppressed. As a result, the firewall function can be applied to the mobile device without reducing the transfer processing speed.

(Second Embodiment)
Hereinafter, a second embodiment of the present invention will be described in detail with reference to the drawings.
In the first embodiment, it is assumed that the mobile device 50 is initially connected to the firewall device in the communication control system 1. Therefore, the firewall device receives and uses the setting file generated by the home agent device. On the other hand, in the present embodiment, assuming that the mobile device 50 changes (handover) the connection destination firewall device due to movement, the setting file held in the movement source firewall device is transferred to the movement destination firewall. The device receives and uses it.

Hereinafter, the communication control system in the present embodiment will be described in detail.
The configuration of the communication control system in the present embodiment is the same as the configuration of the communication control system detailed in the first embodiment. Therefore, the same reference numerals are given to the respective constituent elements and the description thereof is omitted. In the present embodiment, it is assumed that the mobile device 50 changes the connection destination from the firewall device 20 to the firewall device 30.

Next, firewall construction processing executed by the communication control system 1 will be described with reference to FIG.
When the mobile device 50 changes the firewall device of the connection destination (S11), a binding update is transmitted to the home agent device 10 (S12).
Upon receiving the binding update from the mobile device 50 (S13), the home agent device 10 transmits the IP address of the source firewall device 20 to the destination firewall device 30 (S14). This IP address is notified together with the binding update when the mobile device 50 is connected to the firewall device 20, that is, before moving.

When the firewall device 30 receives the IP address of the firewall device 20 (S15), the firewall device 30 transmits a setting file transfer request for the mobile device 50 to the address (S16).
When the firewall device 20 receives the transfer request from the firewall device 30 (S17), the firewall device 20 transmits the identification information and setting file of the mobile device 50 held in the firewall process 221 to the firewall device 30 (S18).

When the firewall device 30 receives the identification information and setting file of the mobile device 50 from the firewall device 20 (S19), the firewall device 30 generates a firewall for the mobile device 50 using the setting file (S20).
Thereafter, processing similar to S10 shown in FIG. 4 is executed. That is, the firewall name and the distribution standard are set in the packet distribution unit 21.

  As described above, the mobile device 50 transmits a binding update to the home agent device 10 with handover. Therefore, each time the mobile device 50 changes the connection-destination firewall device, that is, each time the mobile device 50 moves, the position of the firewall having a filtering condition suitable for the mobile device is variably controlled. As a result, the firewall follows the displacement of the mobile device 50, and the firewall function can be applied to the moving terminal.

  Various methods are conceivable as a method for constructing a firewall at the destination of the mobile device 50. From the viewpoint of efficient firewall construction by suppressing the communication load as much as possible, an existing setting file is stored in the firewall device before the move. It is preferable to divert to the firewall device after moving. That is, the destination firewall apparatus 30 acquires the IP address of the firewall apparatus that already holds the setting file of the mobile device 50 from the home agent apparatus 10 and acquires the setting file from the firewall apparatus. As a result, the firewall function can be applied to the mobile device 50 after moving without transmitting / receiving the setting file between the home agent device 10 and the firewall device 30. Since the IP address has a smaller data capacity than the setting file, the communication load in the communication control system 1 can be reduced.

(Third embodiment)
Hereinafter, a third embodiment as still another aspect in the case where the mobile device 50 changes the connection destination firewall device due to movement will be described in detail with reference to the drawings. Here, since the configuration of the communication control system in the present embodiment is the same as the configuration of the communication control system detailed in the first embodiment, the same reference numerals are given to the respective components and the description thereof is omitted. . Further, in the present embodiment, it is assumed that the mobile device 50 is handed over from the firewall device 20 to the firewall device 30 as in the second embodiment.

With reference to FIG. 7, the firewall construction process executed by the communication control system 1 will be described.
The firewall construction process executed by the communication control system 1 in the present embodiment includes a plurality of steps that are common to the firewall construction process (see FIG. 6) described in detail in the second embodiment. Specifically, each step after S21 to S23, S29, and S30 in FIG. 7 corresponds to each step after S11 to S13, S19, and S20 shown in FIG.

Hereinafter, S24 to S28 (processing indicated by bold lines in FIG. 7), which are steps unique to the present embodiment, will be described. That is, the home agent device 10 transmits a setting file transfer request for the mobile device 50 to the source firewall device 20 in response to the reception of the binding update from the mobile device 50 (S24).
When the firewall device 20 receives the transfer request from the home agent device 10 (S25), the firewall device 221 once transmits the identification information and setting file of the mobile device 50 held in the firewall process 221 to the home agent device 10 (S26).

When the home agent device 10 receives the identification information and setting file of the mobile device 50 from the firewall device 20 (S27), the home agent device 10 transmits (transfers) the information to the destination firewall device 30 (S28). Thereafter, processing similar to S19 shown in FIG. 6 is executed. That is, the firewall name and the distribution standard are set in the packet distribution units 21 and 24.
Also by adopting such an aspect, the communication control system 1 can variably control the position of the firewall, and can follow the firewall from the movement source of the mobile device 50 to the movement destination.

(Fourth embodiment)
Hereinafter, a fourth embodiment as still another aspect in the case where the mobile device 50 changes the connection destination firewall device due to movement will be described in detail with reference to the drawings. Here, since the configuration of the communication control system in the present embodiment is the same as the configuration of the communication control system detailed in the first embodiment, the same reference numerals are given to the respective components and the description thereof is omitted. . In the present embodiment, it is assumed that the mobile device 50 is handed over from the firewall device 20 to the firewall device 30 as in the second and third embodiments.

With reference to FIG. 8, the firewall construction processing executed by the communication control system 1 will be described.
The firewall construction process executed by the communication control system 1 in the present embodiment includes a plurality of steps that are common to the firewall construction process (see FIG. 7) detailed in the third embodiment. Specifically, each step after S31 to S35, S37, and S38 in FIG. 8 corresponds to each step after S21 to S25, S29, and S30 shown in FIG.

  Hereinafter, S36 (processing indicated by a thick line in FIG. 8), which is a step specific to the present embodiment, will be described. In other words, in S36, the source firewall apparatus 20 receives the setting file transfer request from the home agent apparatus 10 and receives the identification information and setting file of the mobile device 50 held in the firewall process 221. Multicast.

  Here, the IP address notified from the home agent device 10 is used as the multicast destination address. That is, the home agent device 10 determines the prefix of the firewall device 20 to which the mobile device 50 was connected based on the binding update care-of address received in S33, and all the firewalls on the network indicated by the prefix. Select the device as the multicast destination. Thereafter, the home agent device 10 notifies the firewall device 20 of the selected multicast destination IP address together with the transfer request. As a result, the firewall apparatus 20 can execute multicast for the other firewall apparatuses 30 and 40 in the system.

The identification information and setting file of the mobile device 50 multicast from the firewall device 20 are received by the firewall device 30 on the network and used for generating a firewall. The identification information and setting file of the mobile device 50 multicast to the firewall device 40 can be used to generate a firewall when the mobile device 50 changes the connection destination to the firewall device 40.
Also by adopting such an aspect, the communication control system 1 can variably control the position of the firewall, and can follow the firewall from the movement source of the mobile device 50 to the movement destination.

(Fifth embodiment)
Hereinafter, the fifth embodiment as still another aspect in the case where the mobile device 50 changes the connection destination firewall device due to movement will be described in detail with reference to the drawings. Here, since the configuration of the communication control system in the present embodiment is the same as the configuration of the communication control system detailed in the first embodiment, the same reference numerals are given to the respective components and the description thereof is omitted. . In the present embodiment, it is assumed that the mobile device 50 is handed over from the firewall device 20 to the firewall device 30 as in the second to fourth embodiments.

With reference to FIG. 9, the firewall construction process executed by the communication control system 1 will be described.
The firewall construction process executed by the communication control system 1 in the present embodiment includes a plurality of steps that are common to the firewall construction process (see FIG. 6) described in detail in the second embodiment. Specifically, each step after S41, S44, S45 to S49 in FIG. 9 corresponds to each step after S11, S13, S16 to S20 shown in FIG.

  Hereinafter, steps S42 and S43 (processes indicated by bold lines in FIG. 9) that are unique to the present embodiment will be described. That is, in S42, the mobile device 50 transmits the binding update and the setting file (hereinafter referred to as “old setting file”) transmitted from the home agent device 10 before moving to the home agent device 10.

  In S43, the destination firewall apparatus 30 recognizes the IP address of the source firewall apparatus 20 with reference to the old setting file. Thereby, the firewall apparatus 30 can specify the identification information of the mobile device 50 and the transfer request destination of the setting file. Subsequently, the firewall device 30 receives the identification information and the setting file from the firewall device 20 that is the transfer request destination, and generates a firewall for the mobile device 50. Therefore, the position of the firewall can be variably controlled, and the firewall can follow the movement of the mobile device 50.

  As described above, in the second to fifth embodiments, information such as a setting file is transferred from the source firewall apparatus to the destination firewall apparatus. This purpose is as follows. .

  The first purpose is to take over this state when the firewall device has an internal state or a global variable. For example, when a mobile station receives a TCP (Transmission Control Protocol) connection signal, it stores data related to TCP, erases data when it receives a TCP disconnection signal, and discards data when it is not communicating. It works like this. When such an operation is applied to a mobile device, it is necessary to take over the data stored in the mobile device to the destination.

  The second purpose is to minimize the transfer of information. That is, regarding the access control list, even if it is information for one mobile device, the data capacity may increase. Further, the home agent device is often located at a position far from the mobile device (or firewall device), but the source firewall device and the destination firewall device at the time of handover may be located very close to each other. high. For this reason, as shown in the second, fourth, and fifth embodiments, if information is transmitted from the source firewall apparatus to the destination firewall apparatus, the network load may be reduced.

  It should be noted that the present invention is not limited to the above-described embodiment, and can be appropriately modified without departing from the spirit of the present invention. For example, in this embodiment, the subject that generates and transmits the firewall configuration file is the home agent device, but may be a server device configured separately from a device having a home agent function.

  In particular, when RADIUS (Remote Authentication Dial-In User Service) authentication is performed on a mobile device, the movement of the mobile device can be detected at the time of authentication. Therefore, the RADIUS server may generate and transmit a configuration file.

  Hereinafter, a mode in which a RADIUS server is used instead of the home agent device will be described. First, since RADIUS is a technology standardized by RFC2865, a detailed description is omitted and a basic procedure is briefly described. When there is a request for remote connection by telephone from the user terminal to the remote access device, the remote access device transmits an access request message to the RADIUS server. Normally, this access request message includes the user ID and password entered at the user terminal. The RADIUS server verifies the user based on the user ID and password, and returns a message (access permission message or access permission message) according to the verification result. The remote access device executes remote connection or disconnects the telephone according to this message.

  The protocol that defines the above procedure has been expanded as follows. One extension is to put various data in a packet as an access permission message. The various data includes, for example, a maximum time during which the user terminal can be remotely connected, an IP address used, a filtering ID, and the like. Another extension is to use RADIUS for other than remote access. For example, if a wireless LAN base station is used instead of a remote access device, RADIUS can be used for user authentication of the wireless LAN.

  Hereinafter, the configuration and operation of a communication control system to which RADIUS is applied will be described in consideration of the extended technology. The communication control system is configured to include at least a mobile device, a firewall device that also serves as a wireless base station (base station and firewall), and a RADIUS server. When receiving the broadcast information, the mobile device transmits a connection request to the base station to the base station / firewall that is the transmission source. Upon receiving the connection request, the base station / firewall transmits an access request to the RADIUS server.

  Upon receiving the access request, the RADIUS server performs user verification on the mobile device, and when access permission is obtained as a result of the verification, generates a firewall configuration file for the mobile device. Then, the setting file is placed on the access permission message (packet) and transmitted to the base station / firewall. The base station / firewall initializes the firewall process with reference to the configuration file, and then permits the mobile device to connect to the base station.

  That is, each time the mobile device moves, it obtains communication permission with a radio base station in a new communication area, and if communication permission is obtained, a firewall is set in this radio base station. Note that the operation of the RADIUS server related to the firewall setting is the same as the operation of the home agent device described in detail in each of the above embodiments, and the description thereof is omitted.

  Further, although the mobile device has been described as a single device in the present embodiment, it may be a mobile network in which a plurality of devices are connected by a line. In this case, the plurality of devices move at the same time and are recognized as one terminal from an external network such as the Internet. A device that connects the mobile network and the external network is, for example, a router.

It is a figure which shows the whole structure of a communication control system. It is a block diagram which shows the functional structure of a home agent apparatus. It is a block diagram which shows the functional structure of a firewall apparatus. It is a flowchart for demonstrating the firewall construction process in 1st Embodiment. It is a flowchart for demonstrating an IP packet filtering process. It is a flowchart for demonstrating the firewall construction process in 2nd Embodiment. It is a flowchart for demonstrating the firewall construction process in 3rd Embodiment. It is a flowchart for demonstrating the firewall construction process in 4th Embodiment. It is a flowchart for demonstrating the firewall construction process in 5th Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Communication control system, 10 ... Home agent apparatus, 11 ... Setting file original data storage part, 12 ... BU receiving part, 13 ... Setting file transmission part, 20, 30, 40 ... Firewall apparatus, 21, 24 ... Packet distribution part , 221, 222, 223 ... Firewall process, 23, 25 ... Output buffer, 50 ... Mobile device

Claims (7)

In a communication control device that transmits and receives data to and from a plurality of firewall devices that can be connected to a mobile device,
Receiving means for receiving from the mobile device a notification indicating that the mobile device is connected to the firewall device of the moving destination;
Request means for requesting the firewall setting information of the mobile device from the source firewall device, triggered by receiving the notification,
Transfer means for receiving the firewall setting information transmitted from the source firewall apparatus in response to a request by the request means, and transferring the firewall setting information to the destination firewall apparatus ;
Equipped with a,
The destination firewall device receives the firewall setting information transferred by the transfer means without requesting the firewall setting information from another device;
A communication control device. A communication control device according to claim 1 and a firewall device ,
The communication control system, wherein the mobile device receives a packet to be received via the firewall device. A communication control system comprising: a mobile device whose connection destination is changed from a source firewall device to a destination firewall device; and a communication control device that transmits and receives data to and from the source firewall device and the destination firewall device. There,
The communication control device is
Notification receiving means for receiving from the mobile device a notification indicating that the mobile device is connected to the firewall device of the moving destination;
Request means for requesting firewall setting information of the mobile device to the source firewall device, triggered by receiving the notification,
Transfer means for receiving the firewall setting information transmitted from the source firewall apparatus in response to a request by the request means, and transferring the firewall setting information to the destination firewall apparatus;
With
The source firewall device is
Response means for transmitting the retained firewall setting information of the mobile device to the communication control device when a request by the request means is received
With
The destination firewall device is
Setting information receiving means for receiving the firewall setting information transferred by the transfer means without requesting the firewall setting information of the mobile device from another device
Comprising
A communication control system characterized by that. A communication control system comprising: a mobile device whose connection destination has been changed from a source firewall device to a destination firewall device; and a communication control device that transmits and receives data to and from the source firewall device and the destination firewall device. There,
The communication control device is
Notification receiving means for receiving from the mobile device a notification indicating that the mobile device is connected to the firewall device of the moving destination;
Request means for requesting the source firewall device to transmit firewall setting information of the mobile device to the destination firewall device, upon receiving the notification,
With
The source firewall device is
Transmission means for transmitting the firewall setting information of the mobile device held to the firewall device of the movement destination when the request by the request means is received
With
The destination firewall device is
Setting information receiving means for receiving the firewall setting information transmitted by the transmitting means without requesting the firewall setting information of the mobile device from another device
Comprising
A communication control system characterized by that. A data communication method executed by a communication control device that transmits and receives data to and from a plurality of firewall devices to which a mobile device can be connected,
A receiving step in which the receiving means of the communication control device receives from the mobile device a notification indicating that the mobile device is connected to a destination firewall device;
Requesting means for requesting the firewall setting information of the mobile device from the source firewall device, when the request means of the communication control device receives the notification,
A transfer step in which transfer means of the communication control device receives the firewall setting information transmitted from the source firewall device in response to a request in the request step, and transfers the firewall setting information to the destination firewall device; ,
Including
The destination firewall apparatus receives the firewall setting information transferred in the transfer step without requesting the firewall setting information from another apparatus.
A data communication method characterized by the above. A communication control system comprising: a mobile device whose connection destination has been changed from a source firewall device to a destination firewall device; and a communication control device that transmits and receives data to and from the source firewall device and the destination firewall device; A data communication method executed by
A notification receiving step in which the notification receiving means of the communication control device receives from the mobile device a notification indicating that the mobile device is connected to the destination firewall device;
Requesting means for requesting the firewall setting information of the mobile device to the source firewall device, triggered by the request means of the communication control device receiving the notification,
When the response unit of the source firewall apparatus receives the request in the request step, the response step of transmitting the firewall setting information of the mobile device that is held to the communication control apparatus;
A transfer step in which the transfer means of the communication control device receives the firewall setting information transmitted in the response step and transfers the firewall setting information to the destination firewall device;
A setting information receiving unit for receiving the firewall setting information transferred in the transfer step without requesting the firewall setting information of the mobile device from another device, by the setting information receiving unit of the destination firewall device;
A data communication method comprising: A communication control system comprising: a mobile device whose connection destination has been changed from a source firewall device to a destination firewall device; and a communication control device that transmits and receives data to and from the source firewall device and the destination firewall device; A data communication method executed by
A notification receiving step in which the notification receiving means of the communication control device receives from the mobile device a notification indicating that the mobile device is connected to the destination firewall device;
Request that the requesting means of the communication control device requests the source firewall device to transmit the firewall setting information of the mobile device to the destination firewall device when the notification is received Steps,
When the transmission means of the source firewall apparatus receives the request in the request step, a transmission step of transmitting the firewall setting information of the mobile device that is held to the destination firewall apparatus;
The setting information receiving unit of the destination firewall device receives the firewall setting information transmitted in the transmission step without requesting the firewall setting information of the mobile device from another device; and
A data communication method comprising:

Images