JP4950705B2 - Communication control system and communication control method - Google Patents

Description

  The present invention relates to a communication control system and a communication control method, and more particularly to a communication control system and a communication control method having a firewall function.

In an internal network such as a LAN (Local Area Network), in order to detect and block unauthorized access from an external network such as the Internet, a firewall that determines whether or not data that has reached the boundary of each network is allowed to pass according to predetermined filtering conditions Is installed. In many cases, a firewall is provided in the form of software and is used by being incorporated in a router or a proxy server. However, since high performance is required, dedicated hardware may be used (for example, patent documents). 1).
JP 10-70576 A

  In mobile terminal devices such as terminals and mobile phones that perform dial-up connection, the location for connecting to an external network differs depending on the situation and application, and it is difficult to specify an appropriate and fixed installation location of the firewall. In addition, since the mobile terminal device is connected to the external network via the mobile communication network, the mobile terminal device is connected to the external network in a somewhat secure environment. For this reason, an attack from the Internet can be prevented at the gateway of the mobile communication network, so that even if the mobile terminal device is not protected by a firewall, there is almost no trouble with it.

  However, in recent years, mobile terminal devices capable of wireless LAN connection have been developed, and it is assumed that such mobile terminal devices are open to the public Internet without limitation. For this reason, it has become necessary for mobile terminal devices to take measures against unauthorized access (investigation and attacks for attacks) from the Internet side.

  The present invention has been made in view of the above points, and a communication control system and a communication control method capable of preventing unauthorized access from the network side even in a mobile terminal device connectable to an insecure external network The purpose is to provide.

When the communication control system of the present invention receives a request for use of a specific service from a mobile communication center having a management unit for managing a security policy for each application, and the mobile communication center receives the specific A mobile having communication means for making a connection inquiry about a service application, receiving a security policy corresponding to the application of the specific service from the mobile communication center , and firewall means for releasing network resources in accordance with the security policy comprising a terminal device, wherein the security policy specifies the application available communication ports and / or sequence of the specific service, the firewall means, the finger by the security policy Characterized in that to permit communication with a communication port and / or sequence is.

  According to this configuration, even in a situation where the mobile terminal device that can be connected to an insecure external network is opened to the public Internet indefinitely, unauthorized access from the network side (investigation for attacks) And attacks). Also, with this configuration, the user cannot be involved in the firewall rules, so that it is possible to prevent the user from being inadvertently opened to the public Internet indefinitely.

In the communication control system of the present invention, the mobile terminal device determines whether the specific service is provided in a secure communication network or an insecure communication network, and is provided in the insecure communication network. If determined, it is preferable to make the connection inquiry about the application of the specific service .

  In the communication control system of the present invention, it is preferable that the mobile terminal device and the mobile communication center have application control means for starting an application for connection inquiry. In this case, it is preferable that the firewall unit releases network resources in response to a request from the connection inquiry application side.

The communication control method of the present invention includes a step of making a connection inquiry about an application of the specific service to the mobile communication center when the mobile terminal device receives a request for use of the specific service from the user. The mobile communication center providing a security policy corresponding to the application of the specific service to the mobile terminal device in response to the connection inquiry from the mobile terminal device; Releasing network resources in accordance with the security policy, wherein the security policy designates a communication port and / or sequence that can be used by the application of the specific service and releases the network resource. And the mobile terminal device Characterized in that to allow communication with the specified communication port and / or the sequence at tee policy.

In the communication control method of the present invention, in the step of performing the connection inquiry, the mobile terminal device determines whether the specific service is provided in a secure communication network or an insecure communication network, and It is preferable to make the connection inquiry about the application of the specific service when it is determined that the service is provided by a communication network that is not. In the communication control method of the present invention, the mobile terminal device and the mobile communication center include a step of starting a connection inquiry application, and in the step of releasing the network resource, the mobile terminal device includes the connection inquiry. Network resources may be released in response to a request from the application side.

  According to these methods, even in a situation where the mobile terminal device that can be connected to an unsecured external network is open to the public Internet indefinitely, unauthorized access from the network side (for attack) Can defend against investigations and attacks). Also, with this configuration, the user cannot be involved in the firewall rules, so that it is possible to prevent the user from being inadvertently opened to the public Internet indefinitely.

  According to the present invention, the mobile terminal device issues a connection inquiry to the mobile communication center, the mobile communication center provides a security policy to the mobile terminal device, and the mobile terminal device allocates network resources according to the security policy. Since it is opened, it is possible to provide a communication control system and a communication control method that can prevent unauthorized access from the network side even in a mobile terminal device that can be connected to an insecure external network.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 is a diagram showing a schematic configuration of a communication control system according to an embodiment of the present invention. The system shown in FIG. 1 includes a mobile terminal 1 according to the present invention, a mobile communication center 3 connected to the mobile terminal 1 via a mobile communication network 2, a network such as the mobile communication center 3 and the Internet 4. Is mainly composed of a CP (Contents Provider) server 5 and an access point (AP) 6 of an external network (in this case, a wireless LAN) different from the mobile communication network 2.

  The mobile terminal 1 also has an operating system (mobile device OS), and a browser function, a viewer function, a JAM (Java (registered trademark) Application Manager) and other functions operate on the mobile device OS.

  The mobile communication network 2 is an operator network of the mobile terminal 1. The mobile communication network 2 includes a mobile packet communication network in addition to a normal mobile communication network. The mobile communication network 2 has an operator server, for example, an i-mode (registered trademark) server, and has a gateway function for connecting to the Internet. Specifically, an information distribution function, a mail transmission / reception function, a mail storage function , A contract customer management function, an information provider management function, and an information fee billing function.

  The network includes the Internet 4 and other networks such as LAN and WAN. The CP server 5 is a server connected to the Internet 4 and distributes various contents. AP 6 is a normal access point in a wireless LAN. Note that the communication between the mobile terminal 1 and the CP server 5 and the communication between the mobile terminal 1 and the AP 6 are the same as those normally performed, and the connection sequence thereof is omitted. .

  FIG. 2 is a block diagram showing a configuration of mobile terminal 1 of the communication control system according to the embodiment of the present invention. The mobile terminal 1 shown in FIG. 2 includes a control unit 11 that controls the entire apparatus, a communication control unit 12 that performs wireless communication with the mobile communication center 3 and the AP 6, and a security policy provided from the mobile communication center 3. A storage unit 13 for storing network resources, a firewall unit 14 for releasing network resources in accordance with a security policy provided from the mobile communication center 3, an application control unit 15 for starting a connection inquiry application, and mobile communication for all communications It is mainly composed of a mode changing unit 16 that changes a mode between a mode for inquiring the center and a mode for inquiring the mobile communication center for insecure communication.

  When the user requests use of a specific service, the control unit 11 instructs the communication control unit 12 to perform wireless communication with the mobile communication center 3 and the AP 6. At this time, the control unit 11 instructs the application control unit 15 to activate the connection inquiry application. The control unit 11 stores the security policy in the storage unit 13 when the security policy is provided from the mobile communication center 3. Further, the control unit 11 instructs the firewall unit 14 to release network resources in accordance with the security policy provided from the mobile communication center 3. Further, the control unit 11 instructs the mode changing unit 16 to change the mode between the mode in which the mobile communication center is inquired about insecure communication when the user inputs.

  The communication control unit 12 transmits a connection inquiry request signal to the mobile communication center 3 and receives a security policy from the mobile communication center 3. Further, the communication control unit 12 performs wireless LAN communication with the AP 6. The procedure of this wireless LAN communication is the same as the standard procedure at the time of connection in IEEE802.11.

  The storage unit 13 stores at least the security policy provided from the mobile communication center 3. The storage unit 13 includes a ROM, a RAM, a hard disk, and the like.

  The firewall unit 14 releases network resources according to the security policy provided from the mobile communication center 3. For example, the communication port is opened according to the security policy. As a result, the user can use a specific service. Instead of releasing the network resource according to the security policy provided from the mobile communication center 3, the firewall unit 14 may release the network resource according to a request from the application side for connection inquiry.

  The application control unit 15 executes an application program created in an application language (for example, Java (registered trademark) language) in response to an instruction from the control unit 11. The application control unit 15 activates a connection inquiry application with the mobile communication center 3 to be described later as necessary. The mode changing unit 16 changes the mode between a mode in which the mobile communication center is inquired about all communications and a mode in which the mobile communication center is inquired about unsecured communication in accordance with an instruction from the mobile communication center 3 according to user input.

  FIG. 3 is a block diagram showing the configuration of the mobile communication center 3 of the communication control system according to the embodiment of the present invention. The mobile communication center 3 shown in FIG. 3 includes a control unit 31 that controls the entire apparatus, a communication control unit 32 that performs communication between the mobile terminal 1 and the CP server 5, and an application that manages a security policy for each application. It mainly comprises a management database 33 and an application control unit 34 that activates a connection inquiry application.

  When the connection inquiry application command is sent from the mobile terminal 1, the control unit 31 instructs the application control unit 34 to activate the connection inquiry application. Further, when there is a connection inquiry from the mobile terminal 1, the control unit 31 extracts a security policy corresponding to an application of a specific service that the mobile terminal 1 intends to use from the application management database 33. Then, the communication control unit 32 is instructed to transmit the extracted security policy to the mobile terminal 1.

  The communication control unit 32 receives a connection inquiry request signal from the mobile terminal 1 and transmits a security policy to the mobile terminal 1. In addition, the communication control unit 32 communicates with the CP server 5.

  The application management database 33 manages security policies for each application. The application management database 33 has a management table as shown in FIG. This management table associates network resources (here, communication ports) and sequences (sequences in the mobile terminal 1) for each application.

  The application control unit 34 executes an application program created in an application language (for example, Java (registered trademark) language) in response to an instruction from the control unit 31. The application control unit 34 activates an application for connection inquiry with the mobile terminal 1 as necessary.

  Next, a communication control method in the communication control system having the above configuration will be described. FIG. 5 is a sequence diagram for explaining the communication control method according to the embodiment of the present invention.

  First, when the user requests use of a specific service, the mobile terminal 1 issues a connection inquiry to the mobile communication center 3. That is, the security policy is inquired (ST1). Specifically, in the mobile terminal 1, when an input for use of a specific service is performed by the user, the control unit 11 instructs the application control unit 15 to start the connection inquiry application, and application control is performed. The unit 15 activates the connection inquiry application. At this time, a command signal is sent from the mobile terminal 1 to the mobile communication center 3, and the control unit 31 instructs the application control unit 34 to start an application for connection inquiry by the command signal, and the application control unit 34 Start the connection inquiry application.

  When the mobile communication center 3 receives a connection inquiry request signal for an application of a specific service from the mobile terminal 1, the control unit 31 applies a security policy corresponding to the application of the service related to the inquiry, for example, a communication port or a sequence. Extract from the management database 33. Then, the control unit 31 instructs the communication control unit 32 to transmit the extracted security policy to the mobile terminal 1. The communication control unit 32 transmits the security policy to the mobile terminal 1 (ST2).

  Next, when the mobile terminal 1 receives the security policy, the control unit 11 stores the security policy in the storage unit 13. Next, the control unit 11 instructs the firewall unit 14 to confirm the security policy, and the firewall unit 14 confirms the security policy (ST3). Then, the firewall unit 14 releases network resources according to the security policy (ST4). For example, the communication port is opened according to the security policy. As a result, the user can use a specific service. Thereafter, access is made to the CP server 5 of the service (ST5), and information is transmitted from the CP server 5 (ST6).

  Thus, according to the communication control method according to the present embodiment, the mobile terminal 1 makes a connection inquiry to the mobile communication center 3, the mobile communication center 3 provides a security policy to the mobile terminal 1, Since the mobile terminal 1 releases network resources in accordance with the security policy, even in a situation where the mobile terminal 1 can be connected to an unsecured external network without restriction to the public Internet, the network side Can be protected against unauthorized access (surveys and attacks for attacks). Also, with this configuration, the user cannot be involved in the firewall rules, so that it is possible to prevent the user from being inadvertently opened to the public Internet indefinitely.

  In this embodiment, a case is described in which a connection inquiry is made to the mobile communication center for all connections, but in the present invention, this communication control method is selectively applied according to the level of security. You may do it. For example, as described below, when the mode changing unit 16 sets the mode in which the mobile communication center is inquired about unsecured communication and the security is relatively low, that is, the possibility of unauthorized access from the network side is high. The communication control method may be applied to the above.

  Next, a case where the mobile terminal 1 has a mode for inquiring the mobile communication center for all communications and a mode for inquiring the mobile communication center for insecure communications will be described. FIG. 6 is a flowchart for explaining a communication control method involving mode change according to the embodiment of the present invention.

  This system is effective when it is assumed that the mobile terminal 1 is open to the public Internet without limitation. For this reason, when the mobile terminal 1 connects to a secure network, for example, when using a service in a mobile communication network, it is considered that a firewall is unnecessary. Therefore, it is determined whether the communication network is secure or not secure, and the firewall function is exhibited accordingly.

  In this case, when the user makes a service request (ST11), it is determined whether the application of the service is a secure communication network (ST12). This determination is made by determining the communication method in the communication control unit 12. For example, when the service is a mobile communication network (for example, i-mode (registered trademark) service), the mobile communication network is determined to be a secure communication network, and when the service is a wireless LAN, the communication network is not secure. Judge.

  Therefore, when it is determined that the communication network is not secure, a connection inquiry is made as described above, a security policy is received, and network resources are released according to the security policy. That is, an application for connection inquiry is started in the mobile terminal 1 and the mobile communication center 3 (ST13), the mobile terminal 1 receives the security policy from the mobile communication center 3 (ST14), and the mobile terminal 1 The policy is confirmed (ST15), and network resources are released according to the security policy (ST16). Thereafter, the mobile terminal 1 starts communication with the CP server 5 of the target service (ST17).

  On the other hand, in the case of secure communication, in the mode in which the mobile communication center is inquired for all communication, the application control unit 15 activates the communication application (ST18) and starts communication (ST19).

  Even in such a communication control method, even in a situation where the mobile terminal that can be connected to an insecure external network is open to the public Internet indefinitely, unauthorized access from the network side (due to an attack) Can be protected. Also, with this configuration, the user cannot be involved in the firewall rules, so that it is possible to prevent the user from being inadvertently opened to the public Internet indefinitely.

  The present invention is not limited to the embodiment described above, and can be implemented with various modifications. Although the case where the network resource is a communication port has been described in the above embodiment, the network resource may be other than the communication port in the present invention. In the above embodiment, even when the same service is used, the mobile communication center will be provided with a security policy every time. When an inquiry is made, access may be made without a connection inquiry when the next service is used within the validity period. In this case, in the management table of the mobile communication center, in addition to the network resource and the sequence, an expiration date is associated with each application. Other modifications may be made as appropriate without departing from the scope of the object of the present invention.

It is a figure which shows schematic structure of the communication control system which concerns on embodiment of this invention. It is a block diagram which shows the structure of the mobile terminal of the communication control system which concerns on embodiment of this invention. It is a block diagram which shows the structure of the mobile communication center of the communication control system which concerns on embodiment of this invention. It is a figure which shows the management table of the security policy which a mobile communication center hold | maintains. It is a sequence diagram for demonstrating the communication control method which concerns on embodiment of this invention. It is a flowchart for demonstrating the communication control method accompanied by the mode change which concerns on embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Mobile terminal 2 Mobile communication network 3 Mobile communication center 4 Internet 5 CP server 6 AP
DESCRIPTION OF SYMBOLS 11,31 Control part 12,32 Communication control part 13 Storage part 14 Firewall part 15,34 Application control part 16 Mode change part 33 Application management database

Claims (7)

A mobile communication center having a management means for managing a security policy for each application;
When a request for use of a specific service is received from a user, a connection inquiry about the application of the specific service is made to the mobile communication center, and security corresponding to the application of the specific service is sent from the mobile communication center. A communication means for receiving a policy, and a mobile terminal device having a firewall means for releasing network resources according to the security policy,
The security policy specifies communication ports and / or sequences that can be used by the application of the specific service,
The communication control system according to claim 1, wherein the firewall means permits communication at a communication port and / or sequence specified by the security policy . The mobile terminal device determines whether the specific service is provided by a secure communication network or an insecure communication network, and when it is determined that the specific service is provided by an insecure communication network, the specific service The communication control system according to claim 1 , wherein the connection inquiry about the application is performed .   The communication control system according to claim 1, wherein the mobile terminal device and the mobile communication center have application control means for starting an application for connection inquiry.   4. The communication control system according to claim 3, wherein the firewall means releases network resources in response to a request from the connection inquiry application side. When the mobile terminal device receives a request for use of a specific service from a user, the mobile communication center makes a connection inquiry about the application of the specific service to the mobile communication center;
The mobile communication center providing a security policy corresponding to the application of the specific service to the mobile terminal device in response to the connection inquiry from the mobile terminal device;
The mobile terminal device releasing network resources according to the security policy ,
The security policy specifies communication ports and / or sequences that can be used by the application of the specific service,
In the step of releasing the network resource, the mobile terminal device allows communication in a communication port and / or sequence designated by the security policy . In the step of making the connection inquiry, the mobile terminal device determines whether the specific service is provided by a secure communication network or an insecure communication network, and determines that the specific service is provided by an insecure communication network. 6. The communication control method according to claim 5, wherein if the connection is made, the connection inquiry about the application of the specific service is performed. The mobile terminal device and the mobile communication center comprise a step of starting an application for connection inquiry ,
In the step of opening the network resources, said mobile terminal device, the communication of claim 5 or claim 6, characterized in that to release the network resources in response to a request from the application side for the connection query Control method.

Images