JP2002247111A - Illegal access preventing method, security management device, gateway device and terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method that can prevent an external unauthorized access to a private network and a device that realizes the method. SOLUTION: When a terminal 20 transmits a packet to an in-home network 10, a gateway device 12 transmits packet information and self-authentication data of the packet to a security management device 24. The security management device 24 requests a sender of the packet to transmit its authentication data. The terminal 20 transmits the authentication data to the device 24 in response to the request. The security management device 24 checks whether or not the sender has a legitimate right based on the received authentication data and gives a filtering release instruction to the gateway device 12 when the sender has the legitimate right or informs a 2nd ISP 22 about warning when the security management device 24 discriminates the unauthorized access by the sender. Thus, the access management can be commissioned to the outside.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for preventing unauthorized access to a predetermined network. Furthermore, the present invention relates to various communication devices that realize this method.

[0002]

2. Description of the Related Art In recent years, networks have developed and so-called home networks have been widely used in homes. In this home network, a plurality of information home appliances are connected to each other to realize information sharing and the like. The home network is often connected to an external Internet or the like.

It is convenient for a user of this home network to access the home network from outside. For example, if the information home appliance in the home network can be accessed from the Internet, the information of the home network can be taken out from the outside, so that highly convenient operation is possible. Particularly, in recent years, mobile phones and the like that can access the Internet have become widespread. If such a mobile phone can access a home network via the Internet, more convenient operation is possible.

[0004]

However, if the access to the home network from the outside is unrestricted without permission, a malicious third party flows into the home network and the privacy in the home is infringed. May occur.

Therefore, it is desirable to take some means for monitoring access between the home network and the external Internet or the like.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and an object of the present invention is to provide a method capable of preventing unauthorized access to a private network from the outside and an apparatus for implementing the method.

[0007]

In order to solve the above-mentioned problems, the present invention relates to a method of connecting an external network and an internal network with a gateway device, and performing unauthorized access from the external network to a device on the internal network. In a method for preventing unauthorized access, when a data packet is transmitted from the external network to a device in the internal network, packet information of the data packet and self-authentication data of the gateway device A packet information transmitting step of transmitting to the security management device on the external network, the security management device, based on the packet information, a requesting step of requesting the sender of the data packet sender-side authentication data, In response to the request, the sender is Based on the sender-side authentication data transmitting step of transmitting the sender-side authentication data to the security management device, the transmitted sender-side authentication data, and the self-authentication data of the gateway device, An authentication step of determining whether or not access to the internal network is permitted; and, as a result of the authentication step, when the sender is permitted to access the internal network, the security management device And instructing the gateway device to allow the data packet to flow into the internal network.

[0008] With this configuration, a person who has a right to access the internal network can transmit a data packet to the internal network.

[0009] Further, according to the present invention, when the sender is not permitted to access the internal network as a result of the authentication step, the security management device allows the administrator managing the sender to communicate with the administrator. And a warning notifying step of notifying a warning.

[0010] With this configuration, a warning can be issued to the administrator when an unauthorized access is made.

[0011] Further, according to the present invention, when the sender-side authentication data has not been transmitted within a predetermined period after executing the requesting step, the security management device includes:
A second warning notification step of notifying a warning to a manager who manages the sender.

With this configuration, even when the authentication data is not transmitted, it is determined that an unauthorized access has been made,
A warning can be issued to the administrator.

Further, the present invention is the method for preventing unauthorized access, wherein the external network is the Internet and the internal network is a home network.

With this configuration, it is possible to prevent unauthorized access to the home network from the Internet.

The present invention is also a method for preventing unauthorized access, wherein the packet information is any one of an IP address, a TCP information, and a UDP access port number of a sender of the data packet.

As described above, it is possible to specify the sender of a packet by using the IP address and the like.

Further, the present invention is the method for preventing unauthorized access, wherein the administrator managing the sender is an Internet service provider used by the sender.

With such a configuration, it is possible to notify the Internet service provider that there is a person who has unauthorized access among its users.

The present invention also relates to a security management device for managing another communication device connected via a network, comprising: an interface means for connecting to the network; and access to the other communication device. Storage means for storing a table in which authentication data of authorized persons is described; and when the other communication device requests authentication of a sender who has transmitted a data packet to the other communication device, the transmission is performed. Requesting the person to send their authentication data,
Control means for inspecting whether or not the transmitted authentication data is described in the table, and if described, issuing a command to permit access to the other communication device; A security management device characterized by including:

According to such a configuration, it is possible to entrust the authentication work of whether or not the sender of the packet has a legitimate right from another communication device, thereby reducing the management burden of the other communication device. Can be reduced.

Further, according to the present invention, the control means notifies the administrator of the sender of a warning when the transmitted authentication data is not described in the table. It is a management device.

With this configuration, a warning can be issued to the administrator when the authentication data is incorrect.

Further, according to the present invention, the control means notifies the administrator of the sender of a warning when the authentication data is not transmitted within a predetermined period after requesting the transmission of the authentication data. A security management device.

With such a configuration, even if the authentication data has not been transmitted within a predetermined period, it is possible to judge that the access is unauthorized and issue a warning to the administrator.

Further, the present invention is the security management device, wherein the network is the Internet, and the other communication device is a gateway device.

With such a configuration, the gateway device can outsource determination of unauthorized access from the Internet to an external security management device.

Further, the present invention is the security management device, wherein the administrator is an Internet service provider to which the sender connects.

With such a configuration, it is possible to notify the Internet service provider that there is an unauthorized access among the users.

Further, the present invention is a gateway device for connecting an external network and an internal network,
A first interface unit connected to the external network; a second interface unit connected to the internal network; a filtering unit for filtering data packets from the external network to the internal network; and controlling the filtering unit. Control means for transmitting packet information of the packet and self-authentication data of the gateway device to another management device when a data packet destined for the internal network is transmitted from the external network; Control means for canceling the filtering of the filtering means and permitting the data packet to flow to the internal network when a command to cancel the filtering is transmitted from the device. A gateway device that.

With this configuration, it is possible to obtain a gateway device capable of outsourcing a determination as to whether or not a packet has been transmitted from a person who has a legitimate right.

Further, the present invention is the gateway device, wherein the external network is the Internet, and the internal network is a home network.

With such a configuration, it is possible to outsource the determination as to whether or not the access made from the Internet to the home network is legitimate.

Further, the present invention is the gateway device, wherein the packet information is any one of an IP address or TCP information of a sender of the data packet or a UDP access port number.

With such a configuration, an IP address or the like can be used as information for identifying a sender.

Further, the present invention is the gateway device, wherein the management device is a security management device connectable via the external network.

With this configuration, the security management device can determine whether the sender is legitimate without accessing the inside of the internal network.

Further, according to the present invention, in a terminal device connectable to a network, an interface means for connecting to the network and a request for transmission of authentication data on the terminal device side from another management device via the network are provided. And a control unit for transmitting the authentication data to the other management device when the terminal device has received the authentication data.

With this configuration, the authentication data can be transmitted to the management device.

[0039]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will be described below with reference to the drawings.

Embodiment 1 FIG. 1 shows an overall configuration diagram of a communication system according to Embodiment 1 of the present invention.

As shown in FIG. 1, in the first embodiment, the home network 10 is connected to a first Internet service provider 16 via a gateway device 12. Then, via the first Internet service provider 16, the Internet 1
8 is connected. In FIG. 1, the Internet service provider is abbreviated as “ISP”.

The terminal 20 of a person who wants to access the home network 10 from the outside is connected to a second Internet service provider 22. And
The terminal 20 is connected to the Internet 18 via the second Internet service provider 22. Second Internet Service Provider 22
Also, in FIG. 1, the description is abbreviated as “ISP”. Hereinafter, Internet service providers are often referred to as "ISPs".

A typical example of a case where an attempt is made to connect to the home network from the outside is when a person in the home wants to know information inside the home from outside.

In this case, the terminal 20 may be, for example, a personal computer. In recent years, since mobile phones and the like that can be connected to the Internet 18 have been widely used, various mobile communication devices such as a mobile phone may be used as the terminal 20. Note that the terminal 20 corresponds to the “terminal device” of the present invention.

Further, a security management device 24 is connected to the Internet 18. The security management device 24 manages access to the gateway device 12 for each gateway device 12.

The security management device 24 includes self-authentication data of the gateway device 12 managed by itself,
A table (database) describing authentication data of the terminal 20 that is permitted to access the gateway device 12 is stored. FIG. 2 is a conceptual diagram of such a table.
Is shown in As shown in this figure, this table is a table provided for each gateway device 12, and the terminal 2 which is permitted to access the gateway device 12.
It is a table describing the authentication data of 0.

Note that the authentication data of the terminal 20 is the “sender-side authentication data” or the “terminal-side authentication data” of the present invention.
Is equivalent to

Next, the home network 1
The operation of accessing 0 will be described. FIG. 3 is a flowchart showing the flow of the operation at this time.

First, in step S3-1, a data packet (hereinafter, simply referred to as a packet) for the home network 10 is transmitted from the terminal 20. This packet first arrives at the second ISP 22 (indicated by (1) in FIG. 1). Subsequently, the packet is sent to the second IS
From P22, through the Internet 18, the first I
It arrives at SP14 (indicated by (2) in FIG. 1). Then, the packet arrives from the first ISP 14 to the gateway device 12 of the home network 10 (indicated by (3) in FIG. 1).

In step S3-2, the gateway device 12 transmits the packet information of the transmitted packet and the self-authentication data to the security management device 24.
Send to This data first arrives at the first ISP 16 (shown by (4) in FIG. 1), and further arrives at the security management device 24 via the Internet 18 (shown by (5) in FIG. 1).

Here, the self-authentication data is data for the gateway device 12 to identify itself, and the security management device 24 uses this self-authentication data to identify which gateway device 12 it is. it can. The packet information is data that can specify a sender (sender) of the packet, and can use an IP address, an access port number of TCP or UDP, a packet content, or the like.

In step S3-3, the security management device 24 specifies the sender of the packet based on the packet information, and requests authentication data from the sender. The request message arrives at the second ISP via the Internet 18 (indicated by (6) in FIG. 1), and is transmitted from the second ISP to the terminal 20 (FIG. 1).
(Indicated by (7))).

The process branches from step S3-4 depending on whether the terminal 20 transmits the authentication data in response to the request. When transmitting the authentication data, the process proceeds to step S3-5. On the other hand, if the authentication data cannot be transmitted for some reason, the security management device 24 cannot receive the authentication data. If the security management device 24 has not received the authentication data within the predetermined period, the process proceeds to step S3-8.

In step S3-5, the authentication data is transmitted from the terminal 20 to the security management device 24. The authentication data is first transmitted from the terminal 20 to the second I
SP (indicated by (8) in FIG. 1), and
Security management device 24 via Internet 18
(Indicated by (9) in FIG. 1).

In step S3-6, it is checked whether the sender has the right to access the gateway device 12 based on the authentication data sent from the security management device 24. This check is performed by searching the table described in FIG. First, the security management device 24 finds a table of the gateway device 12 based on the self-authentication data of the gateway device 12 (FIG. 2). Next, it is checked whether or not the authentication data transmitted by the sender of the packet exists in the table. As a result of this inspection, if the authentication data exists in the table, the sender of the packet
Is determined to have a legitimate right to access the home network 10 via the network, and the process proceeds to step S3-7. On the other hand, if the authentication data does not exist in the above table, it is determined that the packet sender does not have a legitimate right, and the process proceeds to step S3-8.

In step S3-7, the security management device 24 issues a filtering cancellation command to the gateway device 12. This release instruction reaches the first ISP 16 (shown by (10) in FIG. 1) via the Internet 18 and reaches the gateway device 12 from the first ISP 16 (shown by (11) in FIG. 1). ). Upon receiving the release command, the gateway device 12 supplies the packet transmitted by the packet sender to the home network 10.

On the other hand, in step S3-8, the security management device 24 determines that the access is unauthorized, and the second ISP 22 to which the sender of the packet is connected.
Is notified (shown by (12) in FIG. 1). As described above, the warning is notified in step S3-8 when the authentication data is not received by the security management device 24 within the predetermined period, or when the authentication data is incorrect (in the table). Was not in)
Is either case.

As described above, according to the first embodiment, only a person who has a right to access the home network 10 can be permitted to flow into the home network 10. In particular, since the judgment can be entrusted to the external security management device 24, there is an advantage that the burden on the gateway device 12 itself can be reduced.

Furthermore, not only is unauthorized access eliminated, but if there is unauthorized access, a warning is sent to the ISP, so that an effect of suppressing unauthorized actions can be expected.

Next, the configuration of the security management device 24 will be described with reference to FIG. As shown in this figure, the security management device 24 includes storage means 40 that stores the number of gateway devices 12 that manage the table shown in FIG. 2 described above. Further, an interface 42 for connecting to the Internet 18 is provided. Further, a control unit 44 for executing the operation described with reference to FIG. 3 is provided.

The control means 44 is composed of a program and a processor for executing the program, and the program controls each operation described above.

(1) That is, the self-authentication data from the external gateway 12 and the gateway 1
When the packet information and the packet information of the packet transmitted to 2 are transmitted to the security management device 24 via the interface 42, authentication data is requested from the sender of the packet based on the packet information. Then, the authentication data is received.

(2) Next, a table of the gateway device 12 is found from the self-authentication data, and it is checked whether or not the authentication data exists in the table.

(3) If the authentication data exists in the table, the gateway device 12 is instructed to release the filtering of the packet and to permit the packet to flow into the home network 10.

(4) On the other hand, if the authentication data does not exist in the table or if the authentication data has not been sent within a predetermined time, a warning is sent to the administrator of the packet sender.

The storage means 40 may be a magnetic disk such as a hard disk, a CDROM, a DVDROM, or the like.
Various storage means such as various optical disks can be used. Further, the security management device 24 can manage a plurality of gateway devices 12. In that case, a plurality of tables created for each of the plurality of gateway devices 12 are stored in the storage unit 40.

Next, the configuration of the gateway device 12 will be described with reference to FIG. As shown in FIG.
Is provided with an interface 50 for connecting to the home network 10 and an interface 52 for connecting to the Internet 18.

The gateway device 12 includes a filtering means 54 for filtering packets coming from the Internet 18. The filtering means 54 also performs filtering of packets going from the home network 10 to the Internet 18.

The gateway device 12 has a control means 56. The control means 56 is a means for setting the definition of a packet to be filtered, the content of the filtering, and the like, and includes a program and a processor for executing the program.

Further, the control means 56 executes the operation described with reference to FIG. 3 according to this program.

(1) That is, when a packet is transmitted from the Internet 18 via the interface 52, the packet information and the self-authentication data are transmitted to the external security management device 24. Here, the self-authentication data may be any data as long as the data can identify the gateway device 12.

(2) Next, the security management device 2
If a filtering cancellation command is transmitted from the control unit 4, the filtering unit 54 is controlled to permit the inflow to the home network 10.

(3) Unless such a release command is received,
Filtering means continues to filter the packet. That is, the inflow to the home network 10 is not permitted. In this way, it is possible to prevent the inflow of packets due to unauthorized access.

The filtering means 54 is preferably constituted by software, but is preferably constituted by hardware in order to improve performance (improve processing speed). The interfaces 50 and 52 can use the existing configuration as they are as interface means with the network.

Next, the configuration of the terminal 20 will be described with reference to FIG. As shown in this figure, the terminal 20 includes an interface 60 for connecting to the second ISP 22.

The terminal 20 has a display means 62 for displaying predetermined information to the user and an input means 64 for the user to input information. These display means 6
2 and the input means 64 have a conventionally well-known configuration.

Further, the terminal 20 has control means 66. The control means 66 includes a program and a processor that executes the program. Then, by this program, the control means 66 executes the operation described with reference to FIG. That is, when the security management device 24 requests authentication data of the terminal 20 via the Internet 18, the control means 66 transmits the authentication data to the security management device 24 in response to the request.

Second Embodiment In the first embodiment, the example of the home network 10 has been described, but any network may be used as long as it is a private network. Embodiment 1
In the above, the example of the Internet 18 is shown, but any network may be used. The present invention can be easily applied to any network.

Further, in the first embodiment, the case where the sender of the packet accesses through the ISP has been described. However, the packet may be connected to the network without passing through the ISP. In this case, the manager is not the ISP, but, for example, the boss of the sender or the organization to which the sender belongs. The security management device 24
Instead of the SP, a warning is sent to these bosses and organizations.

The gateway device 12 also performs the first IS
The present invention can be similarly applied to a form in which the apparatus is directly connected to a network without using P16.

[0081]

As described above, according to the present invention, only legitimate access from the external network to the internal network can be permitted. In addition, since the access from a legitimate person can be entrusted to a management device other than the gateway device connecting the internal network and the external network, the management load on the gateway device is reduced.

In particular, the authentication data is used to judge whether or not the user has a valid right. If the authentication data is not sent from the sender, if the authentication data is incorrect, It can be determined that access has been made.

Further, when it is determined that the access is unauthorized, a warning is notified to the administrator, so that an effect of preventing the unauthorized access in the future is expected. Also, if the administrator is an Internet service provider,
Internet service providers can know that somebody has used unauthorized access,
The effect of strengthening user management is obtained.

Further, since the terminal device is configured so that the authentication data is transmitted in response to a request from the security management device, it is easy to determine that the terminal device has the right to properly access the internal network. It is possible to smoothly access from the external network to the internal network.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of a communication system according to a first embodiment.

FIG. 2 is a conceptual diagram of a table stored in a security management device.

FIG. 3 is a flowchart showing a flow of an operation of accessing a home network from a terminal.

FIG. 4 is a configuration block diagram of a security management device.

FIG. 5 is a configuration block diagram of a gateway device.

FIG. 6 is a configuration block diagram of a terminal.

[Explanation of symbols]

 Reference Signs List 10 home network 12 gateway device 12 16 first Internet service provider 18 Internet 20 terminal 22 second Internet service provider 24 security management device 24 40 storage means 42 interface 44 control means 50 interface 52 interface 54 filtering means 56 control means 60 Interface 62 display means 64 input means 66 control means

Claims (16)

[Claims] 1. An unauthorized access prevention method for connecting an external network and an internal network with a gateway device to prevent an unauthorized access to a device on the internal network side from the external network side, wherein: Packet information transmission for transmitting packet information of the data packet and self-authentication data of the gateway device to a security management device on the external network when a data packet is transmitted to a device in the internal network. Requesting, wherein the security management device requests the sender of the data packet for sender-side authentication data based on the packet information; and, in response to the request, the sender sends the sender-side authentication data to the sender. To the security management device. Based on the transmitted sender-side authentication data and the self-authentication data of the gateway device, whether the sender is permitted to access the internal network. An authentication step of judging whether the sender is permitted to access the internal network as a result of the authentication step, the security management device sends the data packet to the gateway device. A command step for permitting inflow into the internal network. 2. The unauthorized access prevention method according to claim 1, wherein, as a result of the authentication step, if the sender is not permitted to access the internal network, the security management device sets the sender to the sender. A warning notification step of notifying a warning to an administrator who manages the unauthorized access. 3. The unauthorized access prevention method according to claim 1, wherein, after executing the requesting step, if the sender-side authentication data has not been transmitted within a predetermined period, the security management device is configured to: A second warning notification step of notifying a manager who manages the sender of a warning. 4. The method according to claim 1, wherein the external network is the Internet, and the internal network is a home network. 5. The unauthorized access prevention method according to claim 1, wherein the packet information is the I of a sender of the data packet.
An unauthorized access prevention method, which is one of a P address, TCP information, and a UDP access port number. 6. The unauthorized access prevention method according to claim 2, wherein the administrator managing the sender is an Internet service provider used by the sender. 7. A security management device for managing another communication device connected via a network, comprising: an interface unit connected to the network; and a person who is permitted to access the other communication device. Storage means for storing a table in which the authentication data is written, when the other communication device requests authentication of a sender who has transmitted a data packet to the other communication device, Requesting the transmission of the authentication data, and checking whether or not the transmitted authentication data is described in the table. If the authentication data is described, the access to the other communication device is permitted. Control means for issuing a command of the following. 8. The security management device according to claim 7, wherein the control unit issues a warning to an administrator of the sender if the transmitted authentication data is not described in the table. A security management device for notifying. 9. The security management device according to claim 7, wherein the control unit requests transmission of the authentication data.
If the authentication data is not transmitted within a predetermined period, a warning is notified to an administrator of the sender. 10. The security management device according to claim 7, wherein the network is the Internet, and the other communication device is a gateway device. 11. The security management device according to claim 8, wherein the administrator is an Internet service provider to which the sender connects. 12. A gateway device for connecting an external network and an internal network, comprising: a first interface unit for connecting to the external network; a second interface unit for connecting to the internal network; Filtering means for filtering a data packet destined for a network; and control means for controlling the filtering means. When a data packet destined for the internal network is transmitted from the external network, packet information of the packet is transmitted. And transmitting the self-authentication data of the gateway device to another management device, and when a command to cancel the filtering is transmitted from the management device, cancels the filtering of the filtering unit, Gateway apparatus characterized by comprising a control unit that allows the flow of serial data packet to said internal network. 13. The gateway device according to claim 12, wherein said external network is the Internet, and said internal network is a home network. 14. The gateway device according to claim 12, wherein the packet information is the I of a sender of the data packet.
A gateway device, which is one of a P address, TCP information, and a UDP access port number. 15. The security management device according to claim 12, wherein the management device is a security management device connectable via the external network. 16. A terminal device connectable to a network, comprising: interface means for connecting to the network; and when another management device requests transmission of authentication data on the terminal device side via the network, Control means for transmitting the authentication data to the other management device.