JP2005223453A - Program and device for data communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To protect a LAN from impersonation utilizing an RTP, a DoS attack, and the feeding of an unauthorized program or the like. <P>SOLUTION: A gateway is installed at the connecting point of an external IP network such as the Internet and an internal IP network such as the LAN. The transmission rate of a data packet passing through the gateway is constantly monitored whether it becomes disproportionately high as viewed from types of data notified by a call control packet before it. When the transmission rate exceeds a specified value, a succeeding packet is discarded. Therefore, it is possible to protect the LAN from the DoS attack of feeding a large amount of packets. While, regarding a packet relayed to the LAN without discarding it, analog data in the packet are destroyed with a noise pattern at a level of not affecting the audition of a person. Consequently, even if a program such as a virus is fed, it does not normally operate after passing through the gateway. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a data communication method, a data communication program, and a data communication apparatus for transferring audio data, video data, and the like under the RTP (Real-Time Transport Protocol) system, particularly for data transfer between terminals connected by a network. About.

  With recent advances in IP-related technology, it has become possible to transfer real-time data such as audio and video represented by TV conferences, which has been difficult in the past. RTP (IETF RFC3550) is used for data transfer, and SIP (IETF RFC3261) or ITU-T H.264 is used for managing data transfer sessions. Protocols such as H.323 are used.

  In companies and the like, there is a movement to integrate a data network and a voice network, which have been individually constructed conventionally, into one IP network using these technologies. In addition, there is a need to connect networks between a plurality of companies and to connect to the Internet, which is an IP public network, and to unify all communications including IP for voice networks.

  However, IP networks such as the Internet are not originally designed with an emphasis on safety. Therefore, there is a conventional technique for improving the security of data transfer by selectively encrypting a part of data transmitted / received by RTP in particular (for example, Patent Document 1 below), but data modification is performed in an IP network. In addition to snooping and peeping, malicious users can spoof IP addresses and infiltrate LANs (so-called “spoofing”), illegally access servers and PCs, send large amounts of packets, and increase processing power There is a risk of taking it away (so-called “DoS attack”) or spreading a computer virus using an OS security hole (see, for example, Patent Document 1).

  Therefore, conventionally, a gateway device (FireWall, etc.) is placed at the connection point between the internal network and the external network, the application sequence is monitored by the device, and abnormal packets are detected and discarded as described above. Was dealing with a serious attack.

JP 2002-319936 A

  However, in the transmission of audio data and video data by IP, RTP that simply allows data packets to flow is used. Therefore, a malicious attack cannot be detected by the conventional technology that monitors application sequence abnormalities. Therefore, there is no choice but to determine whether or not the IP packet can be passed based on the IP packet arrival / departure address and TCP / UDP port number received by the gateway device. In effect, impersonation, DoS attack, and unauthorized program There was a problem that it was not possible to stop sending in.

  An object of the present invention is to provide a data communication method, a data communication program, and a data communication apparatus capable of preventing a malicious attack using RTP in order to solve the above-described problems caused by the prior art. .

  In order to solve the above-described problems and achieve the object, a data communication method, a data communication program, and a data communication apparatus according to the present invention receive data packets such as audio and video from a first terminal connected via a network. A data packet receiving step, a transmission rate extracting step for extracting a transmission rate corresponding to the type of data in the data packet received in the data packet receiving step, and a transmission of the data packet received in the data packet receiving step A data packet received in the data packet receiving step when the transmission rate measuring step for measuring the rate and the transmission rate measured in the transmission rate measuring step is equal to or less than the transmission rate extracted in the transmission rate extracting step Is transmitted to the second terminal that is the destination of the data packet. And Tsu DOO transmitting step, characterized in that it comprises a.

  According to the present invention, when the transmission rate of the data packet becomes abnormally high in view of the type of data in the packet, the relay of the subsequent packet is interrupted.

  A data communication method, a data communication program, and a data communication apparatus according to the present invention include a data packet receiving step for receiving a data packet such as audio or video from a first terminal connected via a network, and the data packet reception A noise pattern extracting step for extracting a noise pattern corresponding to the type of data in the data packet received in the step; and the data packet received in the data packet receiving step for the noise pattern extracted in the noise pattern extracting step A noise pattern synthesizing step for synthesizing the data in the data, and a data packet transmitting step for transmitting the data packet synthesized with the noise pattern in the noise pattern synthesizing step to the second terminal that is the destination of the data packet; It is characterized by including.

  According to the present invention, data in a data packet to be relayed is destroyed with noise that does not affect human listening.

  According to the data communication method, the data communication program, and the data communication apparatus according to the present invention, the data packet transferred from the calling terminal to the called terminal is monitored in the middle of the transmission rate or destroyed by the noise pattern. It is possible to prevent a malicious attack using RTP, specifically, an attack in which a large number of packets are sent, or an illegal program is sent by fake analog data.

  Exemplary embodiments of a data communication method, a data communication program, and a data communication apparatus according to the present invention will be explained below in detail with reference to the accompanying drawings.

  FIG. 1 is an explanatory diagram showing an overall configuration of a data communication system including a data communication apparatus according to an embodiment of the present invention. As shown in the figure, the data communication system according to the present embodiment includes a gateway 100 that connects an external IP network 101 such as the Internet and an internal IP network 102 such as a LAN, a terminal 101a on the external IP network 101, and an internal IP network 102. It is comprised by the upper terminal 102a. Of these, the gateway 100 corresponds to the data communication apparatus according to the present invention.

  Both the terminal 101a and the terminal 102a may be data sending / receiving terminals, but in the following, the case where the terminal 101a is the calling terminal and the terminal 102a is the called terminal, that is, the gateway 100 from the external IP network 101 is described below. Let us consider a case where data is transmitted to the internal IP network 102 via the network. This data is specifically analog data such as voice, audio, and video, and RTP is used as a transmission / reception protocol.

  FIG. 2 is an explanatory diagram showing an example of a hardware configuration of the data communication apparatus according to the embodiment of the present invention, that is, the gateway 100 shown in FIG. As illustrated, the gateway 100 includes a CPU 201, ROM 202, RAM 203, HDD (hard disk drive) 204, HD (hard disk) 205, FDD (flexible disk drive) 206, FD (flexible disk) 207, display 208, network I / F ( Interface) 209a, 209b, keyboard 210 and mouse 211. Each of the above parts is connected by a bus 200.

  In the figure, a CPU 201 controls the entire apparatus. The ROM 202 stores a boot program and the like. The RAM 203 is used as a work area for the CPU 201.

  The HDD 204 controls data read / write with respect to the HD 205 according to the control of the CPU 201. The HD 205 stores data written according to the control of the HDD 204. The FDD 206 controls reading / writing of data with respect to the FD 207 according to the control of the CPU 201. The FD 207 stores data written according to the control of the FDD 206. The FD 207 is an example of a detachable recording medium, and may be a CD-ROM (CD-R, CD-RW), MO, DVD (Digital Versatile Disk), memory card, or the like instead of the FD 207.

  A display 208 displays various data such as a document and an image, as well as a cursor, a window, an icon, and the like. The network I / Fs 209a and 209b are connected to a network such as a LAN / WAN. For example, here, the network I / F 209a is connected to the external IP network 101, and the network I / F 209b is connected to the internal IP network 102, and controls transmission and reception of data between the network and the inside of the apparatus. The keyboard 210 includes a plurality of keys for inputting characters, numbers, various instructions, and the like, and inputs data corresponding to the pressed key into the apparatus. The mouse 211 inputs the amount and direction of rotation of the ball at the bottom of the main body and ON / OFF of each button at the top of the main body into the device as needed.

  Next, FIG. 3 is an explanatory diagram showing a functional configuration of the data communication apparatus according to the embodiment of the present invention, that is, the gateway 100. As shown in the figure, the data communication apparatus according to the present embodiment includes a call control packet reception unit 300, a call control packet transmission unit 301, a session management unit 302, a transmission rate DB 303, a noise pattern DB 304, a data packet reception unit 305, a packet rate. A monitoring unit 306, a noise mixing unit 307, and a data packet transmission unit 308 are provided.

  First, the call control packet receiving unit 300 receives a call control packet transmitted from the data transmitting side, here the external IP network 101, via the network I / F 209a, and outputs it to the call control packet transmitting unit 301 described later. In addition, when the packet is particularly a call-related packet (Setup signal in ITU-T H.323, INVITE message in SIP), a function unit that outputs necessary items in the packet to the session management unit 302 described later. is there.

  Specifically, the necessary items are an incoming / outgoing IP address (here, IP addresses of the terminal 101a and the terminal 102a), a port number, and a media type. The media type is information indicating the type of data in the data packet transmitted / received following the call-related packet, and specifically, “voice (CELP / AD-PCM / PCM)” “audio (normal / high). Quality) "" video (MPEG-1 / MPEG-2 / MPEG-4) ". The media type is held in the “additional information” area in the outgoing call packet.

  Next, the call control packet transmitting unit 301 is a functional unit that transmits the call control packet input from the call control packet receiving unit 300 to the data receiving side, here, the internal IP network 102. The transmitted call control packet is finally relayed to the terminal 102a which is the destination via the internal IP network 102.

  Next, the session management unit 302 is a functional unit that manages a data transfer session. This function is the same as the session management according to the prior art. In addition, the session management unit 302 according to the present invention reads necessary items from a transmission rate DB (database) 303 and a noise pattern DB (database) 304 described later. , And a function of outputting to a packet rate monitoring unit 306 and a noise mixing unit 307, which will be described later.

  FIG. 4 is an explanatory diagram schematically showing the contents of the transmission rate DB 303. As shown in the figure, the transmission rate DB 303 corresponds to the type of data specified by the media type described above and its normal transmission rate (which can be called a standard transmission rate predicted from the type of data). It is a database that is retained.

  The noise pattern DB 304 is a database that holds, for each data type, a noise pattern to be combined with the data. For example, a noise pattern of white noise is prepared for data whose media type is “voice” and registered in the noise pattern DB 304. Note that this noise pattern is not particularly limited to white noise, and when the synthesized audio data or video data is returned to an analog signal, it does not affect human audition, that is, the human recognizes the main signal. Any pattern can be used as long as it does not interfere.

  Returning to the description of FIG. 3, the data packet receiving unit 305 receives a data packet transmitted from the data transmission side, here the external IP network 101, and outputs it to the packet rate monitoring unit 306 described later. It is. The data packet receiving unit 305 holds a management table for managing the state of an open session. When the session management unit 302 is instructed to open a session, the session number notified along with the instruction, The incoming / outgoing IP address and port number are registered in the table, and when an instruction to close the session is given, the entry of the session specified by the session number notified with the instruction is deleted from the table.

  Next, the packet rate monitoring unit 306 monitors whether or not the actual transmission rate of the data packet input from the data packet receiving unit 305 exceeds the normal transmission rate notified from the session management unit 302, and the former. Is a functional unit that outputs the data packet to a noise mixing unit 307, which will be described later.

  The transmission rate notified from the session management unit 302 when the session is opened is registered in the management table of the packet rate monitoring unit 306 in association with the session number notified at the same time, and is deleted when the session is closed. The packet rate monitoring unit 306 holds a rate counter for measuring the data transmission rate in each session for each session number registered in the management table, that is, for each open session. The packet counter of the data packet input to the packet rate monitoring unit 306 is sequentially added to the rate counter, and is initialized to 0 every time a predetermined time, for example, 100 ms elapses by a monitoring timer held by the packet rate monitoring unit 306. Shall be

  Next, the noise mixing unit 307 combines the noise pattern input from the session management unit 302 with the data portion in the data packet input from the packet rate monitoring unit 306, that is, an appropriate noise pattern according to the media type. This is a functional unit that outputs a later data packet to a data packet transmission unit 308 described later.

  The combining method is not particularly limited. For example, when the media type is voice, the logical sum of the voice data in the data packet and the noise pattern is taken, and the voice data in the data packet may be rewritten as a result. When the media type is video, since data is generally compressed, it is necessary to devise such as decompression and synthesis with a noise pattern. This is because if the compressed data is destroyed by noise, it cannot be reproduced.

  Next, the data packet transmission unit 308 is a functional unit that transmits the data packet input from the noise mixing unit 307 to the internal IP network 102 via the data reception side, here, the network I / F 209b. The transmitted data packet is finally relayed to the destination terminal 102a via the internal IP network 102.

  Next, FIG. 5 is a flowchart showing a procedure of call control packet transmission / reception processing in the data communication apparatus according to the embodiment of the present invention, that is, the gateway 100 shown in FIG.

  First, the device receives a call control packet transmitted from the terminal 101a on the network to which the device is connected, for example, the external IP network 101, by the call control packet receiving unit 300 (step S501).

  When the packet is a call-related packet (step S502: Yes), necessary items, specifically, an incoming / outgoing IP address, a port number, and a media type are extracted from the packet (step S503). The management unit 302 is instructed to open a new session (step S504). Thereafter, the call control packet received in step S501 is output to the call control packet transmission unit 301, and the call control packet transmission unit 301 receiving the packet transmits the packet to its destination, here the terminal 102a on the internal IP network 102. Transmit (step S505).

  On the other hand, when the received call control packet is a termination call type packet (step S502: No, step S506: Yes), the call control packet receiving unit 300 instructs the session management unit 302 to close the session. (Step S507), the packet is transmitted to the call control packet transmitter 301 (step S505). If the received call control packet is neither a call-type packet nor a termination-type packet, that is, a call control packet indicating the progress of data communication or the like (step S502: No, step S506: No), it remains as it is. Without doing anything, the packet is transmitted to the call control packet transmitter 301 (step S505).

  Next, FIG. 6 is a flowchart showing the procedure of session open processing (step S504 in FIG. 5) by the session management unit 302 that has received an instruction from the call control packet receiving unit 300.

  When the call control packet receiving unit 300 gives an instruction to open a session with the necessary items extracted in step S503 of FIG. 5, the session management unit 302 that has received the request hunts the session number and uses that number. The state of the specified session is set to “Open” (step S601), and the transmission rate DB 303 and noise pattern DB 304 are searched for the media type notified from the call control packet receiving unit 300, and the transmission corresponding to the media type is performed. A rate and a noise pattern are extracted (step S602).

  Thereafter, the session number hunted in step S601, the calling IP address and port number notified from the call control packet receiving unit 300 are added, and the data packet receiving unit 305 is instructed to open a session (step S603). Receiving this, the data packet receiving unit 305 registers the above items in the above management table.

  At the same time, the session management unit 302 notifies the session number and the transmission rate extracted in step S602 to the packet rate monitoring unit 306, and notifies the session number and the noise pattern extracted in step S602 to the noise mixing unit 307 ( Steps S604 and S605).

  Next, FIG. 7 is a flowchart showing a procedure of data packet transmission / reception processing in the data communication apparatus according to the embodiment of the present invention, that is, the gateway 100 shown in FIG.

  When a data packet transmitted from the network to which the present apparatus is connected, for example, the terminal 101a on the external IP network 101 is received (step S701), the present apparatus receives the data packet by the data packet receiving unit 305. The management table is searched by the incoming / outgoing IP address and port number (step S702).

  If the search fails, that is, if the received data packet is not a data packet of any open session (step S703: No), the data packet is discarded (step S704). On the other hand, when the session number can be retrieved from the above table, that is, when the received data packet is a data packet of any open session (step S703: Yes), the data packet received in step S701 is The session number searched in step S702 is output to the subsequent packet rate monitoring unit 306.

  In response to this, the packet rate monitoring unit 306 adds the data length of the input data packet to the rate counter corresponding to the session number (step S705), and whether the value of the counter after the addition is equal to or less than the specified value. It is determined whether or not (step S706). For example, when the media type is “voice (CELP)”, the normal transmission rate is 8 Kbps (see FIG. 4). Therefore, the data amount per 100 ms at which the rate counter is initialized is 800 bits, and this value is defined as the above. Value.

  When the amount of data accumulated in the rate counter exceeds the specified value of 800 bits, that is, when the actual transmission rate exceeds the normal transmission rate in the management table (step S706: No), the data The packet is discarded (step S707). On the other hand, as long as the actual transmission rate is equal to or lower than the normal transmission rate (step S706: Yes), the data packet input from the data packet receiving unit 305 and the session number are output to the subsequent noise mixing unit 307.

  In response to this, the noise mixing unit 307 synthesizes a noise pattern corresponding to the session number with the data portion of the input data packet (step S708), and the combined data packet is a subsequent data packet transmission unit. Output to 308. Thereafter, the data packet transmitting unit 308 transmits the data packet to the destination, here, the terminal 102a on the internal IP network 102 (step S709).

  According to the embodiment described above, the transmission rate of RTP data relayed from the external IP network 101 such as the Internet to the internal IP network 102 such as the LAN is abnormally transmitted (or alternatively) by the gateway 100 at the connection point. Since it is constantly monitored whether it is high (unsuitably for the media type), the network can be protected from a so-called DoS attack that uses RTP to send large amounts of data.

  In the above-described embodiment, the transmission rate corresponding to each media type is uniformly determined in advance and registered in the transmission rate DB 303. This transmission rate is adopted by the arrival / departure terminal of each session. You may decide by the kind of codec.

  In the above-described embodiment, the length of data passing through the gateway 100 is added to a counter that is initialized at a fixed period, and packet relay is interrupted when the value of the counter exceeds a specified value. However, when the data packet has a fixed length, the transmission rate may be measured noting the data length but paying attention to the packet transmission interval. In other words, if the upper limit of the transmission rate is determined in the case of a fixed length, the average value of the packet transmission interval is determined, so the first packet is received, and all packets received earlier than the average value are discarded. .

  In addition, according to the above-described embodiment, the RTP data passing through the gateway 100 is destroyed by the application of a noise pattern, so even if an illegal program such as a virus or a back door is sent to the LAN, It does not operate normally after passing through the gateway 100. In other words, as long as analog data such as audio and video is transmitted and received by RTP, the synthesis of noise patterns only slightly degrades the quality, but in the case of software, the data is fatally destroyed. Therefore, even if it can pass through the gateway 100, it has no meaning and is rendered harmless.

  In the above-described embodiment, the media type is specified for each session in the additional information of the call control packet. For example, when the terminal 101a or the terminal 102a is a dedicated terminal specialized for a specific type of data, The media type of data to be delivered in the subsequent session can be specified only by the incoming / outgoing IP address and port number in the control packet. Therefore, if the arrival / departure IP address and media type are registered in the gateway 100 (or other server) DB, it is possible to refer to this DB to specify the media type and the appropriate type without specifying the media type for each session. It is possible to specify a proper transmission rate and noise pattern.

  In the above-described embodiment, the case where the terminal 101a is the originating terminal and the terminal 102a is the destination terminal, that is, the case where data is relayed from the external IP network 101 to the internal IP network 102 is described as an example. Even when data is relayed from the IP network 101 to the external IP network 102, an attack from the LAN to the outside of the LAN can be stopped by the gateway 100 by monitoring the packet rate or synthesizing the noise pattern. Can do.

  The data communication method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program is recorded on a computer-readable recording medium such as the hard disk 205, the flexible disk 207, the CD-ROM, the MO, and the DVD, and is executed by being read from the recording medium by the computer. The program may be a transmission medium that can be distributed via a network such as the Internet.

(Supplementary Note 1) A data packet receiving step of receiving a data packet such as audio or video from a first terminal connected via a network;
A transmission rate extraction step of extracting a transmission rate corresponding to the type of data in the data packet received in the data packet reception step;
A transmission rate measuring step of measuring a transmission rate of the data packet received in the data packet receiving step;
When the transmission rate measured in the transmission rate measurement step is equal to or lower than the transmission rate extracted in the transmission rate extraction step, the data packet received in the data packet reception step is the second destination of the data packet. A data packet transmission process to be transmitted to the terminal of
A data communication method comprising:

(Appendix 2) Further, a call control packet receiving step of receiving a call control packet preceding the data packet from the first terminal;
A media type extracting step of extracting information indicating the type of data in the data packet from the call control packet received in the call control packet receiving step,
2. The data communication method according to appendix 1, wherein in the transmission rate extraction step, the transmission rate is extracted based on the information extracted in the media type extraction step.

(Supplementary Note 3) Further, when the transmission rate measured in the transmission rate measurement step is equal to or less than the transmission rate extracted in the transmission rate extraction step, the data in the data packet received in the data packet reception step A noise pattern extraction process for extracting a noise pattern corresponding to the type;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step,
In the data packet transmitting step, the data packet synthesized with the noise pattern in the noise pattern synthesizing step is transmitted to a second terminal that is a destination of the data packet. The data communication method described in 1.

(Supplementary Note 4) A data packet receiving step of receiving a data packet such as audio or video from a first terminal connected via a network;
A noise pattern extraction step of extracting a noise pattern corresponding to the type of data in the data packet received in the data packet reception step;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step;
A data packet transmission step of transmitting the data packet synthesized with the noise pattern in the noise pattern synthesis step to a second terminal that is a destination of the data packet;
A data communication method comprising:

(Supplementary note 5) Further, a call control packet receiving step of receiving a call control packet preceding the data packet from the first terminal;
A media type extracting step of extracting information indicating the type of data in the data packet from the call control packet received in the call control packet receiving step,
5. The data communication method according to appendix 3 or appendix 4, wherein in the noise pattern extraction step, the noise pattern is extracted based on the information extracted in the media type extraction step.

(Appendix 6) A data packet receiving step of receiving a data packet such as audio or video from a first terminal connected via a network;
A transmission rate extraction step of extracting a transmission rate corresponding to the type of data in the data packet received in the data packet reception step;
A transmission rate measuring step of measuring a transmission rate of the data packet received in the data packet receiving step;
When the transmission rate measured in the transmission rate measurement step is equal to or lower than the transmission rate extracted in the transmission rate extraction step, the data packet received in the data packet reception step is the second destination of the data packet. A data packet transmission process to be transmitted to the terminal of
A data communication program for causing a computer to execute.

(Supplementary note 7) Further, a call control packet receiving step of receiving a call control packet preceding the data packet from the first terminal;
A media type extracting step of extracting information indicating the type of data in the data packet from the call control packet received in the call control packet receiving step,
7. The data communication program according to appendix 6, wherein in the transmission rate extraction step, the transmission rate is extracted based on the information extracted in the media type extraction step.

(Appendix 8) Further, when the transmission rate measured in the transmission rate measurement step is equal to or lower than the transmission rate extracted in the transmission rate extraction step, the data in the data packet received in the data packet reception step A noise pattern extraction process for extracting a noise pattern corresponding to the type;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step,
In the data packet transmitting step, the data packet synthesized with the noise pattern in the noise pattern synthesizing step is transmitted to the second terminal that is the destination of the data packet. The data communication program described in 1.

(Supplementary note 9) A data packet receiving step of receiving data packets such as audio and video from a first terminal connected via a network;
A noise pattern extraction step of extracting a noise pattern corresponding to the type of data in the data packet received in the data packet reception step;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step;
A data packet transmission step of transmitting the data packet synthesized with the noise pattern in the noise pattern synthesis step to a second terminal that is a destination of the data packet;
A data communication program for causing a computer to execute.

(Supplementary note 10) Further, a call control packet receiving step of receiving a call control packet preceding the data packet from the first terminal;
A media type extracting step of extracting information indicating the type of data in the data packet from the call control packet received in the call control packet receiving step,
10. The data communication program according to appendix 8 or appendix 9, wherein in the noise pattern extraction step, the noise pattern is extracted based on the information extracted in the media type extraction step.

(Appendix 11) Data packet receiving means for receiving data packets such as audio and video from a first terminal connected via a network;
Transmission rate extracting means for extracting a transmission rate corresponding to the type of data in the data packet received by the data packet receiving means;
A transmission rate measuring means for measuring the transmission rate of the data packet received by the data packet receiving means;
When the transmission rate measured by the transmission rate measuring means is equal to or lower than the transmission rate extracted by the transmission rate extracting means, the data packet received by the data packet receiving means is the second destination of the data packet. Data packet transmission means for transmitting to the terminal of
A data communication apparatus comprising:

(Supplementary note 12) Further, call control packet receiving means for receiving a call control packet preceding the data packet from the first terminal;
Media type extracting means for extracting information indicating the type of data in the data packet from the call control packet received by the call control packet receiving means,
The data communication apparatus according to appendix 11, wherein the transmission rate extraction unit extracts the transmission rate based on the information extracted by the media type extraction unit.

(Additional remark 13) Furthermore, when the transmission rate measured by the transmission rate measuring means is equal to or less than the transmission rate extracted by the transmission rate extracting means, the data in the data packet received by the data packet receiving means A noise pattern extraction means for extracting a noise pattern corresponding to the type;
Noise pattern synthesizing means for synthesizing the noise pattern extracted by the noise pattern extracting means with the data in the data packet received by the data packet receiving means,
The data packet transmitting means transmits the data packet synthesized with the noise pattern by the noise pattern synthesizing means to the second terminal that is the destination of the data packet. The data communication apparatus according to 1.

(Supplementary note 14) Data packet receiving means for receiving data packets such as audio and video from a first terminal connected via a network;
Noise pattern extracting means for extracting a noise pattern corresponding to the type of data in the data packet received by the data packet receiving means;
Noise pattern synthesizing means for synthesizing the noise pattern extracted by the noise pattern extracting means with the data in the data packet received by the data packet receiving means;
Data packet transmitting means for transmitting the data packet synthesized with the noise pattern by the noise pattern synthesizing means to the second terminal that is the destination of the data packet;
A data communication apparatus comprising:

(Supplementary note 15) Call control packet receiving means for receiving a call control packet preceding the data packet from the first terminal;
Media type extracting means for extracting information indicating the type of data in the data packet from the call control packet received by the call control packet receiving means,
15. The data communication apparatus according to appendix 13 or appendix 14, wherein the noise pattern extraction unit extracts the noise pattern based on the information extracted by the media type extraction unit.

  As described above, the data communication method, the data communication program, and the data communication apparatus according to the present invention are useful for preventing a malicious attack in an IP network. In particular, an attacker uses analog data such as voice and video such as RTP. Suitable when using a protocol for sending and receiving.

It is explanatory drawing which shows the whole structure of a data communication system including the data communication apparatus concerning embodiment of this invention. It is explanatory drawing which shows an example of the hardware constitutions of the data communication apparatus (gateway 100) concerning embodiment of this invention. It is explanatory drawing which shows the functional structure of the data communication apparatus (gateway 100) concerning embodiment of this invention. It is explanatory drawing which shows the content of transmission rate DB303 typically. It is a flowchart which shows the procedure of the transmission / reception process of the call control packet in the data communication apparatus (gateway 100) concerning embodiment of this invention. 6 is a flowchart illustrating in detail a procedure of session open processing in step S504 of FIG. 5. It is a flowchart which shows the procedure of the transmission / reception process of the data packet in the data communication apparatus (gateway 100) concerning embodiment of this invention.

Explanation of symbols

100 Gateway 101 External IP Network 102 Internal IP Network 101a, 102a Terminal 200 Bus 201 CPU
202 ROM
203 RAM
204 HDD
205 HD
206 FDD
207 FD
208 Display 209a Network I / F
209b Network I / F
210 Keyboard 211 Mouse 300 Call control packet receiver 301 Call control packet transmitter 302 Session manager 303 Transmission rate DB
304 Noise pattern DB
305 Data packet reception unit 306 Packet rate monitoring unit 307 Noise mixing unit 308 Data packet transmission unit

Claims (5)

A data packet receiving step of receiving data packets such as voice and video from a first terminal connected via a network;
A transmission rate extraction step of extracting a transmission rate corresponding to the type of data in the data packet received in the data packet reception step;
A transmission rate measuring step of measuring a transmission rate of the data packet received in the data packet receiving step;
When the transmission rate measured in the transmission rate measurement step is equal to or lower than the transmission rate extracted in the transmission rate extraction step, the data packet received in the data packet reception step is the second destination of the data packet. A data packet transmission process to be transmitted to the terminal of
A data communication program for causing a computer to execute. A call control packet receiving step for receiving a call control packet preceding the data packet from the first terminal;
A media type extracting step of extracting information indicating the type of data in the data packet from the call control packet received in the call control packet receiving step,
The data communication program according to claim 1, wherein the transmission rate extraction step extracts the transmission rate based on the information extracted in the media type extraction step. Furthermore, when the transmission rate measured in the transmission rate measurement step is equal to or lower than the transmission rate extracted in the transmission rate extraction step, it corresponds to the type of data in the data packet received in the data packet reception step. A noise pattern extraction process for extracting a noise pattern;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step,
The data packet transmitting step transmits the data packet synthesized with the noise pattern in the noise pattern synthesizing step to a second terminal that is a destination of the data packet. Item 3. A data communication program according to Item 2. A data packet receiving step of receiving data packets such as voice and video from a first terminal connected via a network;
A noise pattern extraction step of extracting a noise pattern corresponding to the type of data in the data packet received in the data packet reception step;
A noise pattern synthesis step of synthesizing the noise pattern extracted in the noise pattern extraction step with the data in the data packet received in the data packet reception step;
A data packet transmission step of transmitting the data packet synthesized with the noise pattern in the noise pattern synthesis step to a second terminal that is a destination of the data packet;
A data communication program for causing a computer to execute. Data packet receiving means for receiving data packets such as audio and video from a first terminal connected via a network;
Noise pattern extracting means for extracting a noise pattern corresponding to the type of data in the data packet received by the data packet receiving means;
Noise pattern synthesizing means for synthesizing the noise pattern extracted by the noise pattern extracting means with the data in the data packet received by the data packet receiving means;
Data packet transmitting means for transmitting the data packet synthesized with the noise pattern by the noise pattern synthesizing means to the second terminal that is the destination of the data packet;
A data communication apparatus comprising:

Images