JP2007072856A - Network service security system and network service security method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent illicit access without losing real time property. <P>SOLUTION: When a request of service is generated from a remote terminal 9, a service server 7 transmits a request to open a port used for the service to a control server 4. The control server 4 issues a port number (B2) used for the service, opens a service port B2, and transmits the port number (B2) to a service port report port A1 of a gate device 2. The gate device 2 issues the port number (A2) of a service port A2 corresponding to the port number (B2), and opens the service port A2. Thereafter, transmission and receiving of data for the service are executed using the service port A2 of the gate device 2 and the service port B2 of the control server 4. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  In particular, the present invention relates to a service performed via a network in an Internet environment exposed to an attack such as unauthorized access, and the like to prevent unauthorized access to a server device and a gate device, and a locally connected device. The present invention relates to a network service security system and a network service security method.

  In a home control system that controls devices on a home network by remote home appliances, an application that implements a service waits for a signal at a certain predetermined port. Therefore, the port needs to be always open. Since the default port number is open to the public, unauthorized access targeting that port number occurs.

Therefore, in order to prevent the unauthorized access, a second port number that is generally not default is notified in advance to the gate device that permits access, and communication is performed using the second port. There is a technology having a mechanism for delivering to an application that realizes a service. In addition, using a method of accepting external reception of only the response signal to the request signal using a firewall, in the case of a request from the server device side, periodically check whether there is a service request from the gate device side at regular intervals. There is also a technology that responds with a confirmation mechanism. Patent Document 1 discloses a technique for dealing with unauthorized access to the home control system.
JP 2002-55895 A

  By the way, in recent years, network appliances such as information home appliances have become more sophisticated, and the need for remote control of home appliances from whereabouts has increased, and the need for technology to provide safe and real-time data transmission and reception at low cost high.

  However, in the data transmission / reception method between the gate device and the server device according to the above-described prior art, even if a second port that is not generally specified is used, the port is always open to an unspecified number of people. Therefore, there is a problem that there is a high risk that a third party searches for an open port by performing a port scan or the like and is illegally accessed. Software that can be used for unauthorized access such as port scanning is distributed free of charge on the Internet and can be easily implemented.

  In addition, when using a technology that has a mechanism for checking the presence or absence of a service request from the gate device side to the server device at regular intervals using a firewall, a confirmation cycle interval occurs, and real-time performance is lacking. There's a problem. If the interval is shortened, there is a problem that the processing load on each device and the network increases, and the cost increases due to the high performance of the equipment.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a network service security system and a network service security method capable of preventing unauthorized access without losing real-time characteristics. It is in.

  In order to solve the above-described problems, the present invention provides a network service security system in which a device connected to a home network is remotely controlled by a remote control unit via a network based on a service provided by a service provider. Each time a request for a service is generated by the remote control means, the first port that is always open is used to notify the port number of the second port used for data transmission / reception for the service, When receiving the control server connected to the service server via the network and the port number of the second port notified using the first port, the second port indicated by the notified port number is received. Open the port and use the second port to exchange data for the service with the service server Characterized by comprising a gate device connected to the device via the home network.

  The present invention also provides an open port used for a service in a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider. A gate device that is immediately closed when the service ends is provided.

  Further, the present invention relates to payout of ports used in a service in a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider. It is characterized by comprising a gate device for paying out a different port each time.

  According to the present invention, the control server includes a service ID receiving unit that receives a service ID of a service requested by the remote control unit, and a port open request unit that transmits a port open request including the service ID to the gate device. The gate device includes an application correspondence table storage unit that stores the service ID and an application corresponding to the service ID in association with each other, and a corresponding application based on the service ID included in the port open request. Is generated from the application identification storage unit, and the transfer setting for transferring the service data of the service ID received at the port number of the second port to the read application port is generated and stored, and the port is opened. Pass completion to the control server Transfer setting means, and service control means for notifying the application of the data based on the transfer setting when the service data of the service ID is received at the second port. .

  In the present invention, when the control server receives a port open completion notification from the gate device, the control server notifies the service server of the address information of the gate device, the port number of the second port, and the session ID. And

  In order to solve the above-described problems, the present invention provides network service security in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider. A method for providing a port number of a second port used for data transmission / reception for a service using a first port that is always open each time a service request is generated by the remote control means, The control server connected to the service server via the network notifies the gate device connected to the device via the home network, and the second port notified using the first port The second port indicated by the port number is opened, and the second port is used to send the previous port through the control server. Between the gate device and the service server, performs data transmission and reception for the service, the service is equal to or close immediately the second port when finished.

  According to the present invention, the control server connected to the service server via the network uses the first port that is always open every time a request for service is generated by the remote control means. The port number of the second port used for data transmission / reception is notified, and the port number of the second port notified by the gate device connected to the device via the home network using the first port Is received, the second port indicated by the notified port number is opened, and data transmission / reception for the service is performed with the service server using the second port. Therefore, there is an advantage that unauthorized access can be prevented without lacking real-time characteristics.

  Further, according to the present invention, in a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider, Close any open ports used immediately upon service termination. Therefore, since the second port is opened only at the moment of data transmission / reception for the service, there is an advantage that the time during which unauthorized access can be received can be minimized.

  In addition, according to the present invention, a gate device service is used in a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider. Regarding port payout, payout of a different port each time. Therefore, there is an advantage that unauthorized access can be prevented without lacking real-time characteristics.

  In addition, according to the present invention, it is possible to deal with services of a plurality of different service providers by using one gate device.

  In addition, according to the present invention, it is possible to simultaneously process a plurality of services with a single gate device.

  According to the present invention, the control server connected to the service server via the network uses the first port that is always open every time a service request is generated by the remote control means. The port number of the second port used for data transmission / reception for the device is notified, and the gate device connected to the device via the home network is notified of the second port notified using the first port. When the port number is received, the second port indicated by the notified port number is opened, and data transmission / reception for service with the service server is performed using the second port. Therefore, there is an advantage that unauthorized access can be prevented without lacking real-time characteristics.

  Embodiments of the present invention will be described below with reference to the drawings.

A. Configuration of Embodiment FIG. 1 is a block diagram showing a configuration of a network service management system to which a security method in data transmission / reception between a server device and a gate device is applied according to an embodiment of the present invention. In the figure, devices 1-1 to 1-3 are network devices installed in a house, and are connected to the gate device 2 via a local network. The gate device 2 is a device for connecting the devices 1-1 to 1-3 to the IP network 3, and performs conversion between a private address and an IP network side address. Details of the gate device 2 will be described later.

  The control server 4 connects to the service server 7 of the service provider 6 via the IP network 5, and provides a service menu for the user to select a service of the service provider 6 via the IP network 5 and the Internet 8. Distribute to the remote terminal 9. Details of the control server 4 will be described later.

  Next, the service server 7 includes an application of a service provided by the service provider 6, and includes the corresponding application of the gate device 2 or the devices 1-1 to 1-3 on the private network, the control server 4, and the gate device 2. To provide services through communication. Note that physically, the control server 4 may also serve as the service server 7.

  The remote terminal 9 is installed at a remote place and is connected from the service server 7 via the Internet 8. The remote terminal 9 has a browser function and enables remote control requests and result reception by the user. Further, the remote terminal 9 may be connected to the control server 4 via the Internet 8 and redirected to the service server 7 after undergoing authentication processing such as password authentication in the control server 4.

  Next, FIG. 2 is a block diagram showing a configuration of the gate device 2 described above. In the figure, the gate device 2 comprises a controller 2-1, FW (Fire Wall) & NAPT (Network Address Port Translation) 2-2, and individual service applications 2-3. The controller 2-1 controls the FW & NAPT2-2. FW & NAPT2-2 opens / closes a port and converts a private address and an IP network address according to an instruction from the controller 2-1. The address translation has a NAPT function (or IP masquerade function) that can map n private addresses to one IP network address. The controller 2-1 includes an application correspondence table in which a service ID that uniquely identifies a service and application location information (information configured by address information and a port number) corresponding to the service ID.

  Next, FIG. 3 is a block diagram showing the configuration of the control server 4 described above. In the figure, the control server 4 includes a controller 4-1 and a FW & NAPT 4-2 having functions similar to those of the gate device 2, and is connected to the service server 7 of the service provider 6 via the IP network 5.

B. Operation of Embodiment Next, the operation of the above-described embodiment will be described. Here, FIG. 4 is a sequence diagram for explaining the operation of the network service management system according to the present embodiment. In the sequence shown in FIG. 4, a service request is generated from the remote terminal 9, the port number used for the service is issued by each of the gate device 2 and the control server 4, and the disclosed first port (service port notification port) ) Are used to notify each other's second port (service port), and thereafter the second port (service port) is used to transmit and receive data for the service. The operation is shown.

  First, when the user inputs the selected service to the remote terminal 9, the remote terminal 9 transmits a service execution request to the service server 7 (S1). At this time, a gate device ID for uniquely identifying the gate device 2 is transmitted. The service server 7 receiving the service execution request from the remote terminal 9 transmits a request for opening a port used for the service to the control server 4 (S2). At this time, a service ID for uniquely identifying the current service and a gate device ID are also transmitted. The control server 4 that has received the port open request issues the port number (B2) used for the service (S3), opens the service port B2 (S4), and at the same time, for the service port notification of the gate device 2 The port number (B2) is transmitted to the port A1 (S5).

  The gate device 2 receives it and pays out the port number (A2) of the service port A2 used for service in the gate device 2 (S6). Then, the gate device 2 performs transfer setting from the service port A2 to a port on which the application waits locally in the gate device 2. In this transfer setting, the gate device 2 first searches for an application port using the service ID as key information from the application correspondence table (a correspondence table between the service ID and the application port number), and the search result is service data using the port number A2. And the transmission source as the address information of the control server 4 or the service server 7 and register them as NAPT settings in association with each other (S7). As a result, since the correspondence relationship between the service ID and the service application is registered in the gate device 2, it is possible to cope with processing of services from a plurality of different service providers according to the service ID. Then, the service port A2 is opened (S8), and at the same time, the port number (A2) of the service port A2 is notified to the transmission source port of the control server 4 (S9).

  Next, the control server 4 receives the port number (A2) of the service port A2 used for the service by the gate device 2, and confirms that the acquisition of the mutual port number and the port opening used in the current service processing are completed. The service server 7 is notified (S10). At this time, the address information of the gate device 2, the service port A2 (port ID), and the session ID for specifying this session are also notified. Thereby, when the service server 7 requests execution of processing of the same service, the control server 4 manages with a plurality of different session IDs. Thereby, it is possible to simultaneously process a plurality of execution requests for the same service. The service server 7 receives it and transmits a service control signal to the control server 4 (S11). The control server 4 sends the service control signal received from the service server 7 to the service port A2 of the gate device 2 from the service port B2 paid out earlier (S12).

  The gate device 2 that has received the service control signal transfers the service control signal to the corresponding service application 2-3 using the NAPT set in step S7 (S13). Necessary service signals are exchanged between the local service application 2-3 of the gate device 2 and the service server 7 (S14), and the result is displayed on the remote terminal 9 accordingly (S15).

  When the transmission / reception of the service signal ends, the service server 7 designates a session ID to the control server 4 and transmits a port close request (S16). The control server 4 closes the service port B2 (S17), and transmits a port close request to the service port notification port A1 of the gate device 2 (S18). When no port close request is received from the service server 7, the control server 4 may request a port close request signal from the gate device 2 after a predetermined interval.

  The gate device 2 closes the service port A2 (S19) and notifies the transmission source port of the control server 4 of the completion of the port close (S20). In addition, the NAPT setting of the current service set in step S7 is canceled. The control server 4 notifies the service server 7 of the completion of the port close (S21). When no port close request is received from the service server 7, the gate device 2 may close the service port A2 after a predetermined interval.

  The above-described sequence is merely an example, and there may be variations in port opening timing. For this reason, the change of the range which does not deviate from the main point of this invention is possible. For example, when a network device having a Web server function is connected locally to the gate device 2, the remote device 9 may directly access the network device after opening the port. Further, the control server 4 may be provided with the function of the remote terminal 9.

  As described above, according to the present embodiment, a service port number that is different every time a service is generated, and communication of that port number is limited to a transmission / reception source device, and data transmission / reception for service is performed. Open the port only when you want to do it. For this reason, it is extremely difficult to perform an open port search by port scanning. Further, the time required for data transmission / reception for device control or the like is usually about several seconds, and the time during which unauthorized access can be received is minimized. In addition, since communication is available every time a service is generated, real-time secure communication is possible in response to a remote request. As a result, it is possible to respond to real-time requests from various remote locations and to effectively prevent unauthorized access.

  In the above-described embodiment, the series of processes performed by the gate device 2, the control server 4 and the like are stored in a computer-readable recording medium in the form of a program. By executing this, the above processing is performed. That is, each processing means and processing unit in the gate device 2, the control server 4 and the like is such that a central processing unit such as a CPU reads the above program into a main storage device such as a ROM or RAM, and processes and processes information. It is realized by executing.

  Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

It is a block diagram which shows the structure of the network system to which this invention is applied. 2 is a block diagram showing a configuration of a gate device 2. FIG. 2 is a block diagram showing a configuration of a control server 4. FIG. It is a sequence diagram for demonstrating the operation | movement of this embodiment.

Explanation of symbols

1-1 to 1-3 Equipment 2 Gate device 2-1 Controller 2-2 FW & NAPT (firewall means)
2-3 Service application 3 IP network 4 Control server 4-1 Controller 4-2 FW & NAPT (firewall means)
5 IP network (closed network)
6 Service provider 7 Service server 8 Internet 9 Remote terminal A1, B1 Service port notification port (first port)
A2, B2 Service port (second port)

Claims (6)

A network service security system for remotely controlling a device connected to a home network by remote control means via a network based on a service provided by a service provider,
Via the network, the port number of the second port used for data transmission / reception for the service is notified using the first port that is always open every time a request for service is generated by the remote control means. A control server connected to the service server,
When the port number of the second port notified using the first port is received, the second port indicated by the notified port number is opened, and the service is transmitted using the second port. A network service security system comprising: a gate device connected to the device via the home network for transmitting and receiving data for a service with a server. In a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider.
A network service security system comprising a gate device that immediately closes an open port used for a service when the service ends. In a network service in which a device connected to a home network is remotely controlled by a remote control means via a network based on a service provided by a service provider.
A network service security system comprising a gate device that pays out a different port each time a port used for service is paid out. The control server
Service ID receiving means for receiving a service ID of a service requested by the remote control means;
A port open request means for transmitting a port open request including the service ID to the gate device,
The gate device is
An application correspondence table storage unit that stores the service ID and the application corresponding to the service ID in association with each other;
Based on the service ID included in the port open request, the corresponding application is read from the application identification storage unit, and the service data of the service ID received at the port number of the second port is the read application. Transfer setting means for generating and storing a transfer setting to be transferred to a port of the server, and notifying the control server of completion of port opening;
The service control means for notifying the application of the data of the service ID of the service ID to the application based on the transfer setting when the second port receives the service data. 3. The network service security system according to 3. The control server
5. The network service according to claim 4, wherein upon receiving a port open completion notification from the gate device, the address information of the gate device, the port number of the second port, and a session ID are notified to the service server. Security system. A network service security method for remotely controlling a device connected to a home network by a remote control means via a network based on a service provided by a service provider,
Whenever a service request is generated by the remote control means, the port number of the second port used for data transmission / reception for the service is sent via the network using the first port that is always open. Notify the gate device connected to the device via the home network from the control server connected to the service server,
The second port indicated by the port number of the second port notified using the first port is opened, and the gate device and the gate are connected via the control server using the second port. A network service security method comprising: transmitting and receiving data for a service to and from a service server; and closing the second port as soon as the service ends.

Images