JP2011086197A - Network security system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a low-cost and high-safety network security system for a content distribution system. <P>SOLUTION: Port control information is transmitted to a server side INS(R)-P dedicated terminal 20 from a client side INS(R)-P dedicated terminal 10 through a D channel of an ISDN line. The server side INS(R)-P dedicated terminal 20 opens/closes a predetermined port of a server 30 (or a router 40), according to port control information, and controls access of the server 30 that distributes content according to access from a client terminal 50. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  INDUSTRIAL APPLICABILITY The present invention is a network capable of improving the security of a device accessed from the outside or a private network by being used in network distribution represented by streaming distribution of moving images or distribution of data stored in storage. It relates to the security system.

  2. Description of the Related Art In recent years, the content distribution business via the Internet for moving image distribution and data supply has achieved remarkable growth with the increase in network speed and the performance of PCs (personal computers). In addition, this flow enables content distribution by end users, and there are cases where content such as moving images is distributed from home PCs, and it is now easier to build the environment year by year, so anyone can easily distribute content. Can be done.

  The distribution of content means that a large number of clients are allowed to access the private network, that is, there is a considerable possibility of unauthorized access. In order to prevent this, a firewall or a router having a firewall function is often used. Unnecessary access from the opened port can be prevented by closing unnecessary ports (network input / output interface) by the firewall and opening the minimum necessary ports.

  In recent years, there is a personal firewall that implements a firewall function on the PC itself, which can significantly improve security even in an end user network environment. For example, Patent Document 1 discloses a system that performs communication through a first port, performs opening / closing control of a second port, and provides a service through the second port. That is, when receiving a service on the network, a signal for opening the second port is transmitted from the service server to the first port of the control server, and the control server that receives the signal sends the signal to the second port. To make the service operational. When the service has been provided, the second port is automatically and immediately closed to realize real-time port opening / closing control, preventing unauthorized access without opening the port when not needed.

JP 2007-072856 A

  However, in the method of Patent Document 1, even though it is possible to prevent unauthorized access from the second port of the control server, the first port of the service server and the control server is always open. Is a port opened on a commonly used IP network, and means for preventing unauthorized access from the port needs to be provided separately.

  In addition, in a network environment for content distribution that has been used in the past, security may be invalidated by exploiting vulnerabilities such as the operating system and firewall used, and there is always a risk of unauthorized access. . In addition, since ports that have been set to open always remain open, they continue to be exposed to the risk of unauthorized access for a long time, giving them time to perform various operations and possibly expanding damage. .

  The present invention has been made in view of the above-mentioned problems, and realizes real-time control for opening a port by remote control other than the IP network, and closing the port when not necessary, and further provides such an environment. An object is to provide a network security system that can be realized at low cost.

The network security system according to claim 1, wherein a client connected to a server via the Internet sends a request to the server, and the server distributes content data to the client in response to the request.
A port control terminal connected to the server via a private network;
A port opening / closing instruction terminal connected by a communication line different from the port control terminal and the private network,
When port control information is transmitted from the port opening / closing instruction terminal and the port control terminal receives the port control information, the port control terminal issues a port opening instruction or a port closing instruction to the server, and the server instructs the port opening instruction. Alternatively, a predetermined port is opened and closed in response to a port closing instruction.

  According to the network security system configured as described above, a communication port of a server or a firewall serving as an entry route to a private network via the Internet can be opened and closed by a port control terminal connected via another communication line. . Furthermore, since the port control terminal opens and closes the port based on the port control information transmitted from the port opening and closing instruction terminal, the port can be opened and closed remotely.

  The network security system according to claim 2 is the network security system according to claim 1, wherein the port opening / closing instruction terminal and the port control terminal are INS-P dedicated transmission / reception terminals, and the port control information is a DDN of an ISDN line. It is transmitted through a channel.

  According to the network security system having the above configuration, the port opening / closing instruction terminal and the port control terminal are connected to the Internet and the private network, that is, the IP network without being connected to the IP network by using the INS-P terminal. Open control can be performed.

  The network security system according to claim 3 is the security system of the content distribution system according to claim 2, wherein the port opening / closing instruction terminal is a mobile phone, and the port control terminal is a mobile phone dedicated router. To do.

  According to the network security system having the above configuration, the port opening / closing instruction terminal is a mobile phone, and the port control terminal is a mobile phone dedicated router, so that port opening control can be performed without being connected to the IP network.

  According to the network security system of the first aspect of the present invention, the port control terminal for opening / closing the communication port of the server or firewall is installed inside the content distribution system, and the corresponding port opening / closing instruction terminal is installed outside. Since the port control information can be transmitted to the port control terminal from the port opening / closing instruction terminal to the port control terminal without going through the IP network consisting of the Internet and the private network, the content distribution system is installed to open and close the port. It can be done from a remote location, separate from the location where it will be. In addition, since the Internet is not used, a dedicated port is not opened other than the port for content distribution, so that security can be improved.

  According to the network security system according to claim 2 of the present invention, in the network security system according to claim 1, by using the INS-P terminal, a connectable INS-P terminal can be permitted in advance. The port can be opened and closed according to the situation, and unauthorized access by a third party can be prevented. In addition, since communication is performed via the D channel, the communication cost can be reduced.

  According to the network security system described in claim 3 of the present invention, in the content distribution system described in claim 1, since the port opening / closing instruction terminal is a mobile phone and the port control terminal is a mobile phone dedicated router, By registering the mobile phone number, the port control information can be received only from a specific mobile phone, and the port can be opened and closed, allowing the port to be opened and closed according to the situation, and by a third party Unauthorized access can be prevented.

It is explanatory drawing which shows the structure of the network security system in Example 1 of this invention. It is a sequence diagram which shows operation | movement of a network security system same as the above. It is explanatory drawing which shows the structure of the network security system in Example 2 of this invention.

  Hereinafter, an embodiment as the best mode for carrying out the present invention will be described with reference to FIGS. Of course, it goes without saying that the present invention can be easily applied to other than those described in the embodiments without departing from the spirit of the invention.

  1 and 2 show an embodiment of the present invention, and FIG. 1 is an explanatory diagram showing an outline of the configuration of a network security system in the present embodiment. FIG. 2 is a sequence diagram for explaining the operation of each apparatus.

  The configuration of the content distribution system according to the present embodiment will be described with reference to FIG. FIG. 1 shows a content distribution system and a security system for improving its security. Reference numeral 1 denotes a home network including a server and other network devices described later. Reference numerals 10 and 20 are INS-P control terminals, and both are communicably connected via the ISDN public network. A server 30 distributes content. A router 40 connects the home network 1 and the Internet. Reference numeral 50 denotes a client terminal that is connected to the server 30 via the Internet or the like to download content. Reference numeral 60 denotes a switching hub (SW hub) that is installed in the home network 1 and connects the apparatuses so that they can communicate with each other. Reference numeral 70 denotes a network camera that captures a moving image that is one type of content and transmits the moving image to the server 30 via the SW hub 60. The server 40, the router 40, the SW hub 60, and the network camera 70 are constructed as a LAN (Local Area Network) environment and are connected by a communicable cable such as a LAN cable.

  The server 30 always maintains a state in which the moving image of the network camera 70 can be distributed, for example, an introductory pair that can be distributed by streaming, and the user having the client terminal 50 desires to view the moving image taken by the network camera 70. In this case, after the server 30 receives the request from the client terminal 50, the server 30 transmits the moving image shot by the network camera 70 to the client terminal 50 by streaming. At that time, when viewing a moving image, a predetermined port, for example, a port such as 80 or 8080 of the server 30 or the router 40 must be opened, and access to the server 30 by the client terminal 50 via the port must be permitted. Don't be.

  The port opening should be kept to the minimum necessary from the viewpoint of security, but opening the port is an indispensable requirement for distributing contents to a specific or unspecified number of client terminals. The network security system according to this embodiment performs port opening at an arbitrary timing and enables the operation to be performed in a remote place.

  The operation of each device of the network security system in this embodiment will be described with reference to FIG. In the following description, it is assumed that the communication port of the server 30 is controlled. The network camera 70 always transmits moving image data shot toward the server 30 (S201). An ACK signal (port control information) on which a port opening instruction is superimposed is transmitted from the client-side INS-P dedicated terminal 10 to the server-side INS-P dedicated terminal 20 via the D channel of the ISDN line. (S202). Thereafter, all communications between the INS-P terminals are performed via the D channel of the ISDN line. The server-side INS-P dedicated terminal 20 sends a NACK signal indicating that the reception of the port control information is completed to the client-side INS-P dedicated terminal 10 (S203). The server-side INS-P dedicated terminal 20 that has received the ACK signal superimposed with the port opening instruction transmits a signal for opening the port to the server 30 via the SW hub 60 (S204). The server 30 opens the designated port, and transmits a signal indicating completion of port opening to the server-side INS-P dedicated terminal 20 (S205). The server 30 whose port opening has been completed can access the server 30 via the router 40 from the Internet (WAN: Wide Area Network) (S206), and acquires the moving image shot by the network camera 70 as streaming data. It becomes possible. (S207).

  After that, when it is desired to stop video distribution at an arbitrary timing, for example, an ACK signal for instructing port closure is transmitted from the client-side INS-P dedicated terminal 10 to the server-side INS-P dedicated terminal 20. . (S208). The server-side INS-P dedicated terminal 20 sends a NACK signal indicating that the reception of the signal is completed to the client-side INS-P dedicated terminal 10 (S209). The server-side INS-P dedicated terminal 20 that has received the ACK signal on which the port closing instruction is superimposed transmits a signal for closing the port to the server 30 via the SW hub 60 (S210). The server 30 closes the designated port, and transmits a signal indicating that the port closing is completed to the server side INS-P dedicated terminal 20 (S211). The server 30 whose port is closed rejects the access from the client 50 at that time, and stops the distribution of the moving image (S212).

  According to the network security system that performs the operations as described above, the opening and closing of ports is controlled by the ISDN line, which is a line different from the so-called IP network, such as the Internet and the LAN in the home network 1, so that unnecessary ports are opened. Since the user can control the port at any timing even if all the ports are closed in advance, the details can be opened if necessary and closed if unnecessary. Operation is possible, and security can be improved. In addition, the INS-P control terminals can uniquely set a target terminal for the communication and can refuse access of a third party terminal, so that stronger security can be obtained. be able to. In addition, since port control information is exchanged via the D channel of the ISDN line, it is possible to reduce operational costs without incurring communication costs.

  FIG. 3 shows a second embodiment of the present invention. The same parts as those in the first embodiment are denoted by the same reference numerals, and detailed description thereof is omitted. In the second embodiment, the client-side INS-P dedicated terminal 10 and the server-side INS-P dedicated terminal 20 in the first embodiment are replaced with a mobile phone 11 and a mobile phone dedicated router 21, respectively. The telephone number of the mobile phone 11 is registered in advance in the mobile phone dedicated router 21. By receiving an incoming call from the registered mobile phone 11, the mobile phone dedicated router opens and closes a predetermined port of the server 30 (or router 40). For example, when the port is closed and the content cannot be distributed, the mobile phone dedicated router 21 receives an incoming call from the mobile phone 11 and detects the open / closed state of a predetermined port of the server 30 and opens it. If closed, open. If closed, open. That is, in the first embodiment, the ACK signal transmitted via the D channel is the port control information, whereas in this embodiment, the incoming information of the mobile phone 11 is the port control information.

  Compared with the case where the above-described INS-P dedicated terminal is used, a communication fee is incurred for transmission / reception of port control information, and the operation cost increases, but a portable phone that can be easily carried is opened and closed. Since it can be used as an instruction terminal, content distribution start and stop can be controlled in real time at any location where mobile phone radio waves can reach, which greatly improves convenience.

  As described above, two types of embodiments of the present invention have been described in detail. However, the present invention is not limited to the first and second embodiments, and various modifications can be made within the scope of the present invention. It is. For example, the video taken by the network camera 70 is streamed and distributed as content. However, the present invention is not limited to this, and it is desired to distribute data such as a data file stored in an HDD provided in the server 30 or other storage connected to the LAN. It is possible to select data to be appropriately selected. In addition, the server side INS-P control terminal 20 or the mobile phone dedicated router 21 which is a port control terminal performs port control of the server 30. However, the present invention is not limited to this, and when a router 40 having a firewall function is used, The port control terminal is configured to control the opening and closing of the 40 ports, and when the port control of both the server 30 and the router 40 is necessary, the port control terminal may be configured to control both ports.

1 Home network 10 INS-P dedicated terminal for client side (port opening / closing instruction terminal)
11 Mobile phone (port opening / closing instruction terminal)
20 Server side INS-P dedicated terminal (port control terminal)
21 Mobile phone router (port control terminal)
30 server 40 router 50 client terminal 70 network camera

Claims (3)

In a content distribution system in which a client connected to a server via the Internet sends a request to the server, and the server distributes content data to the client in response to the request.
A port control terminal connected to the server via a private network;
A port opening / closing instruction terminal connected by a communication line different from the port control terminal and the private network,
When port control information is transmitted from the port opening / closing instruction terminal and the port control terminal receives the port control information, the port control terminal issues a port opening instruction or a port closing instruction to the server, and the server instructs the port opening instruction. Alternatively, a network security system that opens and closes a predetermined port upon receiving a port closing instruction.   2. The network security system according to claim 1, wherein the port opening / closing instruction terminal and the port control terminal are INS-P dedicated transmission / reception terminals, and the port control information is transmitted through a D channel of an ISDN line. . 2. The network security system according to claim 1, wherein the port opening / closing instruction terminal is a mobile phone, and the port control terminal is a mobile phone dedicated router.

Images