JP2016181874A - Communication control device and communication control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To respond to a cyber attack with a small processing load.SOLUTION: An HSS 200 of a communication control device 10 stores connection propriety information to identify a terminal the connection of which is permitted and a terminal the connection of which is rejected. A P-GW 300 performs processing to relay a connection request received from the terminal of which the connection is permitted to a request destination terminal and not to relay a connection request received from the terminal of which the connection is rejected to a request destination terminal on the basis of the connection propriety information. An attack terminal identification unit 110 of a P-CSCF 100 monitors communication, identifies a terminal that has performed a cyber-attack, and updates the connection propriety information stored in the HSS 200 so that connection of the terminal that has performed the cyber-attack is rejected.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a communication control device and a communication control method.

  In VoLTE that supports high-speed data communication, an IMS network that provides a multimedia service and a user apparatus communicate directly using IP, and thus there is a threat of cyber attacks from the partner apparatus.

  As a technique for protecting against cyber attacks, Patent Document 1 discloses a technique for preventing data falsification and impersonation using an authentication protocol using a plurality of authentication parameters.

JP 2009-26215 A

  The technology disclosed in Patent Document 1 verifies whether or not all the received communications correspond to a cyber attack. Therefore, even if a cyber attack is received multiple times from the same counterpart device, it is necessary to determine that the cyber attack is being performed each time, and the processing load is large.

  The present invention has been made in view of the above situation, and an object thereof is to provide a communication control apparatus and a communication control method that can cope with a cyber attack with a small processing load.

In order to achieve the above object, a communication control apparatus according to the first aspect of the present invention provides:
Storage means for storing connection enable / disable information for identifying terminals that are permitted to connect and terminals that are prohibited;
Based on the connection permission information stored in the storage means, relays the connection request received from the terminal permitted to connect to the request destination terminal, and requests the connection request received from the terminal prohibited from connection. A communication connection means for performing processing that does not relay to the previous terminal;
A connection availability information updating unit that monitors communication, identifies a terminal that performed a cyber attack, and updates the connection availability information stored in the storage unit so as to prohibit connection of the terminal that performed the cyber attack; ,
It is characterized by providing.

In order to achieve the above object, a communication control method according to the second aspect of the present invention includes:
A communication control method for blocking a connection request transmitted from a terminal that has made a cyber attack in the past,
Storing connection permission / rejection information for identifying a terminal that permits connection and a terminal that is prohibited;
A process of relaying a connection request received from a terminal permitted to be connected to the request destination terminal and not relaying a connection request received from a terminal prohibited from being connected to the request destination terminal based on the connection permission information A process of performing
Monitoring the communication, identifying the terminal that performed the cyber attack, and updating the connection permission information so as to prohibit connection of the terminal that performed the cyber attack;
including.

  According to the present invention, it is possible to cope with a cyber attack with a small processing load.

1 is a block diagram illustrating a configuration example of a network system according to a first embodiment. It is a figure of the user information containing the connection availability information memorize | stored in HSS. 2 is a block diagram illustrating a configuration example of a P-GW according to Embodiment 1. FIG. It is a block diagram which shows the structural example of P-CSCF which concerns on Embodiment 1. FIG. It is a block diagram which shows the structural example of an attack terminal specific | specification part. It is a sequence diagram which permits the connection request | requirement transmitted to P-GW from the other party apparatus. It is a sequence diagram which does not permit the connection request transmitted to P-GW from the other party apparatus. It is a sequence diagram which registers the address of the other party apparatus which performed the cyber attack with HSS. It is a flowchart for demonstrating the process of the connection request transmitted from the other party apparatus. It is a block diagram which shows the structural example of P-GW which concerns on the modification 1. FIG. It is a block diagram which shows the structural example of the network system which concerns on Embodiment 2. FIG. It is a sequence diagram which permits the connection request | requirement transmitted to the P-CSCF from the other party apparatus. It is a sequence diagram which does not permit the connection request | requirement transmitted to the P-CSCF from the other party apparatus. It is a sequence diagram which registers the address of the other party apparatus which performed the cyber attack with respect to P-CSCF with HSS.

  Hereinafter, a communication control device and a communication control method according to an embodiment of the present invention will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the part which is the same or it corresponds in drawing.

(Embodiment 1)
A network system to which the communication control apparatus according to the first embodiment is applied will be described with reference to FIG. The network system 1 according to the first embodiment includes a communication control device 10 and a plurality of terminals. In the present embodiment, a terminal that performs a cyber attack will be described as a partner apparatus 700, and a terminal that receives a cyber attack will be described as a user terminal 600. The user terminal 600 and the partner apparatus 700 include electronic devices having communication functions such as mobile terminals, servers, and computers.

  The communication control device 10 includes a user terminal connection device P-CSCF (Proxy Call Session Control Function) 100, a home subscriber information server HSS (Home Subscriber Server, registered terminal storage means) 200, a packet data network gateway device. P-GW (Packet data network Gateway, network connection means) 300. The P-CSCF 100 performs a connection process between the user terminal 600 and the communication control apparatus 10. The HSS 200 manages user information such as a user ID and terminal information (a MAC address and contract number for identifying a terminal). The P-GW 300 performs a connection process between the external network 800 and the communication control apparatus 10. The P-CSCF 100 and the P-GW 300 function as a communication connection unit that connects the partner device 700 that makes a connection request via the network and the user terminal 600.

  When there is a communication connection request from the counterpart device 700 to the user terminal 600 connected to the communication control device 10 via the external network 800, the P-GW 300 connects the counterpart device 700 with the device in the communication control device 10. The HSS 200 is inquired as to whether or not connection is possible. The HSS 200 determines whether or not connection is possible with reference to user information (including connection permission / inhibition information) registered in its own device. If it is determined that the connection can be made, the HSS 200 transmits a connection permission notification to the P-GW 300. The P-GW 300 that has received the connection permission notification relays the communication connection request received from the partner apparatus 700 to the P-CSCF 100. Then, the P-CSCF 100 to which the connection request is relayed relays the connection request to the user terminal 600 to which the counterpart device 700 has transmitted the connection request. When the user terminal 600 accepts the connection request, voice communication or data communication is established between the counterpart device 700 and the user terminal 600. On the other hand, when the HSS 200 determines that the connection is prohibited, the HSS 200 transmits a connection prohibition notification to the P-GW 300. The P-GW 300 that has received the connection prohibition notification transmits a connection unestablished notification to the partner apparatus 700.

  Further, the communication control device 10 determines whether or not the partner device 700 has performed a cyber attack, and if it is determined that a cyber attack has been performed, an address (for example, a MAC address) for identifying the partner device 700 It has a function to specify. Then, by registering the specified address in the HSS 200 as a connection prohibition target address (connection enable / disable information), the communication control device 10 eliminates subsequent connection requests transmitted from the partner device 700 that performed the cyber attack. . Thus, the communication control apparatus 10 protects the user terminal 600 connected to the own apparatus and the own apparatus from the cyber attack.

  Next, the configurations of the HSS 200, the P-GW 300, and the P-CSCF 100 that constitute the communication control apparatus 10 will be sequentially described.

  The HSS 200 is a home subscriber information server that manages user information such as a user ID and terminal location information. The user information stored in the HSS 200 includes a MAC address unique to the user terminal illustrated in FIG. 2 and a connection enable / disable flag (connection enable / disable information) indicating whether to permit connection between the user terminal and the communication control apparatus 10. The connection enable / disable flag permits a connection request when there is a communication connection request from the partner apparatus 700 whose connection enable / disable flag is “0” to the communication control apparatus 10, and does not permit a connection request when it is “1”. Indicates. For example, the HSS 200 sets a connection flag of a user terminal corresponding to a user terminal that performed a cyber attack, a user terminal that has not yet been charged, or an abnormal terminal (such as a faulty terminal that does not accept control such as transmission power control) to “1” (connection Set to Prohibited.

  Next, the P-GW 300 shown in FIG. 1 will be described with reference to FIG. The P-GW 300 has a function of connecting the external network 800 and the communication control apparatus 10 and is configured by a CPU, a RAM, and the like (not shown). Functionally, it includes a connection processing unit 310 and a connection control unit 320.

  The connection processing unit 310 acquires the transmission source address described in the header part of the connection request packet received from the partner apparatus 700 and supplies the acquired address to the connection control unit 320. The connection control unit 320 sends the supplied address to the HSS 200. Then, the connection control unit 320 receives a notification of connection availability from the HSS 200, and controls whether or not to relay the connection request of the counterpart device 700 to the P-CSCF 100 based on the notification. Specifically, when the connection permission notification is received from the HSS 200, the connection control unit 320 controls the connection processing unit 310 so as to relay the connection request of the counterpart device 700 to the P-CSCF 100. When the connection prohibition notification is received, the connection control unit 320 controls the connection processing unit 310 so that the connection processing unit 310 transmits a connection unestablished notification to the partner apparatus 700.

  Next, the P-CSCF 100 will be described with reference to FIG. The P-CSCF 100 has a function of connecting the user terminal 600 and the communication control apparatus 10 and is configured by a CPU, a RAM, and the like (not shown). Specifically, a connection request addressed to user terminal 600 is relayed from partner apparatus 700 and a communication connection request addressed to partner apparatus 700 is received from user terminal 600. Further, it is determined whether or not a cyber attack has occurred from the partner device 700. If a cyber attack has been performed, the address of the partner device 700 that has performed the cyber attack is notified to the HSS 200 as a connection prohibition target address. In order to realize the function of updating this connection availability information (connection availability information updating means), the P-CSCF 100, as shown in FIG. 4, the attack terminal identification unit 110, the connection prohibition target address acquisition unit 120, and the notification unit 130 The connection processing unit 140 is provided.

  The attacking terminal specifying unit 110 monitors the packet relayed from the P-GW 300 and determines whether or not the transmission of the packet by the counterpart device 700 does not correspond to the cyber attack. And when it corresponds to a cyber attack, the transmission source address of the other party apparatus 700 which transmitted the applicable packet is specified. Specifically, the attack terminal identification unit 110 has a function of detecting a cyber attack that centrally transmits a large number of accesses, and a function of detecting falsification / spoofing of an IP address or the like. In order to realize these functions, the attack terminal identification unit 110 includes an address detection unit 111, a packet count unit 112, an attack terminal address acquisition unit 113, and a falsification / spoofing detection unit 114, as shown in FIG. .

The address detection unit 111 monitors packets transmitted from the P-GW 300. In the header of the monitored packet, information for specifying a user ID and a MAC address for specifying the transmission source device is described. The address detection unit 111 distributes the monitored packets for each of these addresses.
The packet count unit 112 counts the number of monitored packets for each address. Then, when the number of packets for each allocated address within the unit time is equal to or greater than the threshold, it is determined that a cyber attack has been performed. For example, it is determined that a cyber attack has been performed when there are 100 or more connection requests from the same address within one hour.
The attacking terminal address acquisition unit 113 acquires the transmission source address described in the header part of the packet transmitted by the counterpart terminal 700 that the packet count counting unit 112 has determined to be a cyber attack, and notifies the acquired address to the notification unit 130. To supply.

  The falsification / spoofing detection unit 114 detects a packet corresponding to falsification / spoofing for each packet distributed by the address detection unit 111. The tampering / spoofing detection method is arbitrary. For example, a technique disclosed in Patent Document 1 (Japanese Patent Laid-Open No. 2009-26215) may be used. Then, the falsification / spoofing detection unit 114 supplies the detected packet to the attack terminal address acquisition unit 113. The attacking terminal address acquisition unit 113 acquires the transmission source address described in the header part of the packet that is determined to be a cyber attack by the falsification / spoofing detection unit 114 and supplies the acquired address to the notification unit 130.

  Returning to FIG. 4, the connection prohibition target address acquisition unit 120 acquires, from the user terminal 600 connected to the communication control apparatus 10, the transmission source address of the partner apparatus 700 that has determined that the user terminal 600 is a cyber attack. .

  The notification unit 130 notifies the HSS 200 of the address detected by the attack terminal identification unit 110 and the address acquired by the connection prohibition target address acquisition unit 120.

  The connection processing unit 140 relays the connection request of the partner terminal 700 relayed from the P-GW 300 to the user terminal 600.

  Next, a sequence in which the communication control apparatus 10 having the above configuration processes a connection request will be described with reference to FIGS.

  First, the case where the connection request transmitted from the partner apparatus 700 is permitted will be described with reference to FIG. For example, this is a case where there is a connection request from a terminal whose MAC address shown in FIG. 2 is MAC-A1. In the user information shown in FIG. 2, the MAC address (MAC-A1) described in the header part of the received connection request packet is registered, and the connection permission flag is set to “0” (connection permission). Has been.

  When the partner apparatus 700 makes a connection request to the P-GW 300 via the network 800 (step S11), the P-GW 300 is the address where the transmission source address (MAC-A1) of the received connection request packet is already registered. In addition, the HSS 200 is inquired whether it is a connection prohibition target address (step S12). The HSS 200 collates the user information shown in FIG. 2 with the address that received the inquiry, and confirms whether or not the connection is possible (step S13). Since the MAC-A1 is registered in the HSS 200 and the connection permission flag is set to “0” (connection permission), the HSS 200 transmits a connection permission notification to the P-GW 300 (step S14). The P-GW 300 that has received the connection permission notification relays the connection request to the P-CSCF 100 so that the partner apparatus 700 and the user terminal 600 can perform packet communication (step S15).

  Next, a case where the connection request transmitted from the partner apparatus 700 is not permitted will be described with reference to FIG. For example, there is a connection request from a terminal whose MAC address shown in FIG. 2 is MAC-A2. In the user information shown in FIG. 2, the connection availability flag corresponding to MAC-A2 is set to “1” (connection prohibited).

  When the partner apparatus 700 makes a connection request to the P-GW 300 via the network 800 (step S21), the P-GW 300 is the address where the transmission source address (MAC-A2) of the received connection request packet is already registered. In addition, the HSS 200 is inquired as to whether the address is a connection prohibition target address (step S22). The HSS 200 collates the user information shown in FIG. 2 with the address that has received the inquiry, and confirms whether or not the connection is possible (step S23). In the case of MAC-A2, since the connection permission flag is set to “1” (connection prohibited), the HSS 200 transmits a connection prohibition notification to the P-GW 300 (step S24). The P-GW 300 that has received the connection prohibition notification does not relay the connection request to the P-CSCF 100, but transmits a connection unestablished notification to the counterpart device 700 (step S25). The connection request may be rejected without performing the notification in step S25.

  Next, a sequence when a cyber attack from the partner apparatus 700 is detected after permitting a connection request will be described with reference to FIG. In this case, when the P-GW 300 performs the connection process, the connection availability flag corresponding to the partner apparatus 700 is “0” (connection permitted), and the connection process described with reference to FIG. 6 is performed. Is called. When the communication control device 10 detects that the partner device 700 is performing a cyber attack after communication is started between the partner device 700 and the user terminal 600 connected to the communication control device 10. This is the sequence.

  When the partner device 700 performs a cyber attack during communication (step S31), the attack terminal identification unit 110 in the P-CSCF 100 monitors the packet transmitted by the partner device 700, so that the partner device 700 performs a cyber attack. It is discriminate | determined whether it is (step S32). Specifically, the number of packets per unit time transmitted by the partner apparatus 700 is counted, and when the number of packets is equal to or greater than a threshold, it is determined that the partner apparatus 700 has performed a cyber attack.

  The attacking terminal identifying unit 110 that has determined that a cyber attack has been performed identifies the source address described in the header portion of the packet transmitted by the partner device 700 and supplies the identified address to the notifying unit 130. The notification unit 130 notifies the HSS 200 that the identified address is a connection prohibition target address (step S33). Upon receiving the notification, the HSS 200 registers the received address as a connection prohibition target address (step S34). For example, when the partner device 700 whose MAC address is MAC-A4 has made a cyber attack, the HSS 200 changes the connection permission flag corresponding to MAC-A4 shown in FIG. 2 from “0” (connection permission) to “1” ( Change to (Prohibit connection).

  The HSS 200 that has changed the connection availability flag notifies the P-GW 300 of the changed flag information (connection availability information) (step S35). The P-GW 300 that has received the connectability information disconnects communication between the partner device 700 of the corresponding address and the own device (step S36).

  In this way, the communication control apparatus 10 disconnects the partner apparatus 700 that has performed the cyber attack from the own apparatus. Next, even if the same counterpart device 700 makes a communication connection request, the communication control device 10 will be described with reference to FIG. 7 because the connection permission flag shown in FIG. 2 is set to “1” (connection prohibited). Process that does not allow the connection request. Therefore, the partner terminal 700 that has made a cyber attack in the past is never connected to the communication control device 10. Note that the processing of step S35 and step S36 may be omitted when the connection is prohibited from the next connection request without disconnecting the communication once connected.

  Next, connection request processing performed by the communication control apparatus 10 will be described with reference to FIG. The flowchart shown in FIG. 9 is started when the P-GW 300 receives a communication connection request from the partner apparatus 700 via the network.

  When the P-GW 300 receives a communication connection request from the counterpart device 700 (step S41), the P-GW 300 acquires the transmission source address of the counterpart device 700 described in the header portion of the received packet (step S42). . Then, the HSS 200 is inquired as to whether or not the acquired address is an address permitted to connect to the P-GW 300 (step S43).

  The HSS 200 compares the user information shown in FIG. 2 to determine whether or not the address that has been queried is an address that is permitted to be connected (step S44). Specifically, when the transmitted address is a pre-registered address and the connection enable / disable flag is “0” (connection permission) (step S44: Yes), the HSS 200 permits connection to the P-GW 300. A notification is transmitted (step S45). The P-GW 300 that has received the connection permission notification relays the connection request to the P-CSCF 100, and performs connection processing so that the partner apparatus 700 and the user terminal 600 can perform packet communication (step S46).

  On the other hand, if the address that has been inquired is an address that has not been registered in advance, or if the address has been registered but the connectability flag is set to “1” (connection prohibited) (step S44: No), The HSS 200 transmits a connection prohibition notification to the P-GW 300 (step S47). Receiving the connection prohibition notification, the P-GW 300 does not relay the connection request to the P-CSCF 100, but transmits a connection unestablished notification to the counterpart device 700 (step S48). Above, description of the connection process of the communication control apparatus 10 is completed.

  As described above, when the communication control apparatus 10 according to the first embodiment identifies the transmission source address of the partner apparatus 700 that has performed the cyber attack, the communication control apparatus 10 stores the identified address in the HSS 200 as the connection prohibition target address. The P-GW 300 checks the connection availability flag (connection availability information) registered in the HSS 200 every time a new connection process is performed. Therefore, even if the next cyber attack is set from the same counterpart device 700, the communication control device 10 The P-GW 300 blocks the connection request transmitted from the partner apparatus 700. Therefore, the communication control device 10 does not perform connection processing or cyber attack detection processing of the partner device 700 that has made a cyber attack in the past. Thereby, it is possible to prevent an increase in the processing load on the communication control device 10 or a server connected to the communication control device 10 even if the same partner device 700 makes a cyber attack.

(Modification 1)
In the first embodiment, the attack terminal identifying unit 110 is provided in the P-CSCF 100 and a received packet is monitored to detect that the partner apparatus 700 has performed a cyber attack. However, the location where cyber attacks are detected need not be limited to this. For example, an attack detection function may be provided in the P-GW 300.

  The apparatus configuration of the P-GW 300 when the attack terminal specifying unit 110 is provided in the P-GW 300 (hereinafter, the P-GW provided with the attack terminal specifying unit 110 is referred to as P-GW 301) was performed in the first embodiment. Description will be made with reference to FIG. The P-GW 301 according to the first modification includes an attack terminal specifying unit 110 and a notification unit 130. Other configurations are the same as those described in the first embodiment. The attacking terminal identifying unit 110 monitors the packets received from the network 800 and counts the number of packets distributed for each source address described in the packet header. When the number of packets with the same address monitored within the unit time is equal to or greater than the threshold, the attacking terminal identifying unit 110 determines that the partner device 700 that has transmitted the corresponding packet is performing a cyber attack. Then, the transmission source address of the partner apparatus 700 determined to be performing a cyber attack is notified to the HSS 200 via the notification unit 130.

  Receiving the notification, the HSS 200 sets a connection enable / disable flag corresponding to the partner apparatus 700 to “1” (connection prohibited). The P-GW 300 confirms the connection availability flag stored in the HSS 200. If the connection availability flag is “1” (connection prohibited), the P-GW 300 does not permit the connection request. Therefore, the partner device 700 that once made a cyber attack is never connected to the communication control device 10.

(Embodiment 2)
In the description of the first embodiment and the first modification, the case where there is a connection request from the partner apparatus 700 via the external network 800 has been described. In the second embodiment, a case where the counterpart apparatus 700 directly makes a communication connection request to the P-CSCF 100 without going through the external network 800 will be described with reference to FIGS. Also in the second embodiment, a terminal that performs a cyber attack will be described as a partner apparatus 700, and a terminal that receives a cyber attack will be described as a user terminal 600.

  First, a network system configuration according to the second embodiment will be described with reference to FIG. In the second embodiment, when the counterpart device 700 communicates with the user terminal 600, the counterpart device 700 makes a connection request to the P-CSCF 100b. And P-CSCF100b which received the connection request relays a connection request to the user terminal 600 connected to an own apparatus. This relay route is indicated by route 1 in FIG. In other cases, the partner apparatus 700 makes a connection request to the P-CSCF 100b, and the P-CSCF 100b that has received the connection request relays the connection request to another P-CSCF 100a. Then, the P-CSCF 100a that has received the relay relays the connection request to the user terminal 600 connected to the own device. This relay route is shown as route 2 in FIG. In other cases, the partner apparatus 700 makes a connection request to the P-CSCF 100b, and the P-CSCF 100b relays the connection request to the user terminal 600 connected to the network 800 via the P-GW 300. This relay route is indicated by route 3 in FIG.

  In any case, the P-CSCF 100b that has received the connection request inquires of the HSS 200 whether or not the partner apparatus 700 is a terminal that is permitted to connect to the P-SCF 100b. First, a sequence for permitting a connection request for the connection route 1 will be described with reference to FIG. In this case, the user information stored in the HSS 200 includes an address described in the header part of the received connection request packet of the partner apparatus 700, and the corresponding connection permission flag is “0” (connection permission). Is set to

  When the partner device 700 makes a connection request to the P-CSCF 100b (step S51), the P-CSCF 100b is that the transmission source address of the received connection request packet is a registered address or the connection is not prohibited. Is inquired of the HSS 200 (step S52). The HSS 200 collates the registered user information with the address that has received the inquiry, and confirms whether or not the connection is possible (step S53). Since the connection permission flag is “0” and the address is a connection permission target, the HSS 200 transmits a connection permission notification to the P-CSCF 100b (step S54). The P-CSCF 100b that has received the connection permission notification relays the connection request to the user terminal 600 connected to the own device. Then, the partner apparatus 700 and the user terminal 600 are allowed to perform packet communication (step S55).

  In the case of the relay route 2, the relay destination of the connection request in step S55 is not the partner apparatus 700 but another P-CSCF 100a, but the other processes are the same. In the case of the relay route 3, the relay destination of the connection request in step S55 is not the partner apparatus 700 but the P-GW 300, but the other processes are the same.

  Next, a case where the connection request transmitted from the partner apparatus 700 is not permitted will be described with reference to FIG. In this case, the connection availability flag corresponding to the received address is set to “1” (connection prohibited).

  When the partner apparatus 700 makes a connection request to the P-CSCF 100b (step S61), the P-CSCF 100b has received a connection request packet whose source address is a registered address, and connection is not prohibited. Is inquired of the HSS 200 (step S62). The HSS 200 collates the registered user information with the address that has received the inquiry, and confirms whether or not the connection is possible (step S63). Since the connection permission flag is “1” and the address is a connection prohibition target, the HSS 200 transmits a connection prohibition notification to the P-CSCF 100b (step S64). The P-CSCF 100b that has received the connection prohibition notification transmits a connection unestablished notification to the counterpart device 700 (step S65).

  Next, a sequence when a cyber attack from the partner apparatus 700 is detected after connection will be described with reference to FIG. When the partner device 700 performs a cyber attack during communication (step S71), the attack terminal identifying unit 110 in the P-CSCF 100b monitors the packet transmitted by the partner device 700, so that the partner device 700 performs a cyber attack. It is discriminate | determined whether it is (step S72). The attacking terminal specifying unit 110 that has determined that a cyber attack is being performed acquires the transmission source address described in the header portion of the corresponding packet, and supplies the acquired address to the notification unit 130. The notification unit 130 notifies the HSS 200 that the address is a connection prohibition target address (step S73). Receiving the notification, the HSS 200 registers the received address as a connection prohibition target address (step S74). For example, when receiving a notification that the partner device 700 corresponding to MAC-A4 shown in FIG. 2 has made a cyber attack, the HSS 200 sets the connection permission flag corresponding to MAC-A4 shown in FIG. Change from “permitted” to “1” (connection prohibited).

  The HSS 200 that has changed the connection availability flag notifies the P-CSCF 100b of the changed flag information (connection availability information) (step S75). The P-CSCF 100b that has received the connectability information disconnects communication with the counterpart device 700 of the corresponding address (step S76).

  As described above, when the communication control apparatus 10 according to the second embodiment determines that the partner terminal 700 connected to the P-CSCF 100 has performed a cyber attack, the communication control apparatus 10 specifies the address of the partner apparatus 700 and the address Is stored in the HSS 200 as a connection prohibition target address. Since the P-CSCF 100 checks the connection availability flag (connection availability information) registered in the HSS 200 every time a new connection process is performed, even if the next cyber attack is set by the same partner device 700, the communication control device 10 Blocks the connection request at the P-CSCF 100. Therefore, the communication control device 10 does not perform connection processing or cyber attack detection processing of the partner device 700 that has made a cyber attack in the past. Thereby, it is possible to prevent an increase in the processing load on the communication control device 10 or a server connected to the communication control device 10 even if the same partner device 700 makes a cyber attack.

  In the above description of the first and second embodiments and the first modification, the case has been described in which whether or not the P-GW 300 or the P-CSCF 100 can directly connect to the HSS 200 is confirmed. However, the scope of the present invention is not limited to the above embodiment. When the user terminal is a mobile terminal, the P-GW 300 or the P-CSCF 100 sets a mobility management server (Mobility Management Entity: hereinafter abbreviated as MME) that manages the location information of the user terminal when setting communication with the user terminal. ) To confirm the location information of the user terminal. Then, the user information may be confirmed with the HSS 200 via the MME. An embodiment in which the HSS 200 is inquired via the MME is also included in the present invention.

In the above description, the case where the connection prohibition target address is stored in the HSS 200 has been described. However, the connection prohibition target address is stored in the MME, and when the P-GW 300 or P-CSCF 100 makes an inquiry to the MME, the partner device 700 connects to the P-GW 300 or P-CSCF 100 from the MME. You may make it notify that it is an apparatus.
In addition, the connection prohibition target address is stored in the storage unit in the P-GW 300 or the P-CSCF 100, and the connection processing unit 140 or the connection processing unit 310 refers to the information so that the partner device 700 that has performed the cyber attack The connection may not be made.

  Part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1)
Storage means for storing connection enable / disable information for identifying terminals that are permitted to connect and terminals that are prohibited;
Based on the connection permission information stored in the storage means, relays the connection request received from the terminal permitted to connect to the request destination terminal, and requests the connection request received from the terminal prohibited from connection. A communication connection means for performing processing that does not relay to the previous terminal;
A connection availability information updating unit that monitors communication, identifies a terminal that performed a cyber attack, and updates the connection availability information stored in the storage unit so as to prohibit connection of the terminal that performed the cyber attack; ,
A communication control apparatus comprising:

(Appendix 2)
The communication connection means includes
Network connection means having a function of connecting the communication network and the communication control device;
User terminal connection means having a function of connecting the communication control device and the user terminal;
The communication control device according to supplementary note 1, comprising:

(Appendix 3)
The connection availability information update unit monitors a packet transmitted and received in communication based on a connection request relayed by the communication connection unit, and identifies a terminal that has performed the cyber attack based on the monitored packet.
The communication control apparatus according to Supplementary Note 1 or 2, characterized in that:

(Appendix 4)
The connectability information update means includes:
Monitor communication packets, detect centralized access, impersonation, or tampering,
Identify the terminal that has performed any of centralized access, impersonation, and falsification, and update the connection availability information stored in the storage means so as to prohibit the connection of the identified terminal.
4. The communication control apparatus according to any one of appendices 1 to 3, wherein

(Appendix 5)
The connectability information update unit detects an address that identifies a transmission source attached to a packet transmitted / received by communication, and a threshold value when the number of packets of the same address received per unit time is equal to or greater than the threshold value. Identify the terminal that transmitted the above number of packets as the terminal that performed the cyber attack,
The communication control device according to any one of appendices 1 to 4, characterized in that:

(Appendix 6)
It further comprises acquisition means for acquiring the address of the terminal that performed the cyber attack from another device,
The connection availability information update means updates the connection availability information stored in the storage means so as to prohibit connection with the terminal of the address acquired by the acquisition means.
The communication control device according to any one of appendices 1 to 5, characterized in that:

(Appendix 7)
The communication connection means includes
Connected to a communication network and one or more second terminals that communicate with the first terminal connected to the communication network via the communication control device;
A terminal that receives a connection request for the second terminal as a request destination from the first terminal via the communication network and is permitted to connect based on the connection permission information stored in the storage unit Relay the connection request received from the requesting terminal, and do not relay the connection request received from the terminal prohibited from connecting to the requesting terminal.
The communication control device according to any one of appendices 1 to 6, characterized in that:

(Appendix 8)
The communication connection means includes
Connection received from one of the second terminals from a terminal that is permitted to connect based on the connection availability information stored in the storage means, to a connection request addressed to any other of the second terminal The request is relayed to the requested terminal, and the connection request received from the terminal whose connection is prohibited is not relayed to the requested terminal.
The connectability information update means includes:
Monitoring the relayed communication to identify the terminal that made the cyber attack, and updating the connection permission information stored in the storage means so as to prohibit the connection of the terminal that made the cyber attack,
The communication control apparatus according to appendix 7, characterized by:

(Appendix 9)
A communication control method for blocking a connection request transmitted from a terminal that has made a cyber attack in the past,
Storing connection permission / rejection information for identifying a terminal that permits connection and a terminal that is prohibited;
A process of relaying a connection request received from a terminal permitted to be connected to the request destination terminal and not relaying a connection request received from a terminal prohibited from being connected to the request destination terminal based on the connection permission information A process of performing
Monitoring the communication, identifying the terminal that performed the cyber attack, and updating the connection permission information so as to prohibit connection of the terminal that performed the cyber attack;
Including a communication control method.

DESCRIPTION OF SYMBOLS 1 ... Network system, 10 ... Communication control apparatus, 100 ... P-CSCF, 100a ... P-CSCF, 100b ... P-CSCF, 110 ... Attack terminal specific | specification part, 111 ... Address detection part, 112 ... Packet number count part, 113 ... attack terminal address acquisition unit, 114 ... falsification / spoofing detection unit, 120 ... connection prohibition target address acquisition unit, 130 ... notification unit, 140 ... connection processing unit, 200 ... HSS, 300 ... P-GW, 301 ... P-GW , 310 ... connection processing unit, 320 ... connection control unit, 600 ... user terminal, 700 ... partner device, 800 ... network

Claims (9)

Storage means for storing connection enable / disable information for identifying terminals that are permitted to connect and terminals that are prohibited;
Based on the connection permission information stored in the storage means, relays the connection request received from the terminal permitted to connect to the request destination terminal, and requests the connection request received from the terminal prohibited from connection. A communication connection means for performing processing that does not relay to the previous terminal;
A connection availability information updating unit that monitors communication, identifies a terminal that performed a cyber attack, and updates the connection availability information stored in the storage unit so as to prohibit connection of the terminal that performed the cyber attack; ,
A communication control apparatus comprising: The communication connection means includes
Network connection means having a function of connecting the communication network and the communication control device;
User terminal connection means having a function of connecting the communication control device and the user terminal;
The communication control device according to claim 1, further comprising: The connection availability information update unit monitors a packet transmitted and received in communication based on a connection request relayed by the communication connection unit, and identifies a terminal that has performed the cyber attack based on the monitored packet.
The communication control apparatus according to claim 1 or 2, characterized by the above. The connectability information update means includes:
Monitor communication packets, detect centralized access, impersonation, or tampering,
Identify the terminal that has performed any of centralized access, impersonation, and falsification, and update the connection availability information stored in the storage means so as to prohibit the connection of the identified terminal.
The communication control device according to any one of claims 1 to 3, wherein The connectability information update unit detects an address that identifies a transmission source attached to a packet transmitted / received by communication, and a threshold value when the number of packets of the same address received per unit time is equal to or greater than the threshold value. Identify the terminal that transmitted the above number of packets as the terminal that performed the cyber attack,
The communication control apparatus according to any one of claims 1 to 4, wherein the communication control apparatus includes: It further comprises acquisition means for acquiring the address of the terminal that performed the cyber attack from another device,
The connection availability information update means updates the connection availability information stored in the storage means so as to prohibit connection with the terminal of the address acquired by the acquisition means.
The communication control apparatus according to any one of claims 1 to 5, wherein the communication control apparatus includes: The communication connection means includes
Connected to a communication network and one or more second terminals that communicate with the first terminal connected to the communication network via the communication control device;
A terminal that receives a connection request for the second terminal as a request destination from the first terminal via the communication network and is permitted to connect based on the connection permission information stored in the storage unit Relay the connection request received from the requesting terminal, and do not relay the connection request received from the terminal prohibited from connecting to the requesting terminal.
The communication control apparatus according to any one of claims 1 to 6, wherein the communication control apparatus includes: The communication connection means includes
Connection received from one of the second terminals from a terminal that is permitted to connect based on the connection availability information stored in the storage means, to a connection request addressed to any other of the second terminal The request is relayed to the requested terminal, and the connection request received from the terminal whose connection is prohibited is not relayed to the requested terminal.
The connectability information update means includes:
Monitoring the relayed communication to identify the terminal that made the cyber attack, and updating the connection permission information stored in the storage means so as to prohibit the connection of the terminal that made the cyber attack,
The communication control apparatus according to claim 7. A communication control method for blocking a connection request transmitted from a terminal that has made a cyber attack in the past,
Storing connection permission / rejection information for identifying a terminal that permits connection and a terminal that is prohibited;
A process of relaying a connection request received from a terminal permitted to be connected to the request destination terminal and not relaying a connection request received from a terminal prohibited from being connected to the request destination terminal based on the connection permission information A process of performing
Monitoring the communication, identifying the terminal that performed the cyber attack, and updating the connection permission information so as to prohibit connection of the terminal that performed the cyber attack;
Including a communication control method.

Images