JP5171300B2 - Specification conformity verification device - Google Patents

Description

   The present invention checks whether a message (message) sent by a communication device matches a rule (hereinafter referred to as a rule) created in advance based on the specification of a predetermined communication protocol (referred to as a communication method). Thus, the present invention relates to a specification conformity verification device for verifying whether the message transmission operation of the communication device conforms to the above specifications.

  For example, when providing a VoIP communication service, generally, a plurality of communication devices that transmit and receive messages using a communication protocol such as SIP are prepared, and these are arranged on the communication network to construct a communication service network. .

  In providing or developing the communication service as described above, it is necessary to confirm that the communication device that will constitute the communication service network operates properly according to the specifications of the communication protocol and the specifications specific to the communication service. .

  As one of the methods for performing such confirmation, a message equivalent to the message used in the actual communication service is transmitted to the communication device (referred to as the device to be verified) and returned from the device to be verified. There is a method for verifying in a verification device whether or not the content of a message complies with a rule created in advance based on a communication protocol or the like.

There are Patent Documents 1 and 2 as prior art documents related to the present application.
JP 2001-103123 A JP 2004-248192 A

  When verification is performed by the above method, rule data indicating a rule is stored in the verification device. This rule data is created based on the communication protocol standards, etc., but it takes a lot of effort to extract the necessary parts from the enormous amount of standards and create appropriate rule data. Cost. Therefore, it is not preferable for a provider who provides rule data to a user (such as a communication service provider) of the verification device to easily obtain and use the rule data by the user.

  In order to prevent such diversion, it is conceivable that the rule data is encrypted, and the encrypted rule data is decrypted so as not to leak inside the verification device only when checking the message. In this way, the user of the verification device cannot grasp the contents of the rule data and can prevent the diversion of the rule data.

  However, depending on the user of the verification device, a part of the rule data created in advance based on the communication protocol standard or the like is used for the specification specific to the communication service to be provided by the user or the communication service. There is a case where it is desired to change to a rule based on conditions or the like peculiar to the communication device. If the rule data is encrypted as described above, it becomes impossible to meet such a user's request.

  The present invention has been made in view of the above points, and by comparing the content of a message transmitted by the device to be verified with rule data created in advance, the message transmission operation of the device to be verified is a predetermined communication method. An object of the present invention is to provide a technique for preventing the diversion of rule data and enabling the user to change the contents of the rule data in a verification device that verifies whether or not it conforms to the specifications of the above.

In order to solve the above-described problem, the present invention compares the message sent from the device to be verified with the rule data created in advance based on the specifications of a predetermined communication method, and thereby the message of the device to be verified. A specification conformity verification device for verifying whether or not a transmission operation conforms to the specifications of the predetermined communication method, and is created based on the specifications of the communication method, and includes rule data relating to a plurality of verification items. Encrypted standard rule data storage means for storing encrypted standard rule data obtained by encrypting the standard rule data including the partial rule data for storing partial rule data created for some of the verification items Read the encryption standard rule data from the data storage means and the encryption standard rule data storage means, decrypt the encryption standard rule data, and Decoding means for obtaining quasi-rule data; and reading the partial rule data from the partial rule data storage means, and converting the portion corresponding to the verification item of the partial rule data in the standard rule data to the content of the partial rule data A specification conformity verification device comprising rule data rewriting means for generating rewritten rule data by rewriting, and comparison means for performing specification conformity verification by comparing the rewritten rule data and the message. Ah it is, each rule data in the standard rule data includes a verification matters, and setting information for the verification matter, the conformance verification device, corresponding to the rewritable rule data in the standard rule data Display means for displaying verification items to be processed, and the rewritable rule data. Partial rule data creating means for receiving the setting information for the verification item, creating the partial rule data including the verification item and the inputted setting information, and storing the partial rule data in the partial rule data storage unit Are further provided as a specification conformity verification device .

  Moreover, it can also comprise as a program for making a computer implement | achieve each said means.

  According to the present invention, the encryption standard rule data is stored in the encryption standard rule data storage means, the encryption standard rule data is read from the encryption standard rule data storage means, and the encryption standard rule data is decrypted. The standard rule data is acquired, the partial rule data is read from the partial rule data storage means, and the part corresponding to the verification item of the partial rule data in the standard rule data is rewritten to the contents of the partial rule data, thereby rewriting the rule. Since the specification conformance is verified by generating the data and comparing the rewritten rule data with the message, the standard rule data is prevented from being diverted, and the user can change the contents of the standard rule data. It becomes possible to change.

  Embodiments of the present invention will be described below with reference to the drawings.

(Example of verification environment)
FIG. 1 shows an example of a verification environment using the verification apparatus according to the embodiment of the present invention. As shown in FIG. 1, the verification environment includes a verification device 1, a verification target device 2, and a test message transmission device 3, which are connected via a communication network 4.

  The verification device 1 stores rule data. By comparing a message received from the device under verification 2 via the communication network 4 with the rule data, the operation of the device under verification 2 is controlled by a predetermined communication protocol ( This is a device for verifying whether or not it conforms to the specifications related to SIP. The verified device 2 is a device such as a server scheduled to be used for a communication service, receives a test message sent from the test message sending device 3, and sends a message subjected to processing based on a communication protocol used for the communication service. It has the function to do. The verified device 2 may be a single device or a plurality of devices connected via a communication network.

  The test message sending device 3 is a device having a function of sending a test message. For example, the test message sending device 3 can send a message equivalent to the user terminal in the communication service, or send a message equivalent to the server on the network side in the communication service. The test message sending device 3 can send a message equivalent to a message sent by a plurality of user terminals, or send a message after passing through a plurality of servers. The setting of which test message is transmitted can be performed by the operation of the user who performs the test.

  In the above example, the verification device 1 and the test message transmission device 3 are separate devices, but the verification device 1 may have the function of the test message transmission device 3. Further, it is not essential for the verification device 1 to receive a message transmitted from the verification target device 2. For example, a message storage device that receives a message sent from the device to be verified 2 and stores it as a log is provided separately, and the verification device 1 acquires the log from the message storage device and compares the log with the rule data. Also good.

(Configuration of verification device)
FIG. 2 is a block diagram showing a functional configuration of the verification apparatus 1. As shown in FIG. 2, the verification apparatus 1 according to the present embodiment includes a user interface unit 11, a rule input unit 12, an operation control unit 13, a decryption unit 14, a rule rewrite unit 15, a comparison unit 16, a data storage unit 17, A message acquisition unit 18 is included.

  The user interface unit 11 is a functional unit for inputting data into the verification device 1 based on an operation by a user, outputting data from the verification device 1 to the outside, and displaying data. , Displays, communication interface devices with other devices, and the like.

  The rule input unit 12 is a functional unit for inputting encrypted standard rule data (referred to as encrypted standard rule data) or inputting unencrypted partial rule data via the user interface unit 11. It is. The input encrypted standard rule data and partial rule data are stored in the data storage unit 17.

  Note that the rule data that is created in advance by the provider of the verification apparatus 1 based on the standard specifications of the communication protocol and provided to the user of the verification apparatus 1 is called standard rule data. In the present embodiment, the standard rule data is encrypted and provided to the user, and this is called encrypted standard rule data. In the present embodiment, a part of the standard rule data can be rewritten with partial rule data created by the user of the verification device 1, and this partial rule data is referred to as partial rule data. To do.

  The operation control unit 13 is a functional unit for sending an instruction to each functional unit so that each functional unit operates in accordance with an instruction from the user (an instruction to start verification).

  The decryption unit 14 is a functional unit for reading the encrypted standard rule data from the data storage unit 17 and decrypting it. The decryption key 14 keeps the decryption key secretly. That is, when the decryption unit 14 is a functional unit realized by executing a program in the verification device 1 as a computer, for example, a decryption key is incorporated in the execution program. Also, the decryption key may be stored in the data storage unit 17 so that the user does not know the storage location. Alternatively, the decryption unit 14 itself may be realized by tamper-resistant hardware that is difficult to access from the outside to the inside, and the decryption key may be stored therein. Further, when decrypting the encrypted standard rule data, the decryption key may be obtained from a key management device provided outside via a communication network.

  The rule rewriting unit 15 receives the standard rule data decrypted from the decryption unit 14 and reads the partial rule data from the data storage unit 17 based on an instruction from the operation control unit 13. The standard rule data is rewritten by overwriting a part of the standard rule data. The rule data created by rewriting the standard rule data is called rewritten rule data.

  The comparison unit 16 receives the rewritten rule data from the rule rewriting unit 15 and compares the rewritten rule data with the message stored in the data storage unit 17. It is a functional unit that checks whether or not it conforms to the rule shown and outputs a comparison result via the operation control unit 13.

  The message acquisition unit 18 is a functional unit that is connected to the verification target device 2 via a communication network, receives a message to be verified from the verification target device, and stores it as a log in the data storage unit 17. The message acquisition unit 18 may receive the log from another device that has already stored the log, and store it in the data storage unit 17.

  The verification device 1 can be realized by executing a program in a computer having a CPU, a memory (RAM, etc.), a hard disk, and the like. The data storage unit 17 is realized by a hard disk, for example. The program may be installed in a computer from a recording medium such as a portable memory, or may be downloaded from an external server via a network and installed.

  The processing in each functional unit is a functional one realized by the cooperation of a program and hardware, but physically, the processing of each functional unit is performed on a standard rule data and partial rule on a memory. The data will be expanded. The decrypted standard rule data is not stored in the data storage unit 17 in an externally readable format (for example, a file format). This makes it difficult to read the decrypted standard rule data from the outside.

  The data storage unit 17 is a functional unit that stores encrypted standard rule data, partial rule data, and a log of messages to be verified. The data storage unit 17 may be divided into encrypted standard rule data storage means, partial rule data storage means, and log storage means.

  An example of the structure before encryption of the encryption standard rule data stored in the data storage unit 17 is shown in FIG. As shown in FIG. 3, the standard rule data includes data for identifying each verification item (such as “verification item A”) and one or a plurality of rule data corresponding to the verification item.

  The data for identifying the verification item includes the transmission source device type and the reception source device type, and the rule data of the verification item is applied to the message corresponding to the transmission source device type and the reception source device type. Also good.

  The verification items include, for example, the number of headers of the same type (also referred to as the number of header repetitions) attached to the message, header syntax, message byte size, and the like. An example of the rule data is shown in FIG. The example shown in FIG. 4 is rule data for checking whether the number of repetitions of a message header used in the SIP protocol is equal to or less than a predetermined maximum value.

  In this rule data, “Type” indicates the type of header, and “Value” indicates the maximum number of repetitions allowed for the header of the type. Information originally included in a message such as “Record-Route” of “Type” is called key information, and variable information such as “Value” is called setting information. The key information is also called a verification item. Thus, one rule data has verification items and setting information.

  In the example of FIG. 4, for example, it is shown that up to 10 “Via” headers may exist in one message. For example, if eleven “Via” headers are added to the message received from the device to be verified 2, it can be determined that the device to be verified 2 does not conform to a predetermined specification in this regard.

(Operation example of verification device)
Next, the operation of the verification apparatus 1 in the present embodiment will be described along the procedure shown in the flowchart of FIG. In this operation example, it is assumed that the standardized rule data includes the rule data of the verification item A and the rule data of the verification item B. The rule data for the verification item A is shown in FIG.

  Further, it is assumed that the standard rule data is encrypted in advance so that it can be decrypted only with a decryption key held or acquired by the verification apparatus 1 and stored in the data storage unit 17 as encrypted standard rule data.

  First, the message acquisition unit 18 acquires one or more messages to be verified from the verification target device 2, and stores them as a log in the data storage unit 17 (step 1).

  The user of the verification apparatus 1 knows the contents of the verification items and the key information (verification items) in the verification items A and B based on information disclosed from the provider of the encryption standard rule data, for example. To do. That is, the user knows that there are “Record-Route”, “Route”, and “Via” as verification items of the verification item A. Although each setting information is not disclosed, it cannot be known, but the user recognizes that the setting information set in the encryption standard rule data is a standard value when constructing a communication service network. Shall.

  Here, the user thinks that “Record-Route” and “Route” can be the number of repetitions set by the provider of the encryption standard rule data, but for “Via”, user-specific setting information is used. Suppose you want to set.

  In this case, in step 2, the user creates rule data (referred to as partial rule data) for “Via” shown in FIG. 6, for example, and inputs it to the verification apparatus 1 together with verification item identification information using the user interface unit 11. . The verification item identification information and the partial rule data are stored in the data storage unit 17 by the rule input unit 12.

  In step 2, the user may create partial rule data in the format shown in FIG. 6 by using an editor of another computer and input it via a recording medium or the like. Alternatively, only the key information in the changeable rule data is displayed on the user interface unit 11 (for example, the screen shown in FIG. 7), and the setting information corresponding to the key information is selected by the user selecting the key information whose setting information is to be changed. The user may input setting information (for example, “7” for “Via”) while viewing the screen. The changeable rule data is determined in advance by the standard rule data creator.

  Thereafter, an instruction to start verification is input from the user to the operation control unit 13 via the user interface unit 11. Receiving the instruction, the operation control unit 13 instructs each function unit to start the operation. In this embodiment, the verification process is performed for all the verification items of the encrypted standard rule data. However, the user can select a specific verification item, and the identification information of the selected verification item is set for each verification item. Each functional unit may perform verification processing using only rule data corresponding to the instructed verification item.

  The decryption unit 14 acquires the encrypted standard rule data from the data storage unit 17 and decrypts it (step 3 in FIG. 5). FIG. 8 shows an example of the structure and contents of standard rule data that has been decrypted and expanded on the memory (that is, stored in the memory). FIG. 8 includes the rule data shown in FIG. As shown in FIG. 8, the standard rule data expanded on the memory has a table format structure in which verification item information, key information corresponding to the verification item, and setting information for the key item are associated with each other. Have.

  Subsequently, the rule rewriting unit 15 reads the partial rule data input by the user in step 2 from the data storage unit 17 and expands it in the memory (step 4 in FIG. 5). FIG. 9 shows an example of the structure and contents of the partial rule data expanded in the memory. As shown in FIG. 9, the partial rule data has the same structure as the standard rule data shown in FIG.

  Then, the rule rewriting unit 15 rewrites the setting information in the standard rule data corresponding to the same verification item and key information as the verification item and key information corresponding to the read partial rule data to the setting information of the partial rule data (step 5). That is, in the example of FIGS. 8 and 9, the setting information “10” of the verification item A key information in the standard rule data is the setting information “Via” of the verification item A key information in the partial rule data. It is rewritten to “7”. FIG. 10 shows the rule data after rewriting (rewritten rule data).

  Subsequently, the comparison unit 16 reads one message from the log stored in the data storage unit 17 and compares it with the rewritten rule data to determine whether or not the specification is met. This process is performed for all messages included in the log (step 6). Then, the comparison unit 16 outputs the verification result to the user interface unit 11 via the operation control unit 13 (step 7). The verification result is, for example, information indicating OK or information indicating NG.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

It is a figure which shows an example of the verification environment using the verification apparatus in embodiment of this invention. 2 is a block diagram illustrating a functional configuration of a verification device 1. FIG. It is a figure which shows the structural example of standard rule data. It is a figure which shows an example of rule data. 3 is a flowchart showing an operation procedure of the verification apparatus 1. It is a figure which shows an example of partial rule data. It is a figure which shows the example of the screen for producing partial rule data. It is a figure which shows the example of the standard rule data expand | deployed on the memory. It is a figure which shows the example of the partial rule data expand | deployed on the memory. It is a figure which shows the example of rewritten rule data.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Verification apparatus 2 Device to be verified 3 Test message transmission apparatus 4 Communication network 11 User interface part 12 Rule input part 13 Operation control part 14 Decoding part 15 Rule rewriting part 16 Comparison part 17 Data storage part 18 Message acquisition part

Claims (1)

The message sending operation of the device to be verified conforms to the specification of the predetermined communication method by comparing the message sent from the device to be verified with the rule data created in advance based on the specification of the predetermined communication method. A specification conformity verification device for verifying whether or not
An encrypted standard rule data storage unit that stores encrypted standard rule data that is created based on the specifications of the communication method and that encrypts standard rule data that includes rule data related to a plurality of verification items;
Partial rule data storage means for storing partial rule data created with respect to some of the plurality of verification items;
Decryption means for reading the encrypted standard rule data from the encrypted standard rule data storage means, decrypting the encrypted standard rule data, and obtaining the standard rule data;
Reading the partial rule data from the partial rule data storage means, and rewriting rule data in the standard rule data by rewriting the part corresponding to the verification item of the partial rule data with the content of the partial rule data. Rule data rewriting means,
The rewrite already rule data, Ri conformance verification device der provided with a comparing means for performing conformance verification by comparing the message,
Each rule data in the standard rule data has verification items and setting information for the verification items,
The specification conformity verification device is
Display means for displaying verification items corresponding to rewritable rule data in the standard rule data;
Receiving input of setting information for verification items corresponding to the rewritable rule data, creating the partial rule data including the verification items and the input setting information, and storing the partial rule data in the partial rule data Partial rule data creation means stored in the means;
A specification conformity verification apparatus, further comprising:

Images