WO2006059572A1

WO2006059572A1 - Communication device and communication method

Info

Publication number: WO2006059572A1
Application number: PCT/JP2005/021807
Authority: WO
Inventors: Naoyuki Mochida
Original assignee: Matsushita Electric Industrial Co., Ltd.
Priority date: 2004-12-02
Filing date: 2005-11-28
Publication date: 2006-06-08

Abstract

There is provided a communication device capable of reducing the affect by an unauthorized access such as DoS attack and preventing a communication trouble, thereby continuing a service even when such an unauthorized access has occurred. In this device, a reception unit (106) establishes a first port (102) for receiving a message from a plenty of terminals or servers. When a connection request message is received from a counter device (130), the reception unit (106) established a second port (104) for communication with the counter device (130). A report unit (108) reports the established second port (104) to the counter device (130) by a message. The reception unit (106) receives the next message and after from the counter device (130) at the second port (104). A filter unit (110) filters reception data destined to the first port (102).

Description

Specification

Communication apparatus and communication method

Technical field

TECHNICAL FIELD [0001] The present invention relates to a communication device and a communication method, and in particular, when a communication device receives a call control message via a network, the reception port is set when a DoS (Denial of Service) attack is received. The present invention relates to a communication device and a communication method to be controlled. Background art

In recent years, the Internet has become widespread, and services such as Internet telephone and video distribution are being widely used. Such services that involve real-time data communication generally use call control protocols to exchange call control messages between terminals or between a terminal and a server to control connection and disconnection, as well as voice and video communication. It mediates various parameters used in the process. Since such exchange of call control messages occurs at any time during the operation of the terminal, it is necessary to always open a port for receiving call control messages.

[0003] On the other hand, since the Internet is an open network, security problems such as computer viruses and DoS attacks from malicious users often occur.

[0004] A DoS attack is to send a large amount of data to a terminal or server via a network or send illegal data to disable the original operation of the terminal or server. This is often done for public servers such as Web servers and DNS (Domain Name System) servers.

[0005] In the case of services such as Internet telephony and video distribution, terminals such as IP phones that use only public servers are also open ports for receiving call control messages and may be subject to DoS attacks. . If unauthorized access such as a DoS attack is received on the port for call control messages, the message processing load of the DoS attack increases and other processing cannot be performed, so the service cannot be continued, and further, This can cause the equipment to stop. [0006] As a general method for avoiding DoS attacks, there is a method using an IDS (Intrusion Detection System) (Patent Document 1). In this method, unauthorized access is monitored by IDS, and when IDS detects a DoS attack, a firewall is set based on the detection result, and processing such as closing the port that is attacked is performed.

[0007] As another method, a method of authenticating all accesses to a server or a terminal is also conceivable. In this method, when there is an access, it is authenticated whether it is a legitimate access, and only the data that passes the authentication is processed.

[0008] Furthermore, as another method, a method of installing a firewall on a server or terminal and closing the port when subjected to a DoS attack is conceivable (Patent Document 2). Patent Document 1: Japanese Patent Laid-Open No. 2002-252654

Patent Document 2: Japanese Patent Laid-Open No. 2003-99339

Disclosure of the invention

Problems to be solved by the invention

[0009] However, in the above-described conventional communication apparatus, the call control message port is set to Do

If an S-attack is received, there is a problem that services such as Internet telephone and video distribution cannot be continued. Therefore, as described above, each of the powers for which various methods for avoiding DoS attacks have been considered have the following problems.

[0010] First, in the method of detecting unauthorized access using IDS, it is difficult to set which access is regarded as unauthorized access. Furthermore, IDS is generally an expensive device or software, and it is difficult to install it in a low-priced device for general consumers such as a telephone or a home appliance.

[0011] In addition, in the method of authenticating access, particularly in the case of a device using a CPU (Central Processing Unit) having a low processing capacity, the processing load is high due to the reception of a large number of messages and the execution of the authentication procedure itself. However, there is still a problem that the original service cannot be continued!

[0012] In addition, when a firewall is installed and the port is closed when a DoS attack is received, it becomes impossible to receive a legitimate call control message with a partner terminal or a partner server. For this reason, for example, the call is put on hold or disconnected. There is also a problem that the original service cannot be performed, and the original service is severely restricted.

[0013] The present invention has been made in view of the strong points, and prevents the communication failure by reducing the influence of unauthorized access such as a DoS attack, and is a case where such unauthorized access is received. However, an object of the present invention is to provide a communication device and a communication method capable of continuing the original service.

Means for solving the problem

[0014] The communication device of the present invention opens a first port for receiving messages from an unspecified number of communication partners and a second port different from the first port for communication with a specific communication partner. A reception unit that receives a message from the specific communication partner at the second port after the second port is established; a notification unit that notifies the specific communication partner through the second port by a message;

And a filter unit that filters received data addressed to the first port.

[0015] The communication method of the present invention includes a step of opening a first port for receiving messages from an unspecified number of communication partners, and a first port different from the first port for communication with a specific communication partner. 2 ports are opened, and after the second port is opened, the message of the specific communication partner power is received at the second port, and the second port is notified to the specific communication partner by a message. And filtering received data addressed to the first port.

The invention's effect

[0016] According to the present invention, the influence of unauthorized access such as a DoS attack is reduced to prevent communication failure, and even if such unauthorized access is received, the original service is continued. Can do.

That is, according to the present invention, the reception port for the call control message is dynamically changed, and the original reception port and the new reception port are filtered to open the other device. Even if there is an unauthorized access such as a DoS attack to the receiving port of the call control message that must be kept, Service can be continued.

Brief Description of Drawings

FIG. 1 is a block diagram showing a schematic configuration of a network system including a communication device according to Embodiment 1 of the present invention.

FIG. 2 is a sequence diagram showing an example of message exchange between the communication device and the opposite device according to Embodiment 1 of the present invention.

FIG. 3 is a sequence diagram showing an example of message exchange between a communication device and a counterpart device according to Embodiment 2 of the present invention.

FIG. 4 is a block diagram showing a schematic configuration of a network system including a communication apparatus according to Embodiment 3 of the present invention.

FIG. 5 is a flowchart showing the operation of the communication apparatus according to Embodiment 3 of the present invention.

FIG. 6 is a block diagram showing a schematic configuration of a network system including a communication apparatus according to Embodiment 4 of the present invention.

FIG. 7 is a sequence diagram showing an example of message exchange between a communication device and a counterpart device according to Embodiment 5 of the present invention.

FIG. 8 is a diagram showing an example of an SDP part of an “INVITE” message transmitted from the communication device according to Embodiment 5 of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0020] Here, for the purposes of this specification, "opposite device" refers to a communication device to which the present invention is applied as a communication partner irrespective of the presence or absence of mediation of a server or another server, via a network. Broadly means a terminal or server that performs communication.

[0021] In this specification, "in communication" means, in a broad sense, between a communication device and a counter device until the power of the communication device is turned on and turned off. It means a period during which some kind of signal (for example, various control messages and various information (audio, video, data) messages other than control messages) is exchanged.

It means a period during which information (voice, video, data) is exchanged (for example, IP phone call or chat) between the communication device and the opposite device. [0022] (Embodiment 1)

FIG. 1 is a block diagram showing a schematic configuration of a network system including a communication apparatus according to Embodiment 1 of the present invention.

In FIG. 1, a communication device 100 is connected to a counter device 130 via a network 120. As the communication device 100 and the counter device 130, for example, various terminals such as PCs (Personal Computers), general telephones, mobile phones, and network home appliances, server devices for Internet telephones, and server devices for video distribution, respectively. Various servers are assumed.

[0024] The communication device 100 has a function of dynamically changing a call control message reception port, and opens a plurality of ports (here, only two ports 102 and 104 are shown for convenience) and ports. The receiving unit 106 that receives the message and the notification unit 108 that notifies the opposite device 130 of the newly opened port by the message. Here, for example, the first port 102 is a port for receiving messages from an unspecified number of terminals or Sanoku. The second port 104 is a port newly established for communication with the opposite device 130 in response to a connection request message from the opposite device 130. Between the first port 102 and the receiving unit 106, a filter unit 110 that filters received data addressed to the first port 102 is provided. The reception unit 106, the notification unit 108, and the filter unit 110 are provided as functions of the main CPU 112 of the communication device 100, for example.

[0025] In the following, for example, a case where the communication apparatus 100 is an Internet telephone terminal, that is, an IP telephone will be described as an example.

[0026] Communication terminal (IP telephone) 100 needs to open a port for receiving a call control message in order to receive an incoming call from another terminal or server. For example, when using SIP (Sessi on Initiation Protocol), the default port “5060” is generally opened. In FIG. 1, this port is shown as the first port 102. The receiving unit 106 opens the first port 102 at the time of startup or the like.

The opposite device 130 transmits a connection request call control message to the first port 102 in order to communicate with the communication device 100. When the communication device 100 receives the call control message at the first port 102, the communication device 100 opens the second port 104. The receiver 106 is connected to the established second port 10 4 is notified to the notification unit 108. The notification unit 108 notifies the opposite device 130 of the newly opened second port 104 via the network 120. At this time, the notification content from the notification unit 108 to the opposite device 130 is described in the call control message and sent.

FIG. 2 is a sequence diagram illustrating an example of message exchange between the communication device 100 and the opposite device 130.

[0029] Communication apparatus 100 establishes first port 102 at receiving unit 106 at the time of startup or the like (S1000).

) o

When the opposite device 130 uses SIP as a call control protocol to communicate with the communication device 100, the opposite device 130 sends an “INVITE” message to the first port 102 of the communication device 100 as a call control message for the connection request. Send (S1100). Here, the first port 102 may typically be the default port of the protocol to be used, but the communication device 100 and the opposite device 130 may be used by some means such as a DNS search or mutual agreement. Any port that is agreed upon between the two.

When the communication device 100 receives the “INVITE” message from the opposite device 130 at the first port 102, the communication device 100 needs to return the response message. At this time, the communication device 100 newly opens the second port 104 for communication with the opposite device 130 at the reception unit 106 (S1200), and then notifies the notification unit 108 of the opened second port 104. . Then, the notification unit 108 describes the second port 104 in the response message, and thereafter notifies the opposite device 130 that the second port 104 will receive the call control message (S1300). In the example shown in FIG. 2, when using SIP as the call control protocol, the communication device 100 uses the “Contact” header of the “200 OK” message, and the port for receiving the call control message thereafter is “15060”. The opposite device 130 is notified.

When the opposite device 130 receives the “200 OK” message from the communication device 100, it transmits an ACK message to the second port 104 of the communication device 100 (S 1400). This ACK message is received by the second port 104 of the communication device 100.

With the above procedure, the opposite device 130 transmits a call control message for the communication device 100 to the second port 104 of the communication device 100. As a result, the call control session between the communication device 100 and the opposite device 130 is continued at the first port 102 while the reception port is Can be switched to 2-port 104.

After the reception port for the opposite device 130 is switched to the second port 104, the reception data addressed to the first port 102 is filtered by the filter unit 110. For example, when a DoS attack message is received from the malicious user's DoS attack communication device 140 to the first port 102 (S1500), the DoS message is filtered by the filter 110 (S1 600).

At this time, the filtering rule executed by the filter unit 110 is arbitrary. That is, all data may be allowed to pass without any particular restriction, or conversely, all data may be discarded. Also, pass only a certain amount of data per unit time.

[0036] If the attack on the communication device 100 is caused by a computer virus, the filtering by the filter unit 110 is performed by, for example, a virus check.

[0037] Further, as a configuration method of the filter unit 110, in addition to the configuration using the main CPU 112 as described above, the filter unit 110 may be configured by dedicated hardware having a filtering function, or the communication device. You may make it comprise using CPU different from 100 main CPU112. In such a configuration, even if there is an unauthorized access to the first port 102, the communication with the opposite device 130 is not affected.

[0038] As described above, according to the present embodiment, a new connection is started from an old port (for example, a default port) that is likely to be illegally accessed while continuing a call control session to the opposite device 130. Because it is possible to change the receiving port to the port assigned to, the session with the opposite device 130 can be continued regardless of whether there is unauthorized access such as a DoS attack on the old port. In addition, since it is possible to perform filtering on the old port, even if unauthorized access such as a DoS attack is received on the old port, processing such as discarding can be performed for each port. The range of influence of the attack can be reduced.

That is, at first, a message such as a call control message for a connection request from the opposite device 130 is accepted at a port that is generally open, such as a default port, and then a new port is assigned to the opposite device 130. Open a new port and send it to the opposite device by message And receive subsequent messages on the new port. Therefore, it is possible to change the port that receives the message from the opposite device 130 while continuing the connection such as the call control session. Therefore, even if an unauthorized access such as a DoS attack is received on an old port or a port of another compatible device, the session with the opposite device 130 can be continued and discarded by port by filtering. This makes it possible to reduce the impact range of the attack while continuing the service.

In the present embodiment, the reception port is changed at the timing when the “INVITE” message from opposite device 130 is received, but the timing for changing the reception port is not limited to this. The receiving port can be changed at any point during communication (in a broad sense). This will be described in Embodiment 2.

[0041] (Embodiment 2)

The second embodiment is a case where the reception port is changed at an arbitrary time point during communication (broad sense). In the first embodiment, an example of changing the reception port at the timing before the start of communication in the IP telephone has been described as an example. Therefore, in this embodiment, the reception port is changed at the timing after the start of communication. Will be described as an example. Here, “after the start of communication” is a concept including communication in a broad sense.

FIG. 3 is a sequence diagram showing an example of message exchange between the communication device and the counterpart device according to Embodiment 2 of the present invention. The configuration of the system is the same as that of Embodiment 1 shown in FIG.

In the present embodiment, communication device 100 receives the call control message for the connection request from opposite device 130 at first port 102 and starts communication using first port 102 as it is. At any time during communication, the reception port to be used is switched from the first port 102 to the second port 104 while continuing the call control session with the opposite device 130.

[0044] The communication device 100 opens the first port 102 at the reception unit 106 at the time of start-up (2000)

The opposite device 130 transmits an “INVITE” message as a connection request call control message to the first port 102 of the communication device 100 (S2050).

The communication device 100 receives the “INVITE” message from the opposite device 130 at the first port 102. If it is received, a “200 OK” message is transmitted as a response message to the opposite device 130 (S2100). When the opposite device 130 receives the “200 OK” message from the communication device 100, the opposite device 130 transmits an ACK message to the first port 102 of the communication device 100 (S2150). When the communication device 100 receives the ACK message from the opposite device 130 at the first port 102, it communicates with the opposite device 130 using the first port 102 as it is, that is, the user of the communication device 100 and the opposite device 130. A call with the user is started (S2200).

[0047] Then, at an arbitrary timing after the start of the call, the communication device 100 newly opens the second port 104 for communication with the opposite device 130 (S2250), and then opens the opened second port 104. Notification unit 108 is notified. Then, the notification unit 108 describes the second port 104 in the response message, and thereafter notifies the opposite device 130 that the second port 104 will receive the call control message (S2300). In the example shown in FIG. 3, when using SIP as the call control protocol, the communication device 100 transmits an “INVITE” message in which “15060” indicating the new second port 104 is described in the “Contact” header to the opposite device 130. To do.

Here, the arbitrary timing after the start of communication is, for example, the timing of transmission / reception of various messages performed between the communication device 100 and the opposite device 130 during a call with the user of the opposite device 130. It may be! /, And may be the timing after a predetermined time has elapsed after the start of communication with the opposite device. Here, the various messages are, for example, a REGISTER message, an OPTIONS message, a BYE message, and the like.

When the opposite device 130 receives the “INVITE” message from the communication device 100, it transmits a “200 OK” message as a response message to the second port 104 of the communication device 100 (S 2350).

[0050] Upon receiving the "200 OK" message from the opposite device 130, the communication device 100 transmits an ACK message to the opposite device 130 (S2400).

[0051] Upon receiving the ACK message from communication device 100, opposite device 130 transmits a response or request call control message to second port 104 of communication device 100 thereafter.

[0052] After the reception port for the opposite device 130 is switched to the second port 104, the first port 1

The received data addressed to 02 is filtered by the filter unit 110. For example, a DoS attack message is received from the malicious user's DoS attack device 140 to the first port 102. If this is the case (S2450), filter this DoS message with filter 110 (S2500

) o

[0053] As described above, according to the present embodiment, it is possible to change the port while continuing the connection of the call control session or the like at any time during communication with the opposite device 130. Therefore, when an unauthorized access such as a DoS attack is received during communication, it is possible to change the receiving port to a new port after receiving an unauthorized access such as a DoS attack. The impact of unauthorized access such as DoS attacks can be reduced.

[0054] Also, as described above, in this embodiment, the reception port is switched during communication (in a narrow sense), that is, after the IP phone call with the user of the opposite device is started. The receiving port is switched before the IP phone call with the remote user is started.

. Therefore, during the communication in a broad sense, that is, during a period in which there is some signal exchange between the communication device and the opposite device until the communication device is turned on and turned off. Can be obtained.

[Embodiment 3]

Embodiment 3 is a case where the receiving port is changed by detecting a DoS (denial of service) attack.

FIG. 4 is a block diagram showing a schematic configuration of a network system including a communication apparatus according to Embodiment 3 of the present invention. The communication device 200 has the same basic configuration as that of the communication device 100 shown in FIG. 1, and the same components are denoted by the same reference numerals, and the description thereof is omitted.

A feature of the present invention is that it has a detection unit 202 that detects a DoS attack on each port, and when a DoS attack is detected by the detection unit 202, a reception port used for communication with the opposing device 130 is the first. It is to switch from the first port 102 to the second port 104.

[0058] The detection unit 202 detects a DoS attack addressed to the first port 102, and notifies the reception unit 106 of the detection result when a DoS attack is detected. The presence / absence of a DoS attack can be determined, for example, based on whether the number of packets received per unit time or the amount of data exceeds a preset threshold value.

Next, the operation of communication apparatus 200 in FIG. 4 will be described using FIG. Figure 5 shows the 10 is a flowchart showing the operation of the communication apparatus according to the third embodiment. In FIG. 5, it is assumed that communication device 100 is communicating with counter device 130 using first port 102.

First, in step S3000, the reception unit 106 receives the message received at the first port 102 via the filter unit 110 and the detection unit 202. At this time, the message received at the first port 102 is transmitted by a plurality of communication devices including the opposite device 130.

[0061] Then, in step S3100, the detection unit 202 determines whether or not the received message includes a DoS attack message. As described above, the presence / absence of a DoS attack can be determined by, for example, whether or not the number of packets received per unit time or the amount of data is preliminarily set! If it is determined that there is a DoS attack message (S3100: YES), the process proceeds to step S3200. If it is determined that there is no DoS attack message (S3100: NO), the first It communicates with the opposite device 130 using the port 102 (S3500).

In step S 3200, detection unit 202 notifies reception unit 106 that the DoS attack message is included in the message received at first port 102.

In step S 3300, the reception port of communication device 100 used for communication with counter device 130 is switched from first port 102 to second port 104 in response to notification from detection unit 202. As a specific procedure, for example, the method shown in FIG. 3 (Reception port change after starting communication Sagawa S2250 to S2400) can be used.

That is, first, when detecting a DoS attack on the first port 102, the communication device 200 opens a new second port 104 for communication with the opposite device 130, and then opens the second port 104 that has been opened. Is notified to the notification unit 108. Next, the notification unit 108 describes the second port 104 in the response message, and thereafter notifies the opposing device 130 that the second port 104 will receive the call control message. Specifically, when using SIP as the call control protocol, the communication device 200 transmits an “IN VITE” message in which “15060” indicating the new second port 104 is described in the “Contact” header to the opposite device 130. . When the opposite device 130 receives the “INVITE” message from the communication device 200, the opposite device 130 receives the first message of the communication device 200 as a response message. 2 A “200 OK” message is sent to port 104. When the communication device 200 receives the “200 ΟΚ” message from the opposite device 130, the communication device 200 transmits an ACK message to the opposite device 130. Upon receiving the ACK message from the communication device 200, the opposite device 130 thereafter transmits a response or request call control message to the second port 104 of the communication device 200.

In step S 3400, communication is performed with counter device 130 using second port 104.

[0066] After the reception port for the opposite device 130 is switched to the second port 104, the first port 1

The received data addressed to 02 is filtered by the filter unit 110.

[0067] Note that, as described above, the filtering rule executed by the filter unit 110 is arbitrary. In this case, it is particularly effective to discard all data because it is under DoS attack. .

[0068] In addition, if the number of packets to be filtered is measured during filtering by the filter unit 110, and the number of packets to be filtered per unit time becomes smaller than a predetermined threshold, a DoS attack is performed. Judge that it is gone and stop filtering.

[0069] In addition, as a configuration method of the filter unit 110, as in the case of the first embodiment and the second embodiment, the filter unit 110 may be configured by hardware having a filtering function, or the main CPU 112a of the communication device 200. Configuration using different CPUs is also effective in order not to affect the main CPU 112a!

[0070] As described above, according to the present embodiment, it is possible to detect a DoS attack. Therefore, at the timing of receiving the DoS attack, the call control session continues as it is and the opposite device 1 30 continues. It is possible to switch the receiving port of the DoS attack and reduce the impact of DoS attacks.

[0071] In addition, it is possible to filter the DoS attack data by the filter unit 110. In particular, if the filter unit 110 is separated as a nodeware, it is originally provided even if a DoS attack is received. It becomes possible to continue the service that had been.

[0072] In the present embodiment, when the DoS attack is detected, the communication device 200 and the opposing device 130 are communicating with each other using the first port 102. The second port 104 is used. Even in the case of communication, the same applies. For example, the second port 10 Just as when 4 is opened, the third port is opened, and the opened third port is notified to the opposite device 130. That is, a new reception port used for communication with the opposite apparatus 130 may be opened, and communication with the opposite apparatus 130 may be performed using the reception port.

In this case, it is possible to add another filter unit that filters data received at each receiving port.

[0074] (Embodiment 4)

Embodiment 4 is a case where received data addressed to a plurality of ports is filtered.

FIG. 6 is a block diagram showing a schematic configuration of a network system including the communication apparatus according to Embodiment 4 of the present invention. The communication device 300 has the same basic configuration as that of the communication device 100 shown in FIG. 1, and the same components are denoted by the same reference numerals and description thereof is omitted.

A feature of the present embodiment is that it has a plurality of filter units. Specifically, in FIG. 6, the first filter unit 302 that filters the reception data addressed to the first port 102 has a second filter unit 304 that filters the reception data addressed to the second port 104. The first filter unit 302 corresponds to the filter unit 110 in the first embodiment.

At this time, similarly to the first filter unit 302, the filtering rule executed by the second filter unit 304 is also arbitrary, and all data may be allowed to pass without any particular limitation. Alternatively, only the data from the opposite device 130 may be passed. In particular, if only the data from the opposite device 130 is allowed to pass, the service can be continued even when a DoS attack is directed to the second port 104.

Further, as the configuration method of the second filter unit 304, as in the case of the first embodiment, the second filter unit 304 may be configured by hardware having a filtering function, or a CPU different from the main CPU 112b of the communication device 300. It is also effective to configure using In such a configuration, even when there is an unauthorized access to the second port 104, it is possible not to affect the communication with the opposite device 130.

[0079] As described above, according to the present embodiment, data received at a newly opened port is received. Therefore, even if an unauthorized access such as a DoS attack is received on a new port, the unauthorized access data is filtered. Disposal and other processing are possible, and the effects of unauthorized access can be reduced.

[0080] (Embodiment 5)

The fifth embodiment relates to a method for avoiding unauthorized access to a port for receiving a voice or video signal that is not received by a port for receiving a call control message. In other words, this embodiment is a case where unauthorized access is avoided by switching the port of the main signal (voice signal) of the IP phone. The configuration of the system is the same as that of Embodiment 1 shown in FIG.

FIG. 7 is a sequence diagram showing an example of message exchange between the communication device and the counterpart device according to Embodiment 5 of the present invention.

Communication device 100 exchanges a call control protocol and exchanges a port used for IP telephone voice communication. That is, the communication device 100 opens the first port 102 for receiving audio data from the opposite device 130 (S4000).

When SIP is used as the call control message for the connection request, the communication device 100 transmits an “INVITE” message to the opposite device 130 as the call control message for the connection request (S4 050). Here, as shown in FIG. 8, when SIP is used as the call control protocol, the `` INVITE '' message transmitted by the communication device 100 includes the port received by itself in the m line of the Session Description Protocol (SDP) part. Since the number can be specified, the first port 102 is specified here and notified to the opposite device 130.

When the opposite device 130 receives the “INVITE” message from the communication device 100, it transmits a “200 OK” message to the first port 102 (S4100). Upon receiving the “200 OK” message from the opposite device 130, the communication device 100 transmits an ACK message to the communication device 130 (S4150).

When the opposite device 130 receives the ACK message from the communication device 100, the opposite device 130 transmits voice data to the first port 102 (S4200). When the communication device 100 receives the voice data from the opposite device 130, The voice data is transmitted to the opposite device 130 (S4250). [0086] In this manner, a voice data transmission / reception session between the communication device 100 and the opposite device 130 is established, and voice data transmission / reception (call) is started.

When voice communication is started from the opposite device 130, the communication device 100 receives the “riNVI TE” message and transmits a “200 OK” message to the opposite device 130. In this case as well, the port number received by itself can be specified using the m line in the SDP part of the “200 ΟΚ” message, as in the above example.

[0088] The communication device 100 newly opens the second port 104 at any time during a call (S4300), and thereafter receives a voice message at the second port 104 via the notification unit 108. To the opposite device 130 (S4350). Specifically, when using SIP as the call control protocol, the communication device 100 can specify the port number received by itself in the m line of the SDP (Session Description Protocol) part of the “INVITE” message. The second port 104 is set here, and the opposite device 130 is notified.

Upon receiving the “INVITE” message from communication device 100, opposite device 130 transmits a “200 OK” message to the call control protocol port of communication device 100 (S440 0).

When receiving the “200「 ”message from the opposite device 130, the communication device 100 transmits an ACK message to the opposite device 130 (S4450).

[0091] Upon receiving the ACK message from the communication device 100, the opposite device 130 receives the communication device 10

Audio data is transmitted to the second port 104 of 0 (S4500). In this way, the rest

The communication device 100 and the opposite device 130 use the second port 104 to start transmission / reception of voice data (call).

After the voice data reception port for the opposite device 130 is switched to the second port 104, the reception data addressed to the first port 102 is filtered by the filter unit 110. For example, when a DoS attack (for example, illegal voice data) is received on the first port 102 from the DoS attack device 140 of a malicious user (S4550), the DoS attack is filtered by the filter 110 (S4600). ).

[0093] As described above, according to the present embodiment, at any time during communication with opposing device 130, a port for receiving voice data while continuing a voice call or the like in an IP phone. The Because it is possible to change the port, it is possible to change the receiving port from the port that received unauthorized access such as DoS attack to a new port when receiving unauthorized access such as DoS attack during communication. Therefore, the impact of unauthorized access such as DoS attacks can be reduced.

[0094] In the present embodiment, the reception port is changed at any time during communication. However, the present invention is not limited to this, as shown in the third embodiment. It is also possible to change the port when a DoS attack is detected.

[0095] In addition to filtering received data addressed to the first port 102 after the port change, as shown in the fourth embodiment, the received data addressed to the second port 104 is filtered. It is also possible to do.

[0096] In addition, simultaneously with the processing of the fifth embodiment regarding voice data, the processing of the first to fourth embodiments for the call control message may be performed simultaneously. In this case, different port sets (a set of the first port 102 and the second port 104) are used for the voice data and the call control message.

[0097] This specification is based on Japanese Patent Application No. 2004-349776 filed on Dec. 2, 2004. All this content is included here.

Industrial applicability

[0098] The communication device and the communication method according to the present invention reduce the effects of unauthorized access such as DoS attacks to prevent communication failures, and even if these unauthorized accesses are received, It is useful as a communication device and a communication method that can continue this service.

Claims

The scope of the claims

[1] A first port for receiving messages from an unspecified number of communication partners;

A receiving unit that opens a second port different from the first port for communication with a specific communication partner, and receives the message of the specific communication partner power at the second port after the second port is opened;

A notification unit for notifying the specific communication partner of the second port by a message; a filter unit for filtering received data addressed to the first port;

A communication device.

[2] The receiving unit includes:

The second port is opened when the specific communication partner power connection request message is received at the first port;

The communication device according to claim 1.

[3] The receiving unit includes:

The second port is opened while communicating with the specific communication partner using the first port.

The communication device according to claim 1.

[4] a detection unit for detecting unauthorized access;

The receiver is

Opens the second port when unauthorized access is detected,

The communication device according to claim 3.

[5] a second filter unit for filtering received data addressed to the second port;

The communication device according to claim 1, further comprising:

[6] a step of opening a first port for receiving messages from an unspecified number of communication partners;

A step of opening a second port different from the first port for communication with a specific communication partner, and receiving the message of the specific communication partner power at the second port after the opening of the second port;

Notifying the specific communication partner of the second port by a message; Filtering the received data addressed to the first port.